PasswordOnWakeSettingFlyout[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

PasswordOnWakeSettingFlyout.exe
Size

37KB
MD5

fd11340ff20ac2e56afce294f23fbf85
SHA1

c4fc24ef049700b869c01d40433d66ca2852cecb
SHA256

622ed60aabb0f9d2b23c182ffa932facf6826392ad37e8bac78c915ee744015f
SHA512

098e1582e43858041de483b0f1a1349eb42ec9249eb7ccf57080cee622c18c3e86411b466165648b44638313a31671664279eaceedba964fbb854df3201a5853
SSDEEP

768:QhpqZS9KV4wDnzKXsa/M8/78cvW1o5VC/INXv4FKE39zrxu/KxyNk+Bj65MZixlG:QhpqZS9KV4wDnzKXsa/M8/78cvW1o5V3

Score

1^/10

Malware Config

Signatures

Files

PasswordOnWakeSettingFlyout.exe
.exe windows x86

05046586364e929993f51cbd48e583cd

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:04:58:d7:28:eb:6a:f0:ae:b9:d8:3a:fa:0d:93:07:88:9b:c9:79:12:64:1e:0c:7d:88:49:c0:96:97:dd:88
Signer

Actual PE Digest

fc:04:58:d7:28:eb:6a:f0:ae:b9:d8:3a:fa:0d:93:07:88:9b:c9:79:12:64:1e:0c:7d:88:49:c0:96:97:dd:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError

user32

LoadStringW

msvcrt

free
_wtoi
_vsnwprintf
memset
memcpy_s
malloc
_callnewh
_purecall
_XcptFilter
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_controlfp
?terminate@@YAXXZ
__CxxFrameHandler3
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode

api-ms-win-core-com-l1-1-0

CoUninitialize
CoGetMalloc
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
WaitForSingleObject
ReleaseSemaphore

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecW
SHGetThreadRef
PathAppendW

uxtheme

GetCurrentThemeName

dui70

?SetRootWindowForTheming@DUIXmlParser@DirectUI@@QAEXPAUHWND__@@@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?GetSheet@DUIXmlParser@DirectUI@@QAEJPBGPAPAVValue@2@@Z
UnInitThread
InitThread
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
UnInitProcessPriv
StartMessagePump
InitProcessPriv
?Destroy@Element@DirectUI@@QAEJ_N@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJPBGPAUHINSTANCE__@@1@Z
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@00@Z

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05046586364e929993f51cbd48e583cd

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

fc:04:58:d7:28:eb:6a:f0:ae:b9:d8:3a:fa:0d:93:07:88:9b:c9:79:12:64:1e:0c:7d:88:49:c0:96:97:dd:88Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-apiquery-l1-1-0

shell32

shlwapi

uxtheme

dui70

Sections

.text Size: 17KB - Virtual size: 16KB

.imrsiv Size: - Virtual size: 4B

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

fc:04:58:d7:28:eb:6a:f0:ae:b9:d8:3a:fa:0d:93:07:88:9b:c9:79:12:64:1e:0c:7d:88:49:c0:96:97:dd:88
Signer

.text
Size: 17KB - Virtual size: 16KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB