GameBarPresenceWriter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GameBarPresenceWriter.exe
Size

83KB
MD5

673918546f367f837baea7ae68d44e37
SHA1

927be0a77ac71a92e2d40c8ed2bf012c49ec0e02
SHA256

a5bfc098e67f7fb99798352f27f85a67e52e735301529d96e62c0d43d829fdb7
SHA512

85e200b4857b6055059e7ff87b9fcd4c8cb01b76effad52babb0a90eaeac887c122cee71d50867395a1d8d815b251bbee02c584fd585c6c835116fe3980caa2e
SSDEEP

1536:6pNGP/7NMrhTHNbhCOchm+U7wCw76PXjcea5p7Iyph6yVL:6pU/7NMtCbhmrwCXjcey6sL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GameBarPresenceWriter.exe

Files

GameBarPresenceWriter.exe
.exe windows x86

046d5026b233d60e4f6c3ecda3207cdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegGetValueW
RegCreateKeyExW
RegCloseKey
RegNotifyChangeKeyValue
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

kernel32

GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
LoadLibraryExW
CreateEventExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
ReleaseSRWLockExclusive
CloseThreadpoolTimer
AcquireSRWLockExclusive
CreateThreadpoolWait
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolTimer
DeleteCriticalSection
ParseApplicationUserModelId
EncodePointer
InitializeCriticalSection
CreateEventW
SetEvent
ReleaseSRWLockShared
DecodePointer
LocalFree
AcquireSRWLockShared
WriteFile
CreateFileW

msvcp_win

?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Xbad_function_call@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_XGetLastError@std@@YAXXZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o___p___argc
_o___p___wargv
_o___p__commode
_o___std_exception_copy
_o___std_exception_destroy
_o___stdio_common_vfwprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o_exit
_o_free
_o_malloc
_o_memset
_o_terminate
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
_o___acrt_iob_func
__std_terminate
memmove
memcpy

ole32

CoCreateInstance
CoAddRefServerProcess
CoReleaseServerProcess
CoTaskMemAlloc
CoRegisterClassObject
CoResumeClassObjects
CoInitializeSecurity
CoRevokeClassObject
CLSIDFromProgID

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsDuplicateString
WindowsStringHasEmbeddedNull

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoRevokeActivationFactories
RoRegisterActivationFactories

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

oleaut32

SysFreeString
SafeArrayGetUBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
VariantInit

rpcrt4

UuidHash

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
IsProcessorFeaturePresent
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

046d5026b233d60e4f6c3ecda3207cdb

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ole32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-power-setting-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

Sections

.text Size: 64KB - Virtual size: 64KB

.data Size: 5KB - Virtual size: 6KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 64KB - Virtual size: 64KB

.data
Size: 5KB - Virtual size: 6KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB