CheckNetIsolation[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CheckNetIsolation.exe
Size

24KB
MD5

03757652a80f880890eceda57a926665
SHA1

cc51822cd944acc02ef704ba933bf487ce4df16c
SHA256

259e2c3bc9b6655876caf607dd15c88c96cb532a26d5520bdebaa5d388714eb5
SHA512

e8908a0cc295fffe7c522e0b40d21bd58b4f0e4d235d079fcc868b9558b59406d556a5b2026e9f095c6228397ddaf72ad92d048d970e83289bc6f64349a5af27
SSDEEP

384:CdhaaOumnYFnC4CKRXK7K+a19kFzGaXdaKzLCMemRlJ6TVlRWY7pOWNkFpwhceIW:CbadYmKt9kFzG8VzLCERlmv7pwef

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CheckNetIsolation.exe

Files

CheckNetIsolation.exe
.exe windows x86

64990a3b0a6950663f5013f8de08d575

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ConvertSidToStringSidW
ConvertStringSidToSidW

kernel32

CloseHandle
SetConsoleCtrlHandler
ResolveDelayLoadedAPI
DelayLoadFailureHook
Sleep
GetModuleHandleW
CreateEventW
SetEvent
GetConsoleOutputCP
lstrcmpiW
LocalFree
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx

msvcrt

__set_app_type
exit
_exit
_cexit
__wgetmainargs
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_amsg_exit
__p__commode
_wsetlocale
swprintf_s
_except_handler4_common
towupper
wprintf
__p__fmode
memcpy
memmove
_XcptFilter
memset

ntdll

RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlIsParentOfChildAppContainer
RtlFreeSid
RtlEqualSid
EtwTraceMessage

ws2_32

htonl

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
LoadStringW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

fwpuclnt

FwpmEngineSetOption0
FwpmNetEventSubscribe1
FwpmEngineGetOption0
FwpmFreeMemory0
FwpmNetEventUnsubscribe0
FwpmEngineClose0
FwpmEngineOpen0

firewallapi

FwAlloc
IsAddressesEmpty
FwEmptyWFAddresses
NetworkIsolationEnumAppContainers
FwSidAndAttributesFree
NetworkIsolationSetAppContainerConfig
NetworkIsolationGetAppContainerConfig
FwSidCopy
FwFree

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64990a3b0a6950663f5013f8de08d575

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

ws2_32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

fwpuclnt

firewallapi

Sections

.text Size: 15KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB