SearchIndexer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SearchIndexer.exe
Size

862KB
MD5

64040ad6d9bfc185dc53a7c36698579b
SHA1

12cb143afd4ca1c145800d3c936f893b115fda00
SHA256

1f45561af6e75a8db41c0e59aad8aa222dea400d36e73f243158450495fe9daf
SHA512

9c704ef5d45c7902b5aa2494e361329c0195dd86e3134c4a0b408021c1fcf6d65e3c8f99fb0ed54a1b3169a0330cd8bb7db9a8dba78c71e0dad8d6822b2d730d
SSDEEP

24576:Oot74Z0tQyEuwGkOkEQSAa2kqbiQheQQxuGw:TtUiDBBQGFqbiQheQQ0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchIndexer.exe

Files

SearchIndexer.exe
.exe windows x86

2dc4c67eb4a1a814c6196b9f51e61297

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
___lc_codepage_func
realloc
___lc_handle_func
_errno
___mb_cur_max_func
___lc_collate_cp_func
_except_handler4_common
setlocale
??1type_info@@UAE@XZ
_onexit
memcmp
toupper
__dllonexit
wcstok
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
abort
??0bad_cast@@QAE@ABV0@@Z
_unlock
_lock
strchr
vswprintf_s
?terminate@@YAXXZ
wcspbrk
_acmdln
qsort
_get_errno
_set_errno
_initterm
bsearch
_wcsdup
__setusermatherr
memset
_ismbblead
__p__fmode
strncmp
__crtCompareStringW
__pctype_func
_cexit
_exit
exit
__set_app_type
__getmainargs
swscanf
_amsg_exit
__p__commode
_XcptFilter
towupper
memmove
memcpy
_CxxThrowException
_wtol
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
wcschr
__crtLCMapStringW
calloc
wcsncpy_s
_get_current_locale
malloc
wcscat_s
iswxdigit
wcscpy_s
_free_locale
_wcslwr_s
wcsncmp
_wcsnicmp
__CxxFrameHandler3
free
wcsstr
_vscwprintf
_wcsicmp
wcstol
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
iswspace
_vsnwprintf

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
LockResource
GetModuleHandleW
FindStringOrdinal
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
SizeofResource
LoadStringW
FreeLibrary
LoadResource
FindResourceExW

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
GetVolumeInformationW
FindVolumeClose
CreateDirectoryW
GetFileAttributesExW
FindFirstFileW
RemoveDirectoryW
SetFileAttributesW
FindFirstFileExW
FindNextVolumeW
FindNextFileW
GetDriveTypeW
FindClose
GetLogicalDrives
CompareFileTime
GetFileTime
GetFileAttributesW
CreateFileW
SetFileTime
DeleteFileW

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
InitOnceExecuteOnce
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventExW
DeleteCriticalSection
SetEvent
CreateMutexExW
CreateMutexW
CreateEventW
ReleaseSRWLockExclusive
ReleaseMutex
OpenEventW
WaitForSingleObject
InitializeCriticalSectionEx
OpenSemaphoreW
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapSize
HeapAlloc
HeapSetInformation
HeapFree
HeapReAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-com-l1-1-0

PropVariantClear
CoInitializeEx
IIDFromString
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoUninitialize
CoTaskMemAlloc
CoRevertToSelf
CoImpersonateClient
CLSIDFromString
CoCreateInstance
CoGetMalloc
CoRevokeClassObject
CoInitializeSecurity
CoTaskMemFree
CoRegisterClassObject
CoMarshalInterface
StringFromGUID2

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWork
CloseThreadpoolTimer
CreateThreadpool
WaitForThreadpoolTimerCallbacks
CloseThreadpool
CloseThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolCleanupGroup

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TlsFree
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
OpenProcessToken
SetPriorityClass
GetStartupInfoW
TlsAlloc

ntdll

RtlIsStateSeparationEnabled
RtlQueryPackageClaims
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtOpenFile
RtlNtStatusToDosError
RtlInitUnicodeString
RtlGetPersistedStateLocation

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegDeleteValueW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegGetKeySecurity
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-core-localization-l1-2-0

GetSystemPreferredUILanguages
ResolveLocaleName
LCMapStringW
LocaleNameToLCID
GetNLSVersionEx
GetSystemDefaultLCID
GetLocaleInfoW
FormatMessageW

oleaut32

LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetUBound
SysAllocStringByteLen
VarBstrCat
VariantInit
VarUI4FromStr
VariantClear
SysStringLen
SysFreeString
SafeArrayGetElement
SysAllocString
SysStringByteLen

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsUNCW
PathRemoveBackslashW
PathFindNextComponentW
PathCanonicalizeW
PathAddBackslashW
PathIsRootW
PathIsUNCServerW
PathAppendW
PathIsUNCServerShareW
PathSkipRootW
PathFileExistsW
PathStripToRootW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SearchPathW
GetEnvironmentVariableW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventEnabled
EventUnregister
EventProviderEnabled
EventActivityIdControl
EventWriteTransfer

api-ms-win-shcore-registry-l1-1-0

SHSetValueW
SHDeleteKeyW
SHGetValueW
SHCopyKeyW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount64
GetVersionExA
GetVersionExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy
OpenProcess

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNew
ciNewNoThrow
ciDelete

shcore

SHStrDupW
ord1

mssrch

??1CSearchServiceObj@@QAE@XZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGXXZ

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNICW
StrStrIW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

Sections

.text
Size: 612KB - Virtual size: 611KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2dc4c67eb4a1a814c6196b9f51e61297

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

oleaut32

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

shcore

mssrch

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

rpcrt4

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

Sections

.text Size: 612KB - Virtual size: 611KB

.data Size: 3KB - Virtual size: 10KB

.idata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 372B

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 612KB - Virtual size: 611KB

.data
Size: 3KB - Virtual size: 10KB

.idata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 372B

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 40KB - Virtual size: 40KB