maintenancetool[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

maintenancetool.exe
Size

10.3MB
MD5

d51d1d2718e3b9eb5651398e61d74327
SHA1

296f84b6c276fe9e91651336de83d3377ffa147b
SHA256

9e894c2620d565949e0d71e181e780ddaccc5b0d2fd70ec674e913ac7549fdcf
SHA512

a5cb4c437ec8a6a7b036c5e4acd9317b5348851b867069e5da0cc1e887a6b29e33e4d0f6c34a55ed1fc9786bd03a6ae39c95df3ae5f0eb41ab66972d38400063
SSDEEP

98304:9Ap0k+ZEtzkBIDW3TFCdsnCDyXOJWvO1pD5i4By2moI3YxkTN1JItXiy+HD:9w3dtDW30jygH7i4fI3YxkZqLy

Score

1^/10

Malware Config

Signatures

Files

maintenancetool.exe
.exe windows x64

4656eef7a3fceefc2b601028e02e0b6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

getpeername
getsockopt
closesocket
ioctlsocket
getsockname
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
bind
WSASocketW
WSAGetLastError
recv
WSAIoctl
WSASend
setsockopt
WSAGetOverlappedResult
WSARecv
listen

kernel32

FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
OutputDebugStringW
LoadLibraryW
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeleteFileW
RemoveDirectoryW
SetFileInformationByHandle
CopyFileExW
GetModuleHandleW
GetCurrentThreadId
TerminateProcess
SetLastError
ReadConsoleW
GetFileInformationByHandle
FindFirstFileW
CreateDirectoryW
FindClose
FindNextFileW
GetFullPathNameW
CreateFileW
GetCommandLineW
GetModuleFileNameW
GetTempPathW
FormatMessageW
GetEnvironmentVariableW
ReleaseSRWLockExclusive
GetCurrentDirectoryW
WriteConsoleW
TryAcquireSRWLockExclusive
GetModuleHandleA
Sleep
GetSystemInfo
IsProcessorFeaturePresent
SetHandleInformation
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
TzSpecificLocalTimeToSystemTime
GetQueuedCompletionStatusEx
CancelIoEx
InitializeSListHead
SetFileCompletionNotificationModes
CreateIoCompletionPort
PostQueuedCompletionStatus
FreeLibrary
WakeConditionVariable
SleepConditionVariableSRW
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
RtlCaptureContext
GetCurrentThread
GetCurrentProcess
GetProcAddress
RtlLookupFunctionEntry
ReleaseMutex
GetConsoleMode
GetStdHandle
HeapReAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
GetConsoleOutputCP
SetConsoleMode
SetConsoleCP
SetConsoleOutputCP
GetConsoleWindow
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
OpenProcess
K32EnumProcesses
RtlVirtualUnwind
GetCurrentProcessId
GetTimeZoneInformation
SystemTimeToFileTime
AcquireSRWLockShared
SystemTimeToTzSpecificLocalTime
AcquireSRWLockExclusive
SwitchToThread
GetEnvironmentStringsW
FileTimeToSystemTime
GetLastError
lstrlenW
GetFileInformationByHandleEx
SetFileAttributesW
CloseHandle
IsDebuggerPresent
WaitForSingleObject
GetExitCodeProcess
DuplicateHandle

user32

SetWindowPlacement
ChangeDisplaySettingsExW
ReleaseCapture
MapVirtualKeyExW
SystemParametersInfoA
GetWindowPlacement
ShowWindow
RegisterRawInputDevices
DestroyAcceleratorTable
DestroyIcon
EnumChildWindows
SendMessageW
GetUpdateRect
ValidateRect
GetRawInputData
AdjustWindowRectEx
GetMenu
RegisterWindowMessageA
MsgWaitForMultipleObjectsEx
GetKeyboardLayout
GetKeyboardState
ToUnicodeEx
SendMessageA
SetWindowLongW
GetForegroundWindow
SetWindowTextW
GetWindowTextW
MessageBoxW
EnumWindows
GetClassNameW
GetWindowRect
GetActiveWindow
GetClipCursor
CreateAcceleratorTableW
SetMenu
GetWindowLongPtrW
InvalidateRgn
SetForegroundWindow
SendInput
MapVirtualKeyW
IsProcessDPIAware
GetDC
RegisterTouchWindow
GetSystemMetrics
CreateWindowExW
RegisterClassExW
CreateIcon
WaitForInputIdle
ClipCursor
SetCapture
PostThreadMessageW
GetMonitorInfoW
DefWindowProcW
SetWindowPos
MonitorFromWindow
GetCursorPos
ClientToScreen
GetClientRect
GetWindowLongW
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
SetCursor
LoadCursorW
PostMessageW
MonitorFromRect
DestroyWindow
ShowCursor
TrackMouseEvent
GetKeyState
GetAsyncKeyState
PeekMessageW
RedrawWindow
SetWindowLongPtrW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
IsWindowVisible

ole32

CoCreateInstance
CoTaskMemFree
CoInitializeEx
RevokeDragDrop
CoTaskMemAlloc
OleInitialize
RegisterDragDrop
CoUninitialize
CoInitialize

comctl32

RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass

shlwapi

SHCreateMemStream
AssocQueryStringW

shell32

ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetKnownFolderPath
SHChangeNotify
GetCurrentProcessExplicitAppUserModelID
DragQueryFileW
DragFinish

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

secur32

ApplyControlToken
AcquireCredentialsHandleA
QueryContextAttributesW
EncryptMessage
DecryptMessage
AcceptSecurityContext
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
InitializeSecurityContextW

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateChain
CertDuplicateStore
CertOpenStore
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateContext
CertEnumCertificatesInStore
CertGetCertificateChain

advapi32

RegGetValueW
SystemFunction036
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

uxtheme

SetWindowTheme

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

psapi

GetModuleFileNameExW
EnumProcessModulesEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

vcruntime140

__current_exception_context
__current_exception
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_purecall
wcsrchr
memcpy
__CxxFrameHandler3
memmove
memset
memcmp
_CxxThrowException
strstr
strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

__setusermatherr
round
floor
trunc

api-ms-win-crt-string-l1-1-0

wcscmp
tolower
wcscpy
wcsncmp
strncmp
wcscat
wcslen
strlen
wcscpy_s
_wcsdup
strncat
strcpy
strcmp
strcat
_wcsicmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_getcwd
__p__commode
__stdio_common_vfprintf
fputws
_wfopen
__stdio_common_vswprintf
fclose
_popen
fgets
fopen
_set_fmode
_pclose
fputc

api-ms-win-crt-filesystem-l1-1-0

_stat64
_wremove
_stat64i32
_wstat64
remove

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
_set_new_mode
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-environment-l1-1-0

getenv
_wgetenv

api-ms-win-crt-runtime-l1-1-0

_wassert
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_exe
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
system
_initialize_onexit_table
_register_onexit_function
terminate
_crt_atexit

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4656eef7a3fceefc2b601028e02e0b6d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

ole32

comctl32

shlwapi

shell32

gdi32

dwmapi

secur32

crypt32

advapi32

bcrypt

uxtheme

oleaut32

api-ms-win-shcore-scaling-l1-1-1

psapi

version

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 7.1MB - Virtual size: 7.1MB

.data Size: 4KB - Virtual size: 20KB

.pdata Size: 164KB - Virtual size: 164KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 42KB - Virtual size: 41KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 7.1MB - Virtual size: 7.1MB

.data
Size: 4KB - Virtual size: 20KB

.pdata
Size: 164KB - Virtual size: 164KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 42KB - Virtual size: 41KB