msedge_elf[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
msedge_elf.dll.exe
Size 1.7MB
Sample251223-n3deaswpdx
SHA256 cdecb17866aa95ae171740ba4fc9b73b0f7a75ee817119fbe423b074c2c3e8a6
MD5 5d00dde458c1a1334db921b6a19d305d
SHA1 b310dc98ee5903eac07d6d003469a3f7caa36a13
SHA512 4e31ca39399551b72a8c3b3d75ec6488b608ecdd59d0f9c63bb52600c4ce2ff378b57616ad186a16b4a8962bcd204b231fef84a76d8e4c90ca79d4bb6161a558
SSDEEP 49152:Qrh9c3z0vPp4Gf3hClz7L/vfAtc+Y5WWQYBjG:+c3zQpWn8/bYs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
msedge_elf.dll.exe

File Explorer

msedge_elf.dll.exe

.dll 1.7MB

msedge_elf.dll.exe

IMPHASH d3774c8b4fb397ae74273ae43189678d
SHA256 cdecb17866aa95ae171740ba4fc9b73b0f7a75ee817119fbe423b074c2c3e8a6
MD5 5d00dde458c1a1334db921b6a19d305d
SHA1 b310dc98ee5903eac07d6d003469a3f7caa36a13
SHA512 4e31ca39399551b72a8c3b3d75ec6488b608ecdd59d0f9c63bb52600c4ce2ff378b57616ad186a16b4a8962bcd204b231fef84a76d8e4c90ca79d4bb6161a558
SSDEEP 49152:Qrh9c3z0vPp4Gf3hClz7L/vfAtc+Y5WWQYBjG:+c3zQpWn8/bYs
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

817888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CopyFileExW CreateDirectoryW CreateEventExW CreateFileW DuplicateHandle FileTimeToSystemTime FindClose FindFirstFileExW FormatMessageW FreeLibrary GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetFileAttributesExW GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetProcAddress GetStdHandle GetSystemTime GetThreadPriority GetTickCount64 LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException SetEvent SetLastError SetThreadErrorMode Sleep SystemTimeToFileTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread FlushProcessWriteBuffers GetThreadContext SetThreadContext GetSystemTimeAsFileTime CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead

ole32

CoWaitForMultipleHandles CoGetApartmentType CoUninitialize CoInitializeEx CoCreateGuid

api-ms-win-crt-math-l1-1-0

log ceil

api-ms-win-crt-heap-l1-1-0

free malloc calloc _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp strlen strcmp strcpy_s strcpy

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

terminate _cexit abort _seh_filter_dll _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e _initterm

