esentutl[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

esentutl.exe
Size

441KB
MD5

bad9577503b0fdf4aaebaceb9345b877
SHA1

032d537b0708efe508b6f34fce512de3fc01a25a
SHA256

22200d53a7b9cbe56389e7daeefb28d653125b7cb23e8c5d60a885f18e158e1f
SHA512

b05f7352ef2b654974f812943baaec7a14189f0c84f6d39ef76a29e108d81cefd5f4e2e65a6024a81a0b1ba73db08f6066bd35d2e366b85316df9de2d16db9a5
SSDEEP

6144:gOWL4JUAsIGb3DdhYvtw8s+2cw+mUYuwq+2vR+hUY3D8L2IdOWMyi+6WC8yWLPMc:3JUcGPgvBGGi7AClgXV3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
esentutl.exe

Files

esentutl.exe
.exe windows x86

c7c5a971b9d7b38ddb5066c26e725f14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
_onexit
__set_app_type
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_controlfp
_XcptFilter
_wtol
_wcsnicmp
strchr
_wfullpath
_wcsupr_s
_except_handler4_common
wcsstr
memcpy
swprintf_s
__iob_func
wcscpy_s
_getch
_snwscanf_s
_wsplitpath_s
_wmakepath_s
swscanf_s
wcstol
_vsnwprintf
malloc
free
wprintf
__p__commode
iswascii
fwprintf
isprint
_vsnprintf
strtoul
strcspn
strrchr
wcsncmp
wcsrchr
memmove_s
iswalpha
rand_s
wcspbrk
vprintf
strstr
wcschr
_purecall
_wcsicmp
wcscat_s
memset

esent

JetRestore2W
JetGetSystemParameterW
JetBeginSessionW
JetInit4W
JetGetLogFileInfoW
JetGetErrorInfoW
JetEndSession
JetSetSystemParameterA
JetGetDatabaseFileInfoW
JetTerm2
JetSetSystemParameterW
JetAttachDatabase3W
JetInit
JetDetachDatabaseW
JetTestHook
JetDBUtilitiesW

ntdll

RtlCaptureStackBackTrace

api-ms-win-core-file-l1-1-0

ReadFile
GetFinalPathNameByHandleW
FindVolumeClose
WriteFileGather
ReadFileScatter
FindNextVolumeW
FindFirstVolumeW
GetFileAttributesW
CreateFileW
SetFileValidData
DeleteFileW
SetFileInformationByHandle
WriteFile
FindClose
FlushFileBuffers
GetFullPathNameW
GetVolumePathNameW
GetFileInformationByHandle
GetDiskFreeSpaceExW
RemoveDirectoryW
GetDriveTypeW
GetDiskFreeSpaceW
GetFileAttributesExW
GetTempFileNameW
CreateDirectoryW
SetEndOfFile
GetVolumeInformationW
FindFirstFileW
GetFileSizeEx
FindNextFileW
SetFilePointerEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapDestroy
HeapAlloc
HeapFree

api-ms-win-core-io-l1-1-0

GetOverlappedResult
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
DeviceIoControl

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

SetHandleInformation
DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx
GetWindowsDirectoryW
GetVersionExW
GetSystemInfo
GetSystemTime
GetSystemWindowsDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetLogicalProcessorInformationEx

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
LoadLibraryExA
GetProcAddress

api-ms-win-core-file-l2-1-0

MoveFileExW
GetFileInformationByHandleEx
CopyFileExW

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsFree
CreateProcessW
TlsAlloc
TlsSetValue
GetCurrentThread
GetExitCodeThread
TerminateProcess
GetCurrentProcess
ResumeThread
GetCurrentThreadId
GetCurrentProcessId
OpenThread
SetThreadPriorityBoost
SetThreadPriority
CreateThread

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
SleepEx
SetEvent
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
AcquireSRWLockExclusive
CreateEventW
CreateMutexW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFileEx
CreateFileMappingW
VirtualQueryEx

api-ms-win-core-processthreads-l1-1-1

GetThreadIdealProcessorEx
IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-localization-l1-2-0

LCMapStringW
LCMapStringEx
FormatMessageW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7c5a971b9d7b38ddb5066c26e725f14

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

esent

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 401KB - Virtual size: 401KB

.data Size: 7KB - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 401KB - Virtual size: 401KB

.data
Size: 7KB - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB