MSOXMLMF.DLL

Microsoft Office XML MIME Filter file version info

Library on Windows 2 known copies with hashes 1 Sigma rule names it

Is it the real MSOXMLMF.DLL?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\

Signed byMicrosoft Corporation

ProductMicrosoft Office InfoPath, Microsoft Corporation

DescriptionMicrosoft Office XML MIME Filter

2 known copies

16.0.12325.20144 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL · signed by Microsoft Corporation

57f3168cf653c6a0eb40cd9775f07f5e8a921b029690731b8ac59b256faed35a

16.0.12325.20144 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLMF.DLL · signed by Microsoft Corporation

b914a8dcb197d3d4d68f24b32a4e969e487a4f3b8c4552fa3887178b83280939

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names MSOXMLMF.DLL in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.