mpsvc[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mpsvc.dll
Size 352KB
Sample260822-p8n9esvbpd
SHA256 a141bc7fcc7fa2631ffadbadf852d554e449f30f7d0ac282ed08932d06360a5d
MD5 b24477e3bbe52adc94e86cab196d011d
SHA1 dd0a90eb5e77c91e81d171c3753de1474f085b22
SHA512 6fa1d0b75ae6f23dd7e6b7f86313897fae57528ed5c74d8d7cc23eb922c35da173080dbd93cb2f3012eb34114b044f192c0bd7945d7593529c5256365984a78d
SSDEEP 6144:CRH9RBQtsFMIloOMLALtLLNph0lhSMXlBXBWn5ikVkgGtf:gRVFc7eBBph0lhSMXli5iT
TLSH
T184749D22FB9441BCD19B827989B74E42F772788D034297CF13A892613F676D26E3F641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mpsvc.dll

File Explorer

mpsvc.dll

.dll 352KB

mpsvc.dll

IMPHASH 004f3c9e976ac93230f3154767700a51
SHA256 a141bc7fcc7fa2631ffadbadf852d554e449f30f7d0ac282ed08932d06360a5d
MD5 b24477e3bbe52adc94e86cab196d011d
SHA1 dd0a90eb5e77c91e81d171c3753de1474f085b22
SHA512 6fa1d0b75ae6f23dd7e6b7f86313897fae57528ed5c74d8d7cc23eb922c35da173080dbd93cb2f3012eb34114b044f192c0bd7945d7593529c5256365984a78d
SSDEEP 6144:CRH9RBQtsFMIloOMLALtLLNph0lhSMXlBXBWn5ikVkgGtf:gRVFc7eBBph0lhSMXli5iT
TLSH
T184749D22FB9441BCD19B827989B74E42F772788D034297CF13A892613F676D26E3F641
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

164188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\repos\ransomsvc\WindowsClient\x64\Release\mpsvc.pdb

kernel32

CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetCurrentProcessId UnhandledExceptionFilter IsDebuggerPresent SetUnhandledExceptionFilter SizeofResource HeapFree GetModuleHandleA GetLastError LockResource LoadResource FindResourceW HeapAlloc GetProcessHeap ExpandEnvironmentStringsA MultiByteToWideChar GetComputerNameA FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LocalFree

shell32

ShellExecuteA

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$numpunct@D@std@@2V0locale@2@A ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?good@ios_base@std@@QEBA_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey BCryptEncrypt BCryptDecrypt BCryptGetProperty BCryptCloseAlgorithmProvider

winhttp

WinHttpConnect WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData

vcruntime140

_CxxThrowException memcpy __std_exception_copy __std_exception_destroy memmove __C_specific_handler memset memchr __std_type_info_destroy_list __std_terminate memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

system _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _seh_filter_dll abort _execute_onexit_table _crt_atexit _errno exit _cexit _invalid_parameter_noinfo_noreturn _initterm _initterm_e _register_onexit_function

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos fsetpos fread _fseeki64 fgetc fclose fflush _get_stream_buffer_pointers fputc __stdio_common_vsprintf ungetc fwrite

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc calloc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtod

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-math-l1-1-0

_ldsign _fdsign _dsign