ef93ed6be37cfde1f82703b039067fec1a649eba74dfefd5429566dad07e014b

Sharing

Copy URL Twitter E-mail

General

Target

ef93ed6be37cfde1f82703b039067fec1a649eba74dfefd5429566dad07e014b
Size

349KB
MD5

cc1250e1ce9f340a645b5e11c914676d
SHA1

07c41aa9fa7d1b2a534c03d084563011f3d34238
SHA256

ef93ed6be37cfde1f82703b039067fec1a649eba74dfefd5429566dad07e014b
SHA512

c7a0e06543f91368eb4ee0d361b4a84436ddcbebd466be0a408983283ecd8dece3f6be7353d3f343ce26d446d7aab3926af80e7b7d70087e2c6f60e25a03d336
SSDEEP

6144:v4rnolIIN78OPIph0lhSMXlBXBW//csoITWXw8:vSaUph0lhSMXleksyg8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef93ed6be37cfde1f82703b039067fec1a649eba74dfefd5429566dad07e014b

Files

ef93ed6be37cfde1f82703b039067fec1a649eba74dfefd5429566dad07e014b
.dll windows:6 windows

ec117db17064c333ba56c22dd0df07c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\ARM\MepInterop.Winrt\MepInterop.Winrt.pdb

Imports

mfsensorgroup

MFCreateCameraControlMonitor

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

mfplat

MFCreateAttributes

msvcp140_app

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Incref@facet@locale@std@@UAAXXZ
??1_Locinfo@std@@QAA@XZ
??1_Lockit@std@@QAA@XZ
?c_str@?$_Yarn@D@std@@QBAPBDXZ
??0_Locinfo@std@@QAA@PBD@Z
??0_Lockit@std@@QAA@H@Z
_Mbrtowc
?_Gettrue@_Locinfo@std@@QBAPBDXZ
?_Xbad_alloc@std@@YAXXZ
?_Getfalse@_Locinfo@std@@QBAPBDXZ
?_Getcvt@_Locinfo@std@@QBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QBAPBUlconv@@XZ
?_Decref@facet@locale@std@@UAAPAV_Facet_base@3@XZ
??1facet@locale@std@@MAA@XZ
??0facet@locale@std@@IAA@I@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
??Bid@locale@std@@QAAIXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

vcruntime140_app

_purecall
__C_specific_handler
__std_exception_copy
__std_type_info_destroy_list
__std_terminate
__CxxFrameHandler3
memset
memmove
memcpy
memcmp
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_initialize_narrow_environment
_configure_narrow_argv
abort
_cexit
_crt_atexit
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_errno
_invalid_parameter_noinfo
_register_onexit_function
_execute_onexit_table

api-ms-win-crt-string-l1-1-0

strlen
iswspace

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free
calloc

api-ms-win-crt-math-l1-1-0

_fdclass
_ldclass
_dsign
_fdsign
_dclass
_ldsign

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

oleaut32

GetErrorInfo
SysFreeString
SysAllocString
SetErrorInfo
SysStringLen

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-util-l1-1-0

EncodePointer

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec117db17064c333ba56c22dd0df07c5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfsensorgroup

api-ms-win-core-com-l1-1-0

mfplat

msvcp140_app

vcruntime140_app

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

oleaut32

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 84KB

.rdata Size: 192KB - Virtual size: 192KB

.data Size: 58KB - Virtual size: 58KB

.pdata Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 84KB - Virtual size: 84KB

.rdata
Size: 192KB - Virtual size: 192KB

.data
Size: 58KB - Virtual size: 58KB

.pdata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB