winmm[.]dll | Triage™

General

Target
winmm.dll
Size 145KB
Sample260830-1pcxtssxhx
SHA256 0271b0f8c27fe35feefc0e69b7453e62b91d9d21b736a47f9b5244555200c914
MD5 59586b98af63870e8739cbd1be7af4e9
SHA1 203e489adb3b6111da5256f0a9b35c6678dfdb69
SHA512 b0d9595d87dc5b8eaf75011291f93f77b019563c28829512a47c493719dfb8bd341ff3ad4e66dcdd0571200a7515c35d550e7664354a18ca98dca2a0fa34b41f
SSDEEP 1536:+/ZakoL9u7H4x6wMJQ2Sx7lZ2JTH+SnwblrfvHZuzEQBFesWr7yd09dlxnKByp6H:wEab4RH9GxeAwbdHoZBQYMNk/kOsHt0
TLSH
T13EE36D17B7A510BFD17B8974C8930A05EB72BC924790ABDF13905EA60E13BD48E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winmm.dll

File Explorer

winmm.dll

.dll 145KB

winmm.dll

IMPHASH 8b44b9410d39f78ad1872321993c97cb
SHA256 0271b0f8c27fe35feefc0e69b7453e62b91d9d21b736a47f9b5244555200c914
MD5 59586b98af63870e8739cbd1be7af4e9
SHA1 203e489adb3b6111da5256f0a9b35c6678dfdb69
SHA512 b0d9595d87dc5b8eaf75011291f93f77b019563c28829512a47c493719dfb8bd341ff3ad4e66dcdd0571200a7515c35d550e7664354a18ca98dca2a0fa34b41f
SSDEEP 1536:+/ZakoL9u7H4x6wMJQ2Sx7lZ2JTH+SnwblrfvHZuzEQBFesWr7yd09dlxnKByp6H:wEab4RH9GxeAwbdHoZBQYMNk/kOsHt0
TLSH
T13EE36D17B7A510BFD17B8974C8930A05EB72BC924790ABDF13905EA60E13BD48E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

18236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualProtect GetModuleFileNameW GetSystemDirectoryW GetModuleHandleA DisableThreadLibraryCalls LoadLibraryW GetProcAddress ExitProcess WriteConsoleW CreateFileW HeapCreate HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep GetLastError HeapReAlloc CloseHandle HeapAlloc GetThreadContext GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread VirtualFree VirtualAlloc GetSystemInfo VirtualQuery QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

MessageBoxW

CloseDriver DefDriverProc DriverCallback DrvGetModuleHandle GetDriverModuleHandle NotifyCallbackData OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage WOW32DriverCallback WOW32ResolveMultiMediaHandle WOWAppExit aux32Message auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joy32Message joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mci32Message mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc mid32Message midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion mod32Message mxd32Message sndPlaySoundA sndPlaySoundW tid32Message timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite wid32Message wod32Message

Name

.text

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winmm.dll

kernel32

user32

generic