MrmIndexer[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MrmIndexer.dll
Size

646KB
MD5

7085bdfbe5f179c96808aaa35119db71
SHA1

ac94e606aa6e8534e281fd99164e125dd4e80470
SHA256

2d33c5d9a178888fde6b4318eb134064899c015b5a4313b6d45047712c301ac7
SHA512

0a82e473fec28274644fc36634b981f6b9c9ba45d4b4bd535f3488850f8fb23e7a72751a09c20da9f53c677d851d7534083575485f59dfb43c6efd1d34c57bbb
SSDEEP

12288:uEKqlPGJ0CKYRjXWqD9/OsYcbysUCFkjD6Kox56:JKqluJXJWkmsysrFkjD6Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MrmIndexer.dll

Files

MrmIndexer.dll
.dll windows:10 windows x86 arch:x86

5f5ff92b3d622997c12b2edfa8879112

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MrmIndexer.pdb

Imports

msvcrt

_except_handler4_common
??0exception@@QAE@ABQBD@Z
__CxxFrameHandler3
_onexit
memmove_s
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
towlower
_wtoi
wcscpy_s
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
wcschr
wcsnlen
wcsncmp
wcsstr
wprintf
_vsnwprintf
fclose
iswdigit
_vsnprintf_s
_wcsnicmp
wcscspn
strcspn
localeconv
memchr
sprintf_s
_wcsicmp
_wfopen
_fileno
fread
_filelengthi64
_wtof
isalpha
isxdigit
strtol
isdigit
wcsrchr
towupper
iswalnum
iswspace
_ui64tow_s
wcsncpy_s
qsort_s
qsort
setlocale
___mb_cur_max_func
_errno
___lc_handle_func
___lc_codepage_func
__pctype_func
__mb_cur_max
__crtLCMapStringW
__crtGetStringTypeW
abort
__uncaught_exception
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
realloc
memcpy_s
fgetwc
_purecall
??1type_info@@UAE@XZ
__iob_func
vwprintf_s
wprintf_s
_ftol2
_ftol2_sse
memcmp
memcpy
memset

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
GetRestrictedErrorInfo
RoReportFailedDelegate
SetRestrictedErrorInfo
RoTransformError
RoOriginateError
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

CreateMutexExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
InitializeCriticalSection
AcquireSRWLockShared
EnterCriticalSection
Sleep
LeaveCriticalSection
InitOnceExecuteOnce
CreateEventExW
SetEvent
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObject
ReleaseSRWLockShared
InitializeSRWLock

api-ms-win-core-com-l1-1-1

CoMarshalInterface
CoReleaseMarshalData
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
RoGetAgileReference
CreateStreamOnHGlobal

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
OpenProcessToken
OpenProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

bcp47langs

FormatLanguageTag
IsWellFormedTag
GetDistanceOfClosestLanguageInList
CompareBcp47Tags
GetParentCompositeRegionCode
GetCompositeRegionCode
GetClosenessOfUnIsoRegionTags
IsValidUnIsoRegionTag
IsValidTag

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW

api-ms-win-security-base-l1-2-0

FreeSid
GetTokenInformation
AddAccessAllowedAceEx
GetLengthSid
EqualSid
GetAce
AllocateAndInitializeSid

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetProcAddress

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventRegister

oleaut32

VariantChangeType
SysStringLen
VariantChangeTypeEx
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
SysFreeString
SysAllocString

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRelativePathToW
PathRemoveBackslashW
PathFileExistsW
PathIsRelativeW

api-ms-win-core-localization-l1-2-1

FormatMessageW
LCMapStringEx

api-ms-win-core-file-l1-2-1

FlushFileBuffers
CreateDirectoryW
WriteFile
CompareFileTime
CreateFileW
GetFinalPathNameByHandleW
GetFileAttributesExW
GetFileSize
FindNextFileW
GetTempPathW
GetFullPathNameW
GetFileAttributesW
FindFirstFileW
SetFilePointer
FindClose
ReadFile
GetFileSizeEx
DeleteFileW

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW
GetNamedSecurityInfoW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

shcore

ord170

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 598KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f5ff92b3d622997c12b2edfa8879112

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

bcp47langs

api-ms-win-core-url-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

oleaut32

api-ms-win-core-string-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-security-provider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

rpcrt4

api-ms-win-core-libraryloader-l1-2-2

shcore

Exports

Exports

Sections

.text Size: 598KB - Virtual size: 597KB

.data Size: 5KB - Virtual size: 7KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 598KB - Virtual size: 597KB

.data
Size: 5KB - Virtual size: 7KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 31KB