114Fj5wy2VPbFxMhfTNd 25iMcgbai3s6BS 28AWz7ZGSOj2LVSIYaP4N5SGuu 38pYCBhW2aaLish3pHt20yB 3Hhumww54WEChMt8hh1wfO 7KuQ8282E8yAsFBo2t8L4I6 7hTUW7iLWnqNnE7VoSpK23BT 7hvzX7ww8s874X1 7t19Fp60JTt3Y2aJ03DvcwgQO80ueamA ??0PwaHelperImpl@edge_pwahelper@@QEAA@XZ ??1PwaHelperImpl@edge_pwahelper@@UEAA@XZ ??_7PwaHelperImpl@edge_pwahelper@@6B@ ?AppendMojoServerBindingInfo@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z ?BadgeNotification@PwaHelperImpl@edge_pwahelper@@UEAAXW4BadgeNotificationType@mojom@2@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@Z ?BindWidgetManager@PwaHelperImpl@edge_pwahelper@@AEAAXV?$ScopedHandleBase@VMessagePipeHandle@mojo@@@mojo@@@Z ?DigitalGoodsAbortPaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z ?DigitalGoodsConsume@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@@Z@base@@@Z ?DigitalGoodsGetDetails@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@V?$allocator@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z ?DigitalGoodsInvokePaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4PurchaseResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z ?DigitalGoodsListPurchaseHistory@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z ?DigitalGoodsListPurchases@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z ?GetAppAcquisitionDetail@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4AcquisitionInfoResponseCode@mojom@edge_acquisition_info@@V?$InlinedStructPtr@VAcquisitionDetails@mojom@edge_acquisition_info@@@mojo@@@Z@base@@@Z ?GetAppLocalFolderPath@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@W4LocalFolderResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z ?InitMojo@PwaHelperImpl@edge_pwahelper@@AEAAXXZ ?InitializeAppUserModelIdForCurrentProcess@PwaHelperImpl@edge_pwahelper@@QEAA_NXZ ?IsCurrentAppPinnedToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z ?OnClientConnected@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVWaitableEvent@base@@@Z ?PinTileToStart@PwaHelperImpl@edge_pwahelper@@UEAAXXZ ?PinTileToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXXZ ?SetPwaHwnd@PwaHelperImpl@edge_pwahelper@@UEAAX_K@Z ?SetSingletonProcessId@PwaHelperImpl@edge_pwahelper@@UEAAXI@Z ?Shutdown@PwaHelperImpl@edge_pwahelper@@AEAAXI@Z ?StartAppWithIncomingMojo@PwaHelperImpl@edge_pwahelper@@QEAAXVPlatformChannelEndpoint@mojo@@@Z ?StartAppWithPlatformChannel@PwaHelperImpl@edge_pwahelper@@QEAAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@@Z ?StartProcessWithMojoIPC@PwaHelperImpl@edge_pwahelper@@QEAAKPEAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@V?$unique_ptr@VScopedTempDir@base@@U?$default_delete@VScopedTempDir@base@@@__Cr@std@@@45@@Z ?TryActivateInstance@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z ?ValidateHandShake@PwaHelperImpl@edge_pwahelper@@AEAAXXZ A4rMu5rrN ATK9cmh21Tj8 ATc8iyD Ak4ulSm8 AoNAMzEfCdm9euJCllTF B3HJGy5b3P8uwp0A8YHl0vS5hQ CAn37Yf5YkTXej ClearReportsBetween_ExportThunk CrashForException_ExportThunk D6EapPCGrgcrUR DdMVtk5 DisableHook DrainLog DumpHungProcessWithPtype_ExportThunk DumpProcessWithoutCrash EdgeElfBeaconDetect EdgeGetElfCommandLine EdgeGetElfLoadThreadId EdgeGetInjectionMitigationStatus EdgeGetMitigationHistogramData EdgeModuleIsEnumerated EdgeModuleIsLoaded F5TzJMN5IjvtPNSvZKHXpL9OjaFO G7ALry1k2drp GB98DIlR2TvTKDG GetApplyHookResult GetBlockedModulesCount GetCrashReports_ExportThunk GetCrashpadDatabasePath_ExportThunk GetHandleVerifier GetInstallDetailsPayload GetProductInfo_ExportThunk GetUniqueBlockedModulesCount GetUploadConsent_ExportThunk GetUserDataDirectoryThunk HAOL6jyH5bDl HBpMEcZJNC6H HRuhMOxGyu InjectDumpForHungInput_ExportThunk IsBrowserProcess IsExtensionPointDisableSet IsTemporaryUserDataDirectoryCreatedForHeadless IsThirdPartyInitialized JlqP5dAUFOkr Jo6gyttHL JrAgRLEoOxaH35 K3bCexk5SFTBracavCWviD KTd3vVEGjSOuExzHXOfBy2VMAq Kj8Fb3VT KmNpv7aCrdvhcz6QDGsrHBdlYGxx MSgHyEGL6sZv3N42Q7mUz8IyvqJfvVc NE1yw9hgG NVFSg8xvnFuQFLeo7UMQ79p Nae3WVoCWB3p9L O8fzn89vYmX9Wd8NVlbw1z OXt3J0dBzw6Uy4Z1dGqHJSefI3bmVi9H P8j3Hh3CPxNNzRLSDh9 PWscynYVRDDCAWXhU83a R3rC81zJ34vSfLcENZM2aPZXdjq RegisterLogNotification RequestSingleCrashUpload_ExportThunk SetMetricsClientId SetTelemetryLevel_ExportThunk SetUploadConsent_ExportThunk SignalChromeElf SignalInitializeCrashReporting StartAppWithParameter T6UJqhqOkLuZzGVGOJWAC U9UvM5eBFDDq6Qoxti UH6ERKR UjV9L8gOBAunso VSWmadwJZ7akNz07O2uPEbsC WSEUJFWj1VfichZrwxF WdwCbhNX X4e32qq5wgdADpiqBfuxJ9WPmndJl Xe91uv3Z0rO3of4yPrhh9VbCruhA XoC0qLQ3P0TQhK1s YG2TjFpQbU7KjuAwQ YaQ65wEsponZ0RhNWelPNY7lmmW ZUwvdxUbayVnEox ZqocCjr00qTpNxuo aJb6lpr38uwhMw1mX9DrIK9cHC363rc bQArgVqrxDOFFCzoD bgjtkG6RjHkWl5 cJ65qSEmT cVc2ZkCY8v0MnY0FxfKSW3 csK29FsrhRdhY1gMAOlwm6mrLJ7Ly eKSXFEFfqCwlYyOVV2 eiCafrM6xmOQrHk1XfqHdnn8 h1itlijfReUGHB2ebRB h8cz32QBtcFx j6SmakGx88Yr jAjgjLkdxn5MS jWRX9B1Rwmrvl9AkBU jpZo9Qd9MFSAxIFAwv3o l5MGgBkLbWI9jPoBbrTsnd2IjEdat1 lZxcyKIqfSxsFtkGFY85b3BAaDVxd llFwaWzuAiJszkVmY llbk2lMSFV8Il mD06XkGW3jpR1r22RbKsvH mptptnMcebmko3B7PZdPAl nmzF2iaUdhL ntKQgUu999GCg7s p64QWWfRJwyQDw pCzTYMULQdOlu2LB5ld9T4S1YZW qX46JgTpFkiDly qbN09nE5J4VtmFpVN8L3fgiHQOFEsHyY qqvT1MDn rGV6wqCgWXa8Q2gcU rZyDB2zmV4iwU1My91U rjEfhQRQ slTido64fBplQGuekpeTkbigo7F spEUCWIqdOrIQylH8tgN0R044Vm7 uQ77MsPZq9k5eEIDglkqSKu wFYVzLUxfRuKZG x0Z7H7SBJhMi3hWHr xBMWGxImnSEgPNrfUCxKbSE9J9IsNO yh2OnPwdVKdlb zC2cfhiq0YSDp6dWjeFf zPOSH132MFox5ZN7WE