SettingSyncHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SettingSyncHost.exe
Size

809KB
MD5

160669ca4de30dfeb6d5aefee2a1eba5
SHA1

9b136e60ce3d6a44171031ae783987778ec1b164
SHA256

020436dbaf8b73f2ca01edf68f8098a38bc1fef8551a51ef424b2c63f5df3bb1
SHA512

226c7545b694933db3d6bf97e573c9fbc65c18bb8036b87cd81ecd4d52cb247a3dd3da56ea75f3ed39fd02bfa33c52abf4d36b77caa8e204cae60d68832e9f89
SSDEEP

24576:r3TP5qU6KEtzaIsvdNCtCsDTlUDQp6IB+MZV9aF9Xqw:LTOt2IsVNC0sdUDaPkFEw

Score

1^/10

Malware Config

Signatures

Files

SettingSyncHost.exe
.exe windows x86

0ae2abee2fddd74040a4859ee309463a

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:6b:1d:97:25:9d:5e:fc:fb:5a:dc:cb:80:b0:3a:52:b9:41:93:ac:3f:65:87:23:60:e3:6a:81:2c:70:d3:45
Signer

Actual PE Digest

70:6b:1d:97:25:9d:5e:fc:fb:5a:dc:cb:80:b0:3a:52:b9:41:93:ac:3f:65:87:23:60:e3:6a:81:2c:70:d3:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

iswalnum
wcschr
wcsstr
_CxxThrowException
_vsnprintf_s
wcstok_s
swscanf_s
_ftol2
??0exception@@QAE@ABV0@@Z
memcmp
_wcstoui64
_vsnwprintf
strncmp
memmove
_except_handler4_common
_controlfp
_wcsnicmp
wcsncpy_s
malloc
?terminate@@YAXXZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_wcmdln
_initterm
__setusermatherr
__p__fmode
_callnewh
_cexit
??1type_info@@UAE@XZ
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
memmove_s
realloc
_wcsicmp
toupper
time
_XcptFilter
free
_get_errno
_set_errno
??1exception@@UAE@XZ
_purecall
??0exception@@QAE@XZ
memcpy_s
memcpy
srand
rand
memset

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
SizeofResource
GetModuleFileNameW
LockResource

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
ReleaseSemaphore
InitializeSRWLock
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
CreateEventW
WaitForSingleObjectEx
AcquireSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
SetEvent
CreateMutexExW
CreateEventExW
ResetEvent
ReleaseSRWLockExclusive
OpenEventW
EnterCriticalSection
AcquireSRWLockExclusive
CreateMutexW
LeaveCriticalSection
TryAcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentProcess
OpenThreadToken
ProcessIdToSessionId
GetCurrentThreadId
GetStartupInfoW
SetThreadPriority
SetPriorityClass
CreateProcessW
GetCurrentThread
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetUserGeoID
FormatMessageW
GetGeoInfoW
LCMapStringEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
StringFromGUID2
CoDisableCallCancellation
CoEnableCallCancellation
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCancelCall
StringFromCLSID
CoReleaseMarshalData
CoCreateGuid
CoGetCallContext
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx
CoGetMalloc
CoCreateInstance
CoSetProxyBlanket
StringFromIID
CoResumeClassObjects
CoRegisterClassObject
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoAddRefServerProcess
CoGetApartmentType
CoReleaseServerProcess
CoTaskMemFree
CLSIDFromString
PropVariantClear

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsStringHasEmbeddedNull

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventProviderEnabled
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-file-l1-1-0

GetTempFileNameW
GetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
CreateFileW
FindFirstFileW
GetFileAttributesExW
CompareFileTime
DeleteFileW
CreateDirectoryW
WriteFile
SetFileAttributesW
SetFileTime

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
SleepConditionVariableSRW
Sleep
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenCurrentUser
RegEnumKeyExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegOpenKeyExW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel

ntdll

ZwClose
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
ZwAlpcConnectPort
RtlWaitOnAddress
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlFreeHeap
RtlAllocateHeap
RtlInitUnicodeString
vDbgPrintEx
NtPowerInformation
RtlGetSuiteMask
RtlPublishWnfStateData
NtCreateWnfStateName
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtQueryWnfStateData
EtwTraceMessage
EtwEventActivityIdControl
NtSetInformationProcess
NtSetInformationThread
RtlNtStatusToDosError

api-ms-win-shcore-thread-l1-1-0

SHCreateThreadWithHandle

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
IStream_Copy
SHCreateStreamOnFileW
IStream_Read
IStream_WriteStr
SHOpenRegStream2W
IStream_Write
SHCreateMemStream
IStream_Size

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount
GetVersionExW
GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW
SHStrDupW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoRegisterActivationFactories
RoActivateInstance
RoRevokeActivationFactories

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpool
CloseThreadpool
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchAppend

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrStrIW
QISearch
StrToIntExW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetCharTypeW
PathStripPathW
PathFindFileNameW

api-ms-win-security-base-l1-1-0

GetTokenInformation
AdjustTokenPrivileges
GetSidSubAuthority
CreateWellKnownSid

api-ms-win-shcore-registry-l1-1-0

SHDeleteValueW
SHSetValueW
SHRegGetPathW
SHRegGetValueW
SHRegSetPathW
SHDeleteKeyW

rpcrt4

UuidCreate

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

propsys

PSPropertyBag_WriteUnknown
PropVariantToUInt32
PropVariantToBoolean
PSPropertyBag_WriteStr
PropVariantToStringAlloc
PSCreateMemoryPropertyStore

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

userenv

GetProfileType

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

Sections

.text
Size: 738KB - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ae2abee2fddd74040a4859ee309463a

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

70:6b:1d:97:25:9d:5e:fc:fb:5a:dc:cb:80:b0:3a:52:b9:41:93:ac:3f:65:87:23:60:e3:6a:81:2c:70:d3:45Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

ntdll

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-shcore-registry-l1-1-0

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

propsys

api-ms-win-core-psapi-l1-1-0

userenv

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

Sections

.text Size: 738KB - Virtual size: 737KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 12KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 240B

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 39KB - Virtual size: 38KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

70:6b:1d:97:25:9d:5e:fc:fb:5a:dc:cb:80:b0:3a:52:b9:41:93:ac:3f:65:87:23:60:e3:6a:81:2c:70:d3:45
Signer

.text
Size: 738KB - Virtual size: 737KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 240B

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 39KB - Virtual size: 38KB