cmutil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cmutil.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cmutil.dll
Resource
win10v2004-20240508-en
General
-
Target
cmutil.dll
-
Size
56KB
-
MD5
b7dfd436a0dccb86b4c6f6da1a6eb172
-
SHA1
aac8de4046825b1ef1903588e8cd769801f657c9
-
SHA256
a1350ba914d46ba7184e8f02d1e69858fa89b74264613d3083fa034ba53ef524
-
SHA512
27081bf9e8c681c29cc81b49fbaf96311ae9e7af97eeab57d0a492bd87d3eb3ddde4655e6772d7080cda3d21593bab5bc18df5f219c21f59bfcd57da86649b87
-
SSDEEP
1536:iKB+Q4AKwQki7g+n3/1bNmsmkrqJxU0AlsxU:irZARQkiE+n3RAU0AlsxU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cmutil.dll
Files
-
cmutil.dll.dll windows:6 windows x64 arch:x64
f3a9e6d8530747664867fadc02738eaf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memset
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
_vsnwprintf
_vsnprintf
advapi32
RegOpenKeyExW
RegQueryValueExA
RegCreateKeyExA
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegSetValueExA
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
gdi32
DeleteObject
GetObjectA
CreateFontIndirectW
kernel32
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
CompareStringA
SetLastError
GetStringTypeExA
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetStringTypeExW
TlsSetValue
TlsGetValue
GetCurrentProcessId
TlsFree
TlsAlloc
DisableThreadLibraryCalls
GetProcAddress
GetTimeFormatW
LoadLibraryW
GetCurrentProcess
FreeLibrary
GetDateFormatW
ExpandEnvironmentStringsW
lstrcmpiW
GetTempPathW
FlushFileBuffers
lstrcmpW
GetFileAttributesW
GetVersionExW
WideCharToMultiByte
GetSystemDirectoryW
WriteFile
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetPrivateProfileStringA
WritePrivateProfileStringA
CloseHandle
GetPrivateProfileStringW
CreateFileW
lstrlenW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetFileSize
SetFilePointer
SetEndOfFile
HeapAlloc
HeapFree
CreateDirectoryW
HeapReAlloc
GetLastError
GetTickCount
CreateFileA
lstrlenA
GetPrivateProfileIntA
GetProcessHeap
user32
CharNextW
SendMessageW
LoadImageA
GetSystemMetrics
LoadImageW
LoadStringW
CharUpperW
CharNextA
LoadStringA
CharPrevW
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
??0CIniA@@QEAA@PEAUHINSTANCE__@@PEBD111@Z
??0CIniW@@QEAA@PEAUHINSTANCE__@@PEBG111@Z
??0CRandom@@QEAA@I@Z
??0CRandom@@QEAA@XZ
??0CmLogFile@@QEAA@XZ
??1CIniA@@QEAA@XZ
??1CIniW@@QEAA@XZ
??1CmLogFile@@QEAA@XZ
??4CIniA@@QEAAAEAV0@AEBV0@@Z
??4CIniW@@QEAAAEAV0@AEBV0@@Z
??4CRandom@@QEAAAEAV0@AEBV0@@Z
??4CmLogFile@@QEAAAEAV0@AEBV0@@Z
??_FCIniA@@QEAAXXZ
??_FCIniW@@QEAAXXZ
