SearchFilterHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SearchFilterHost.exe
Size

219KB
MD5

09c9eb6892e603cd4265920e5a29f7cd
SHA1

6884b7744572dc42301cf23ef36c3945deb33701
SHA256

bfeb65feafe356a44f6cc24d1962317c772abc58a847a200f93c5db69c93e98b
SHA512

fca6e6bd3b4a3b2ce3c7bac569b0d48ef4fbbb6879a3fbdf8ed5d2c9dfcd37d7effa4a113a47be5fb82c19e7c1dcfbe05c9a1806588ad1cc5125f0ede6289504
SSDEEP

6144:coazi+tA/bnO7ttZnrdwGrkR10efUKVyg:coYiCADnmZdwGQztfjz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchFilterHost.exe

Files

SearchFilterHost.exe
.exe windows x86

ff9c8552d339f5b3c859a0ade35b56a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wtoi
??0exception@@QAE@XZ
_amsg_exit
_except_handler4_common
_initterm
toupper
_CxxThrowException
bsearch
wcsncmp
_cexit
_wcsnicmp
__p__commode
memmove_s
_wcsicmp
__wgetmainargs
_purecall
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_wtoi64
_vsnprintf_s
free
malloc
memmove
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
_XcptFilter
__setusermatherr
_errno
??0exception@@QAE@ABQBD@Z
__set_app_type
memcmp
_controlfp
??1type_info@@UAE@XZ
_onexit
wcsncpy_s
__dllonexit
memcpy_s
_unlock
__p__fmode
__CxxFrameHandler3
_vsnwprintf
exit
strerror
_exit
memcpy
_lock
?terminate@@YAXXZ
realloc
_itow_s
memset

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventRegister
EventProviderEnabled
EventWriteTransfer
EventSetInformation

api-ms-win-security-base-l1-1-0

InitializeAcl
SetSecurityDescriptorDacl
GetTokenInformation
AddAccessAllowedAce
GetAclInformation
AddAce
SetSecurityDescriptorGroup
CopySid
GetLengthSid
SetSecurityDescriptorOwner
CreateWellKnownSid
InitializeSecurityDescriptor
GetAce
IsValidSid

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
LoadResource
GetModuleHandleW
FreeLibrary
GetModuleFileNameW
LoadStringW
LoadLibraryExW
SizeofResource

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoUninitialize
PropVariantClear
PropVariantCopy
CoTaskMemAlloc
CoMarshalInterface
CoInitializeEx
StringFromCLSID
CoTaskMemRealloc
CoReleaseMarshalData
CoInitializeSecurity
CoGetMarshalSizeMax
CreateStreamOnHGlobal

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
Sleep

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObject
AcquireSRWLockExclusive
OpenEventW
DeleteCriticalSection
EnterCriticalSection
SetEvent
InitializeCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockShared
CreateMutexExW
OpenSemaphoreW
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-handle-l1-1-0

GetHandleInformation
CloseHandle

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetProcessTimes
OpenProcessToken
TerminateProcess
SetPriorityClass
GetCurrentThread

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegEnumValueW
RegDeleteKeyExW
RegEnumKeyExW
RegSetValueExW
RegGetValueW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
SetProcessMitigationPolicy

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalAlloc
GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciDelete
ciNewNoThrow

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

ntdll

RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
RtlNtStatusToDosError

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff9c8552d339f5b3c859a0ade35b56a6

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 115KB - Virtual size: 114KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 24B

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 115KB - Virtual size: 114KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 8KB - Virtual size: 7KB