MFMediaEngine[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MFMediaEngine.dll
Size

3.4MB
MD5

251710f5735db001a0204fe17c3aba54
SHA1

00222bcf99a2e3111730bf28237f5dd3901a3d28
SHA256

49daa6ed3a8a57ba4051c007e816aaed578f1005c76aa2edc3163898ccab53e5
SHA512

88d345861cc40ce31ae646c620fd9c5a610aca7179925ba4dc5b01f2bbaabec970cb17876d3003dbba6ccc6b1d0a996f151b0c80009ac6579cde04d9a7974c96
SSDEEP

49152:zZqlsIsyjbCc+iNToFGsQpVMzcZK0PeTj4IqwfeGR4twmFhj46u/ehhPtrK:8hsySc+UT0XQpVHMmRj4r/e3Pt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MFMediaEngine.dll

Files

MFMediaEngine.dll
.dll windows:10 windows x86 arch:x86

0848fc0eff915cd54d281d98ba29281b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MFMediaEngine.pdb

Imports

msvcrt

memmove
_lock
_unlock
setlocale
_i64toa_s
___mb_cur_max_func
___lc_handle_func
_gcvt_s
strcspn
___lc_codepage_func
_ismbblead
memset
localeconv
sprintf_s
ldexp
__uncaught_exception
__pctype_func
isupper
??0bad_cast@@QAE@PBD@Z
calloc
abort
_wcsdup
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
_wtof
_wtoi
wcstod
__crtCompareStringW
_ftol2_sse
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__mb_cur_max
_onexit
__dllonexit
??0exception@@QAE@ABQBD@Z
_errno
isxdigit
_initterm
_amsg_exit
strnlen
strtol
_strtoui64
_XcptFilter
_strnicmp
_ltoa_s
wcsrchr
wcsstr
wcschr
wcspbrk
??0exception@@QAE@ABQBDH@Z
strncpy_s
isdigit
isalnum
_vsnprintf_s
time
ctime
atoi
wcstombs_s
memmove_s
iswdigit
iswalpha
towupper
wcscspn
swscanf
??1exception@@UAE@XZ
memcmp
?what@exception@@UBEPBDXZ
__CxxFrameHandler3
wcscpy_s
___lc_collate_cp_func
swscanf_s
memchr
isspace
_Strftime
_Gettnames
_wcsicmp
_Wcsftime
_W_Gettnames
_ui64toa_s
_ultow_s
towlower
tolower
_ltow_s
_W_Getmonths
_W_Getdays
_Getmonths
_Getdays
memcpy
_vsnprintf
_CxxThrowException
??0exception@@QAE@XZ
isalpha
islower
_free_locale
_ultoa_s
realloc
_stricmp
isprint
_get_current_locale
__crtLCMapStringA
_finite
_isnan
_vsnwprintf
__crtLCMapStringW
_wcsnicmp
wcsncmp
qsort
memcpy_s
??0exception@@QAE@ABV0@@Z
wcstok_s
_callnewh
malloc
free
_purecall
strncmp
__crtCompareStringA
_ftol2
floor

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
CreateMutexExW
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForMultipleObjectsEx
SetWaitableTimer
ResetEvent
DeleteCriticalSection
CreateWaitableTimerExW
CreateMutexW
OpenSemaphoreW
AcquireSRWLockShared
WaitForSingleObjectEx
InitializeCriticalSection
SetEvent
CreateEventW
WaitForSingleObject
InitializeSRWLock
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
LeaveCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
LoadStringW
FreeLibrary

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsSetValue
OpenProcessToken

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNW
StrStrW
StrToIntW
StrCmpW
StrCmpIW
StrChrW
StrSpnW
StrStrIW
StrTrimW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
GetStringTypeW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegEnumKeyExW
RegGetValueW
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount64

api-ms-win-core-url-l1-1-0

UrlHashW

api-ms-win-core-path-l1-1-0

PathCchFindExtension
PathIsUNCEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy

api-ms-win-power-base-l1-1-0

PowerUnregisterSuspendResumeNotification
PowerRegisterSuspendResumeNotification

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalFree

xmllite

CreateXmlReader

api-ms-win-core-shlwapi-legacy-l1-1-0

IsCharSpaceW

api-ms-win-core-string-l2-1-0

IsCharAlphaW

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-file-l1-1-0

SetFilePointerEx
CreateFileA
WriteFile
SetFilePointer
FlushFileBuffers

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpiA

api-ms-win-appmodel-runtime-l1-1-2

AppPolicyGetMediaFoundationCodecLoading
AppPolicyGetWindowingModel
AppPolicyGetLifecycleManagement

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFullName
GetPackagesByPackageFamily
PackageIdFromFullName

api-ms-win-dx-d3dkmt-l1-1-0

GdiEntry13

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-console-l1-1-0

AllocConsole

api-ms-win-core-console-l2-2-0

SetConsoleTitleW

bcrypt

BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptDecrypt

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

rtworkq

RtwqSetLongRunning

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0848fc0eff915cd54d281d98ba29281b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-power-base-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

xmllite

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-appmodel-runtime-l1-1-2

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-2-0

bcrypt

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

rtworkq

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.data Size: 7KB - Virtual size: 13KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 688B

.rsrc Size: 74KB - Virtual size: 74KB

.reloc Size: 220KB - Virtual size: 220KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 7KB - Virtual size: 13KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 688B

.rsrc
Size: 74KB - Virtual size: 74KB

.reloc
Size: 220KB - Virtual size: 220KB