?Banner@CmLogFile@@QEAAXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IEBAHPEAUHKEY__@@PEBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IEBAPEAEPEAUHKEY__@@PEBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IEBAHPEAUHKEY__@@PEBD1PEBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IEBAHPEAUHKEY__@@PEBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IEBAPEAEPEAUHKEY__@@PEBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IEBAHPEAUHKEY__@@PEBG1PEBEKK@Z
?CIni_SetFile@CIniA@@KAXPEAPEADPEBD@Z
?CIni_SetFile@CIniW@@KAXPEAPEAGPEBG@Z
?Clear@CIniA@@QEAAXXZ
?Clear@CIniW@@QEAAXXZ
?Clear@CmLogFile@@QEAAXH@Z
?CloseFile@CmLogFile@@AEAAJXZ
?DeInit@CmLogFile@@QEAAJXZ
?FormatWrite@CmLogFile@@AEAAXW4_CMLOG_ITEM@@PEAG@Z
?GPPB@CIniA@@QEBAHPEBD0H@Z
?GPPB@CIniW@@QEBAHPEBG0H@Z
?GPPI@CIniA@@QEBAKPEBD0K@Z
?GPPI@CIniW@@QEBAKPEBG0K@Z
?GPPS@CIniA@@QEBAPEADPEBD00@Z
?GPPS@CIniW@@QEBAPEAGPEBG00@Z
?Generate@CRandom@@QEAAHXZ
?GetFile@CIniA@@QEBAPEBDXZ
?GetFile@CIniW@@QEBAPEBGXZ
?GetHInst@CIniA@@QEBAPEAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QEBAPEAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QEAAPEBGXZ
?GetPrimaryFile@CIniA@@QEBAPEBDXZ
?GetPrimaryFile@CIniW@@QEBAPEBGXZ
?GetPrimaryRegPath@CIniA@@QEBAPEBDXZ
?GetPrimaryRegPath@CIniW@@QEBAPEBGXZ
?GetRegPath@CIniA@@QEBAPEBDXZ
?GetRegPath@CIniW@@QEBAPEBGXZ
?GetSection@CIniA@@QEBAPEBDXZ
?GetSection@CIniW@@QEBAPEBGXZ
?Init@CRandom@@QEAAXK@Z
?Init@CmLogFile@@QEAAJPEAUHINSTANCE__@@HPEBD@Z
?Init@CmLogFile@@QEAAJPEAUHINSTANCE__@@HPEBG@Z
?IsEnabled@CmLogFile@@QEAAHXZ
?LoadEntry@CIniA@@IEBAPEADPEBD@Z
?LoadEntry@CIniW@@IEBAPEAGPEBG@Z
?LoadSection@CIniA@@QEBAPEADPEBD@Z
?LoadSection@CIniW@@QEBAPEAGPEBG@Z
?Log@CmLogFile@@QEAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AEAAJXZ
?SetEntry@CIniA@@QEAAXPEBD@Z
?SetEntry@CIniW@@QEAAXPEBG@Z
?SetEntryFromIdx@CIniA@@QEAAXK@Z
?SetEntryFromIdx@CIniW@@QEAAXK@Z
?SetFile@CIniA@@QEAAXPEBD@Z
?SetFile@CIniW@@QEAAXPEBG@Z
?SetHInst@CIniA@@QEAAXPEAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QEAAXPEAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QEAAXPEBD@Z
?SetICSDataPath@CIniW@@QEAAXPEBG@Z
?SetParams@CmLogFile@@QEAAJHKPEBD@Z
?SetParams@CmLogFile@@QEAAJHKPEBG@Z
?SetPrimaryFile@CIniA@@QEAAXPEBD@Z
?SetPrimaryFile@CIniW@@QEAAXPEBG@Z
?SetPrimaryRegPath@CIniA@@QEAAXPEBD@Z
?SetPrimaryRegPath@CIniW@@QEAAXPEBG@Z
?SetReadICSData@CIniA@@QEAAXH@Z
?SetReadICSData@CIniW@@QEAAXH@Z
?SetRegPath@CIniA@@QEAAXPEBD@Z
?SetRegPath@CIniW@@QEAAXPEBG@Z
?SetSection@CIniA@@QEAAXPEBD@Z
?SetSection@CIniW@@QEAAXPEBG@Z
?SetWriteICSData@CIniA@@QEAAXH@Z
?SetWriteICSData@CIniW@@QEAAXH@Z
?Start@CmLogFile@@QEAAJH@Z
?Stop@CmLogFile@@QEAAJXZ
?WPPB@CIniA@@QEAAXPEBD0H@Z
?WPPB@CIniW@@QEAAXPEBG0H@Z
?WPPI@CIniA@@QEAAXPEBD0K@Z
?WPPI@CIniW@@QEAAXPEBG0K@Z
?WPPS@CIniA@@QEAAXPEBD00@Z
?WPPS@CIniW@@QEAAXPEBG00@Z
?Write@CmLogFile@@AEAAJPEAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc
Sections
.text Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