1194176f51160c4576e762b6fece4910N

Sharing

Copy URL Twitter E-mail

General

Target

1194176f51160c4576e762b6fece4910N
Size

2.5MB
MD5

1194176f51160c4576e762b6fece4910
SHA1

cf9bf6b720ad71cc487049c4e949a53b318f9a6e
SHA256

af4d7d8d3d4363ece443b30e654bb26bda0bf6efbf681a924ad7f65df35d3c4b
SHA512

3111264ed7ecade3baa81206c8b4398a664e88c9d6141e9d48b4546a1a54ea7a09535679e02a683b63e80a61536c5fb5d1b31ccecfea61d6d611fb020d00ffdf
SSDEEP

49152:p58FjwDzoAoMrXWBh7WKyjTRqtHZUrWZHyDc69SJHqsuIgZ:p58Fjsz8MY8TRqt5pA

Score

1^/10

Malware Config

Signatures

Files

1194176f51160c4576e762b6fece4910N
.dll regsvr32 windows:6 windows x86 arch:x86

dbacbb3e6050e2e10a948dfdcb77dea3

Code Sign

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/09/2018, 19:45

Not After

20/09/2019, 19:45

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73
Signer

Actual PE Digest

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73

Digest Algorithm

sha256

PE Digest Matches

true

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73
Signer

Actual PE Digest

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\bb\nnlmsdk164_1\build_windows_mfts\build_dir\repos\mdp_msdk-mfts\samples\_build\Win32\Release_THM\mfx_mft_vp9ve_32.pdb

Imports

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
WaitForSingleObject
SetEvent
InitializeCriticalSection
ResetEvent
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
CreateMutexW
CreateEventW
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
ReleaseMutex
TryEnterCriticalSection
EnterCriticalSection

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoInitializeSecurity
StringFromGUID2
CoTaskMemAlloc
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
StringFromCLSID
PropVariantClear

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit

dxgi

CreateDXGIFactory

mfplat

MFTRegister
MFCreateDXGIDeviceManager
MFCreateDXSurfaceBuffer
MFCreateTrackedSample
MFTUnregister
MFUnlockWorkQueue
MFAllocateSerialWorkQueue
MFPutWorkItem
MFCreateAttributes
MFCreateEventQueue
MFCreateMediaEvent
MFCreateMediaType
MFCreateMemoryBuffer

propsys

PSCreateMemoryPropertyStore
VariantCompare
PropVariantCompareEx

d3d11

D3D11CreateDevice

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteTreeW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegCloseKey

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle
FreeEnvironmentStringsW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineW
GetStdHandle
GetCommandLineA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleA
GetModuleHandleExW
FreeLibraryAndExitThread
LoadLibraryExA
GetModuleFileNameW
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
ExitProcess
GetCurrentProcess
ExitThread
CreateThread
SwitchToThread
TlsAlloc
TlsGetValue
GetCurrentProcessId
GetProcessTimes
TerminateProcess
GetStartupInfoW
TlsSetValue
GetCurrentThreadId
TlsFree
ResumeThread

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

IsValidCodePage
IsValidLocale
FormatMessageW
GetUserDefaultLCID
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetOEMCP
EnumSystemLocalesW
GetACP
FormatMessageA

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy

api-ms-win-core-file-l1-1-0

CreateFileA
FindFirstFileW
SetFileTime
FlushFileBuffers
GetFileType
GetFullPathNameW
WriteFile
GetDriveTypeW
SetFilePointerEx
FindClose
FindFirstFileExW
CreateFileW
SetEndOfFile
FindNextFileW
GetFileAttributesW
GetFileInformationByHandle
ReadFile

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-console-l1-1-0

GetConsoleMode
SetConsoleCtrlHandler
WriteConsoleW
ReadConsoleW
GetConsoleCP

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualQuery
VirtualFree

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbacbb3e6050e2e10a948dfdcb77dea3

Code Sign

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6dCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73Signer

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

dxgi

mfplat

propsys

d3d11

api-ms-win-core-registry-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-io-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 319KB - Virtual size: 318KB

.data Size: 20KB - Virtual size: 97KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 69KB - Virtual size: 69KB

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73
Signer

71:0c:e4:f7:b3:39:74:27:17:da:d9:90:f9:d0:a4:a8:c2:7b:aa:68:e2:95:80:2b:8f:bf:d1:2a:50:3c:71:73
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 319KB - Virtual size: 318KB

.data
Size: 20KB - Virtual size: 97KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 69KB - Virtual size: 69KB