esentutl[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

esentutl.exe
Size

344KB
MD5

5f5105050fbe68e930486635c5557f84
SHA1

2d07c804e9efe16dda41619d9e5f5448e524bbed
SHA256

26d0a05d6ac8584440b3b771cf8be4746e5f2bf19ffb118fd7c7dd551f61ba74
SHA512

80f9cfc5bb514871325b947aa534d4f868b141868e6bfca9e5255ec758e88371fe4f7fa3cc3899019b79fbd6ca13e61ce7757179bc3faa34f440aa155da65cf8
SSDEEP

6144:fzAG0u8JLzbva/bv7caTZmxvnJwYKlK4KhOxZTfjr4fn:sG0LJLzbvazNToxKZcGZTjrGn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
esentutl.exe

Files

esentutl.exe
.exe windows x86

f1c6f14d0ce10c71ebbd7a7e5edda3ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsnicmp
_onexit
_wcsupr_s
_wtol
_XcptFilter
_wfullpath
strchr
?terminate@@YAXXZ
swprintf_s
_controlfp
_except_handler4_common
wcscat_s
wcscpy_s
memcpy
__set_app_type
__dllonexit
_amsg_exit
_snwscanf_s
_wsplitpath_s
_wmakepath_s
__p__commode
swscanf_s
wcstol
_vsnwprintf
exit
__iob_func
free
_exit
printf
wcschr
_cexit
__p__fmode
__setusermatherr
_initterm
_purecall
_lock
_getch
__wgetmainargs
iswascii
fwprintf
isprint
_vsnprintf
strtoul
strcspn
strrchr
wcsrchr
strstr
iswalpha
wcspbrk
vprintf
_wcsicmp
malloc
_unlock
wprintf
wcsstr
memset

esent

JetEndSession
JetDBUtilitiesW
JetGetSystemParameterW
JetGetErrorInfoW
JetTestHook
JetDetachDatabaseW
JetBeginSessionW
JetInit4W
JetGetLogFileInfoW
JetInit
JetRestore2W
JetAttachDatabase3W
JetTerm2
JetSetSystemParameterA
JetGetDatabaseFileInfoW
JetSetSystemParameterW

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetVolumeInformationW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
SetFileValidData
SetFileInformationByHandle
GetDiskFreeSpaceW
FindClose
RemoveDirectoryW
GetFileSizeEx
FindNextFileW
GetFileAttributesExW
ReadFile
WriteFile
SetEndOfFile
SetFilePointerEx
GetDiskFreeSpaceExW
GetVolumePathNameW
DeleteFileW
ReadFileScatter
WriteFileGather
GetFileSize
CreateDirectoryW
GetFileAttributesW
CreateFileW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapDestroy
HeapAlloc
HeapSetInformation

api-ms-win-core-io-l1-1-0

GetOverlappedResult
GetQueuedCompletionStatus
DeviceIoControl
CreateIoCompletionPort
PostQueuedCompletionStatus

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

DuplicateHandle
SetHandleInformation
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetLocalTime
GetTickCount
GetVersionExW
GetSystemInfo
GetSystemTime
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
LoadLibraryExA
FreeLibrary
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-file-l2-1-0

MoveFileExW
CopyFileExW

api-ms-win-core-processthreads-l1-1-0

CreateThread
TlsSetValue
GetExitCodeThread
TlsAlloc
GetCurrentThreadId
GetCurrentThread
TlsGetValue
TlsFree
GetCurrentProcess
CreateProcessW
SetThreadPriorityBoost
TerminateProcess
GetCurrentProcessId
ResumeThread
SetThreadPriority

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFileEx
VirtualFree
CreateFileMappingW
VirtualAlloc
VirtualQueryEx
VirtualProtect

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateMutexW
ReleaseSemaphore
EnterCriticalSection
SleepEx
WaitForSingleObjectEx
WaitForSingleObject
CreateEventW
ReleaseMutex
SetEvent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

LCMapStringW
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1c6f14d0ce10c71ebbd7a7e5edda3ef

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

esent

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 309KB - Virtual size: 308KB

.data Size: 7KB - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 309KB - Virtual size: 308KB

.data
Size: 7KB - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB