cmlua.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cmlua.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cmlua.dll
Resource
win10v2004-20240508-en
General
-
Target
cmlua.dll
-
Size
43KB
-
MD5
175c182411fbe325c48bf66913d5467e
-
SHA1
97edf984f37b5c7b300ad9b969e5ede6784422f9
-
SHA256
5a49a2ca4e807e2526c5540daea2a94e6d5e32d0b0022484b357079f3a57f10b
-
SHA512
dbdc8cd20139b4f8f5db7fd1a738a71c1cab6098e762a7263dba8a719356c3997adf94d13efba1dbae8f775ad68ad346e0dabd0fd32da57498d38509338b6065
-
SSDEEP
768:nvh43/8C5VMGP3Y0rWR7ynRRgHUVS7Jpa8z18IpmZ6B48PSyPy0SNLksgH:nvh4V5VMF4WVyRRgl7JpaW8T98639NLu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cmlua.dll
Files
-
cmlua.dll.dll windows:6 windows x64 arch:x64
f16e69cbb373eaab84f74ed088c20a91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__C_specific_handler
_vsnwprintf
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcmp
_vsnprintf
memset
cmutil
CmFree
WzToSzWithAlloc
CmMalloc
CmStrrchrW
advapi32
RegCloseKey
InitiateSystemShutdownW
AdjustTokenPrivileges
RegEnumKeyExW
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
RegDeleteValueW
LookupPrivilegeValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyW
OpenProcessToken
RegSetValueExW
kernel32
CloseHandle
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
LocalAlloc
FindNextFileW
GetCurrentProcessId
DisableThreadLibraryCalls
FormatMessageW
LocalFree
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
WideCharToMultiByte
LoadLibraryW
CreateFileW
lstrlenW
GetLastError
GetCurrentDirectoryW
GetProcAddress
FindClose
SetCurrentDirectoryW
LoadLibraryExA
shell32
SHGetFolderPathW
SHGetStockIconInfo
SHFileOperationW
ShellExecuteExW
user32
CharNextW
SendMessageW
DestroyIcon
CharPrevW
MessageBoxW
rpcrt4
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
ole32
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient15
ObjectStublessClient7
ObjectStublessClient18
ObjectStublessClient11
ObjectStublessClient13
ObjectStublessClient6
ObjectStublessClient10
ObjectStublessClient3
ObjectStublessClient5
ObjectStublessClient21
ObjectStublessClient9
ObjectStublessClient22
ObjectStublessClient20
ObjectStublessClient16
ObjectStublessClient19
StringFromGUID2
CoGetObject
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient17
Exports
Exports
DllAddRef
DllCanUnloadNow
DllGetClassObject
DllMain
DllRelease
_GetCoCreateInstanceAsAdminHandle
_RemoveShieldIcon
_SetShieldButton
_SetShieldIcon
_ThrowErrorBox
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 142B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