MrmCoreR[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MrmCoreR.dll
Size

606KB
MD5

ef6fd7c89dd2e3fc360df71453cf9f44
SHA1

a7e3015f8126a1b6e90374eabacaea9078bde7e0
SHA256

06432c1ef12172e8677bf48f418fb333dce5935b9a3591f40520cb46ba299e89
SHA512

83b03dedaa58fc4c871d1dcc995147819267d527dcea1fe48bc04b9c66b7b3785bdc944e2cd3a0d34ef1bab91ea70ee37c659a120120b8d21881a7adad46c223
SSDEEP

6144:f2uaRpZr7zksIuatvOrbfpx0N4DPNWEYMqp3zyk3iyo/5mbmFKr+yKwo+fJOs:e5PNR8vO5PDPNWEYMzEiL/5Xw9KAos

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MrmCoreR.dll

Files

MrmCoreR.dll
.dll regsvr32 windows:6 windows x86 arch:x86

1d18fa19fb7a10ca30d93d6052aeed3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MrmCoreR.pdb

Imports

msvcrt

wprintf
isalpha
_ui64tow_s
towlower
wcsnlen
qsort
qsort_s
_wcsnicmp
_wtof
wcstoul
_wcstoi64
memmove
??0exception@@QAE@ABQBD@Z
bsearch
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
towupper
memcmp
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
_purecall
__CxxFrameHandler3
??1type_info@@UAE@XZ
_errno
realloc
_except_handler4_common
memmove_s
memset
wcsrchr
_ftol2
_vsnwprintf
wcsncmp
wcschr
_itow_s
_wtoi
_wcsicmp
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
_ftol2_sse
iswspace
iswalnum
iswdigit
memcpy

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory
RoUninitialize
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
HSTRING_UserFree
HSTRING_UserUnmarshal
WindowsDeleteString
WindowsCreateString
HSTRING_UserMarshal
WindowsConcatString
WindowsCreateStringReference
WindowsGetStringLen
WindowsDuplicateString
HSTRING_UserSize

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
IsErrorPropagationEnabled

rpcrt4

NdrDllUnregisterProxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
RpcStringFreeW
UuidToStringW
NdrStubCall2
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
UuidCreate
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-synch-l1-2-0

CreateEventW
SignalObjectAndWait
DeleteCriticalSection
Sleep
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
InitializeCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegGetValueW
RegSetValueExW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-core-string-l1-1-0

CompareStringEx
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-localization-l1-2-1

SetThreadLocale
GetThreadLocale
GetUserPreferredUILanguages
GetGeoInfoW
GetUserGeoID

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime

api-ms-win-core-file-l1-2-1

GetFileTime
FindClose
CreateFileW
FindNextFileW
ReadFile
WriteFile
FlushFileBuffers
GetFileSizeEx
GetFileAttributesW
FindFirstFileW
GetFinalPathNameByHandleW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
CompareFileTime
GetFileAttributesExW
DeleteFileW

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken
CreateThread
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-security-base-l1-2-0

GetAce
AddAccessAllowedAceEx
GetLengthSid
GetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-localization-private-l1-1-0

_GetMUIStringFromCache
_AddMUIStringToCache
_OpenMuiStringCache

combase

ord11
ord16
ord7
ord14
ord13
ord33
ord32
ord10
ord12
ord5
ord9
ord8
ord34
ord15
ord3
ord22
ord17
ord2
ord4
ord20
ord21
ord6
ord18
ord19

ntdll

RtlUnsubscribeWnfStateChangeNotification
RtlInitializeSRWLock
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQuerySystemInformation
RtlReportException
RtlSubscribeWnfStateChangeNotification

api-ms-win-appmodel-identity-l1-1-0

AppXGetOSMaxVersionTested

bcp47langs

?GetApplicationLanguages@CLanguagesListFactory@Internal@Windows@@SGJPBGPAPBVCLanguagesList@23@@Z
?GetUserLanguages@CLanguagesListFactory@Internal@Windows@@SGJPAPBVCLanguagesList@23@@Z
?IsWellFormedTag@CLanguage@Internal@Windows@@SG_NPBG@Z
??0CLanguage@Internal@Windows@@QAE@PBG@Z
?FindClosestInList@CLanguage@Internal@Windows@@QBEJPBGW4BCP47_COMPARISON_ALGORITHM@23@PAPBGPAN@Z
?GetSubtagFields@CLanguage@Internal@Windows@@QBEJW4BCP47_SUBTAG_FLAGS@23@PAG@Z
Bcp47GetDirectionality
?IsValidRegionTag@CRegion@Internal@Windows@@SG_NPBG@Z
??0CRegion@Internal@Windows@@QAE@PBG@Z
?Compare@CRegion@Internal@Windows@@QBEJABV123@PAN@Z
?GetCompositeRegionCode@CRegion@Internal@Windows@@QBEIXZ
?GetCompositeRegionCode@CRegion@Internal@Windows@@SGII@Z
GetApplicationLayoutDirection
?CreateInstance@CLanguagesList@Internal@Windows@@SGJPBGPAPBV123@@Z

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
GetInternalReferenceBlobForManifestValue
GetMergedSystemPri
GetStringValueForManifestField
MergeResourcePackPri
MergeSystemPriFiles
ResourceManagerQueueGetCurrentDepth
ResourceManagerQueueGetString
ResourceManagerQueueGetStringDirect
ResourceManagerQueueIsResourceReference
ResourceManagerQueueReset

Sections

.text
Size: 541KB - Virtual size: 541KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d18fa19fb7a10ca30d93d6052aeed3c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

rpcrt4

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-private-l1-1-0

combase

ntdll

api-ms-win-appmodel-identity-l1-1-0

bcp47langs

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 541KB - Virtual size: 541KB

.orpc Size: 1024B - Virtual size: 798B

.data Size: 4KB - Virtual size: 4KB

.idata Size: 9KB - Virtual size: 9KB

minATL Size: 512B - Virtual size: 24B

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 541KB - Virtual size: 541KB

.orpc
Size: 1024B - Virtual size: 798B

.data
Size: 4KB - Virtual size: 4KB

.idata
Size: 9KB - Virtual size: 9KB

minATL
Size: 512B - Virtual size: 24B

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 29KB - Virtual size: 28KB