fsutil[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fsutil.exe
Size

163KB
MD5

452ca7574a1b2550cd9ff83ddbe87463
SHA1

e98b328b51ff18d2042c0a75cf8f5f882fbac4bb
SHA256

b732e4e29a2d768417bbcd1b18368b1ba9bfecf0eb4af320c27b5d800d1f8da2
SHA512

cae5d6c7271bd6be2d4d87538e4142330c87ca84032b8222829126c950f13a84e64900daf1f35ef6afb26d9ffb3ec1968cfda6ee88d91edb14ca91131b56452e
SSDEEP

3072:Oy90dPKnlGwgbLOAZc7ejIKsvF6oW/GAYbHOeMFNa/zob48OQrq7w:KKn0Pb5qejIKMF6oFAN7FNa/zu48Ouq

Score

1^/10

Malware Config

Signatures

Files

fsutil.exe
.exe windows x86

6b1f6721fd39601739eb215e5fba7364

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:71:66:71:0c:99:48:80:b9:b8:6f:6d:29:d3:4f:bf:a5:c5:7f:32:c1:b5:8e:59:b2:47:63:72:fa:f7:22:9d
Signer

Actual PE Digest

02:71:66:71:0c:99:48:80:b9:b8:6f:6d:29:d3:4f:bf:a5:c5:7f:32:c1:b5:8e:59:b2:47:63:72:fa:f7:22:9d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
wcstol
memmove
memcpy
_local_unwind4
wcstok_s
_wcstoui64
wcstoul
iswctype
_errno
exit
__setusermatherr
wcsncpy_s
memcpy_s
wcscpy_s
realloc
towupper
_wtoi
wcsrchr
wcschr
_wcsicmp
wcscat_s
isalpha
isdigit
toupper
setlocale
calloc
_initterm
_vsnwprintf
_exit
_cexit
wprintf
swprintf_s
_controlfp
_except_handler4_common
malloc
free
_wcsdup
?terminate@@YAXXZ
_wcsnicmp
__p__fmode
memset

ntdll

NtClose
RtlVerifyVersionInfo
VerSetConditionMask
NtQuerySystemInformation
RtlTimeToTimeFields
RtlStringFromGUID
NtEnumerateTransactionObject
RtlInitializeCriticalSection
RtlGetOwnerSecurityDescriptor
RtlAllocateHeap
NtQuerySecurityObject
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtCreateFile
RtlFreeHeap
NtFlushBuffersFileEx
RtlSetCurrentTransaction
RtlGetCurrentTransaction
NtSetQuotaInformationFile
NtQueryQuotaInformationFile
RtlLengthSid
NtSetVolumeInformationFile
NtOpenFile
RtlInitUnicodeString
NtQueryVolumeInformationFile
NtQueryEaFile
NtQueryInformationFile
RtlNtStatusToDosError
NtSetInformationFile
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDosPathNameToNtPathName_U

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW

api-ms-win-core-file-l1-1-0

FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
FindClose
GetDiskFreeSpaceExW
GetVolumePathNameW
SetFilePointerEx
GetVolumeInformationW
GetFileInformationByHandle
SetEndOfFile
DeleteFileW
GetDriveTypeW
GetLogicalDriveStringsW
GetFileType
CreateDirectoryW
GetTempFileNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetFinalPathNameByHandleW
QueryDosDeviceW
WriteFile
CreateFileW
GetFileSizeEx
GetFullPathNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetVersionExW
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
GetComputerNameExW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-security-base-l1-1-0

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
TerminateProcess

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW

api-ms-win-core-com-l1-1-0

StringFromIID
StringFromGUID2
CoTaskMemFree
IIDFromString

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageW
SetThreadUILanguage

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

CreateHardLinkW
GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-file-l1-2-2

FindFirstFileNameW
FindNextFileNameW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapSetInformation
HeapAlloc

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW
LookupAccountNameLocalW

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleMode

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
GetCurrentDirectoryW

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory
LsaOpenPolicy
LsaLookupSids

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventProviderEnabled
EventRegister
EventWriteTransfer

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Sections

.text
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b1f6721fd39601739eb215e5fba7364

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

02:71:66:71:0c:99:48:80:b9:b8:6f:6d:29:d3:4f:bf:a5:c5:7f:32:c1:b5:8e:59:b2:47:63:72:fa:f7:22:9dSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-heap-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-memory-l1-1-0

Sections

.text Size: 133KB - Virtual size: 132KB

.data Size: 4KB - Virtual size: 5KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

02:71:66:71:0c:99:48:80:b9:b8:6f:6d:29:d3:4f:bf:a5:c5:7f:32:c1:b5:8e:59:b2:47:63:72:fa:f7:22:9d
Signer

.text
Size: 133KB - Virtual size: 132KB

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB