SpeechRuntime[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SpeechRuntime.exe
Size

298KB
MD5

2a542da86900053c9c09b7a00b4e41c5
SHA1

fd8efce43f599a5562bdf7ba729937ef46b1eb6a
SHA256

c48dbfa782376baaa00daf312ff8f4bdb7923bb227aa38c49c3dd91328a4b39a
SHA512

f105bff1d003319d4f7243b2475d1cdd122f117748b6a57331ad836ac9288212bdec691badf03b767a191248f026dee8f49d8f9e6c016d1ddc10c5a84baf8fe7
SSDEEP

3072:GONIhWMfXAQLj4GPq3VzqZ3kZRy6bAu+54KvD9frYxSa3Z/o5St1U+Ns7HGM6wS:F4WVqUGIWl6o54KbRrYxXlo5Sv6KM6

Score

1^/10

Malware Config

Signatures

Files

SpeechRuntime.exe
.exe windows x64

07a40b99afffee729893078e4366c15d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp110_win

??0id@locale@std@@QEAA@_K@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z
?_Xbad_function_call@std@@YAXXZ
?_Orphan_all@_Container_base0@std@@QEAAXXZ

msvcrt

??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_vsnprintf
_vscwprintf
_vsnwprintf_s
memmove_s
_beginthreadex
memset
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
memmove
memcpy
memcmp
__RTDynamicCast
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
_fmode
_CxxThrowException

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer

api-ms-win-security-base-l1-1-0

AccessCheck
CreateWellKnownSid
GetTokenInformation

api-ms-win-core-com-l1-1-0

CoInitializeSecurity
CoCreateInstance
StringFromCLSID
CoTaskMemAlloc
CoUninitialize
CoRevokeClassObject
CoReleaseServerProcess
CoAddRefServerProcess
CoRegisterClassObject
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoResumeClassObjects
CoWaitForMultipleHandles
CoCreateGuid

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
LoadStringW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-synch-l1-1-0

ResetEvent
WaitForSingleObject
ReleaseMutex
SetEvent
CreateMutexW
CreateEventW
InitializeCriticalSection
ReleaseSemaphore
ReleaseSRWLockShared
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
LeaveCriticalSection
OpenSemaphoreW
CreateWaitableTimerExW
CreateSemaphoreExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenMutexW
CreateEventExW
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSize
HeapAlloc
HeapSetInformation
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsCompareStringOrdinal

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
CreateThread
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetExitCodeThread

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoRegisterActivationFactories
RoActivateInstance
RoUninitialize
RoRevokeActivationFactories
RoInitialize

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolWait
SubmitThreadpoolWork
CloseThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWait

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW
StrCmpCW

mmdevapi

ord21
ord27

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegFlushKey
RegCloseKey
RegNotifyChangeKeyValue

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
ReportEventW
DeregisterEventSource

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-url-l1-1-0

UrlCreateFromPathW

api-ms-win-core-wow64-l1-1-0

Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

coremessaging

CoreUICreate

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification

powrprof

PowerReadACValueIndex

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07a40b99afffee729893078e4366c15d

Headers

DLL Characteristics

File Characteristics

Imports

msvcp110_win

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

mmdevapi

api-ms-win-core-registry-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-provider-l1-1-0

bcrypt

api-ms-win-core-synch-l1-2-1

api-ms-win-core-libraryloader-l1-2-1

coremessaging

api-ms-win-power-setting-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

ntdll

powrprof

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 177KB - Virtual size: 176KB

.rdata Size: 98KB - Virtual size: 98KB

.data Size: 4KB - Virtual size: 9KB

.pdata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 80B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 177KB - Virtual size: 176KB

.rdata
Size: 98KB - Virtual size: 98KB

.data
Size: 4KB - Virtual size: 9KB

.pdata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 80B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB