MMDevAPI[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MMDevAPI.dll
Size

344KB
MD5

aa60d1648da8cffe3dc989e5fc82abb2
SHA1

76f68dd79970290ab7b9d669d7fa62978577a328
SHA256

c5db4791dede28631258ee2a09c66093ba631f67ca3df675d94332ef41d6e13d
SHA512

7663adf27ae0aa28d78b0fb0503e96dc5bfed2823fb3a728ee1ecd2e1ab1fbe917bde16d1a494d835a3cdf0c090f478a00217a172c48f834e29fce0d4f48d5d6
SSDEEP

6144:6q6q5F7xzEtGE5K+hEeuBd2KSmA9c5zibm575r5RqX:6qb5FmtG0K+hEeuBd2Lmdz+QJe

Score

1^/10

Malware Config

Signatures

Files

MMDevAPI.dll
.dll regsvr32 windows:10 windows x86 arch:x86

b860f30b4ba68540bd07e64aff1e4523

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:2e:39:8a:f0:84:92:27:85:58:dc:62:b4:79:f5:22:f8:e1:dd:f8:67:dd:8a:d4:5c:90:a9:84:3e:24:1b:6b
Signer

Actual PE Digest

ad:2e:39:8a:f0:84:92:27:85:58:dc:62:b4:79:f5:22:f8:e1:dd:f8:67:dd:8a:d4:5c:90:a9:84:3e:24:1b:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MMDevAPI.pdb

Imports

msvcrt

_vsnwprintf
??1type_info@@UAE@XZ
realloc
_initterm
_amsg_exit
?terminate@@YAXXZ
_XcptFilter
_lock
_unlock
_onexit
memset
__CxxFrameHandler3
_vsnprintf
__dllonexit
_errno
_except_handler4_common
memcmp
_CxxThrowException
wcstol
_ftol2_sse
_wtoi
wcsncmp
_wcsicmp
wcstoul
memmove_s
calloc
wcscat_s
wcscpy_s
_resetstkoflw
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
memcpy

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
LoadStringW
GetModuleFileNameW
GetModuleHandleW
SizeofResource
FindResourceExW
LoadResource
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
AcquireSRWLockExclusive
DeleteCriticalSection
CreateEventW
ReleaseSRWLockShared
InitializeSRWLock
OpenSemaphoreW
SetEvent
WaitForSingleObjectEx
ReleaseSemaphore
CreateEventExW
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
ResetEvent
Sleep
ReleaseSRWLockExclusive
TryEnterCriticalSection
InitOnceExecuteOnce
CreateMutexExW
InitializeCriticalSection

api-ms-win-core-heap-l1-2-0

HeapDestroy
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-2

ProcessIdToSessionId
GetCurrentThreadId
OpenThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
CompareStringOrdinal

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale
FormatMessageW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

RpcBindingFromStringBindingW
NdrClientCall4
RpcStringFreeW
RpcStringBindingComposeW

ntdll

EtwSendNotification
EtwNotificationUnregister
EtwNotificationRegister
EtwLogTraceEvent
ShipAssert
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlQueryPackageClaims
EtwTraceMessage

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolWorkCallbacks
CreateThreadpoolIo
CreateThreadpoolTimer
CancelThreadpoolIo

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-io-l1-1-1

CancelSynchronousIo
DeviceIoControl
CancelIoEx
GetOverlappedResultEx

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount64
GetLocalTime
GetSystemTime
GetTickCount

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-service-private-l1-1-1

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-core-file-l1-2-1

CreateFileW
CompareFileTime

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

devobj

DevObjGetDeviceInterfacePropertyKeys
DevObjGetDeviceInterfaceAlias
DevObjGetDeviceInterfaceProperty
DevObjOpenDeviceInterfaceRegKey
DevObjSetDeviceProperty
DevObjGetDeviceProperty
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjOpenDeviceInterface
DevObjOpenDeviceInfo
DevObjGetDeviceInstanceId
DevObjEnumDeviceInfo
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList
DevObjSetDeviceInterfaceProperty

propsys

PropVariantToGUID

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ActivateAudioInterfaceAsync
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 32B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b860f30b4ba68540bd07e64aff1e4523

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ad:2e:39:8a:f0:84:92:27:85:58:dc:62:b4:79:f5:22:f8:e1:dd:f8:67:dd:8a:d4:5c:90:a9:84:3e:24:1b:6bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

rpcrt4

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-localization-private-l1-1-0

api-ms-win-core-profile-l1-1-0

devobj

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 298KB - Virtual size: 298KB

RT_BSS Size: - Virtual size: 32B

.data Size: 2KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 212B

RT_DATA Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ad:2e:39:8a:f0:84:92:27:85:58:dc:62:b4:79:f5:22:f8:e1:dd:f8:67:dd:8a:d4:5c:90:a9:84:3e:24:1b:6b
Signer

.text
Size: 298KB - Virtual size: 298KB

RT_BSS
Size: - Virtual size: 32B

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 212B

RT_DATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB