appidpolicyconverter[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

appidpolicyconverter.exe
Size

94KB
MD5

bc20eee894bb0e17a85ce5f4882585b7
SHA1

8a8f3c9d1b133a2e7b71cd3b0a67514ca25679ef
SHA256

fde5452794b134dcfaa1ca970b01874ef29fc92e9e4b131749dbe73df036ab16
SHA512

2b9ba72d9e2fa2f50d754d2eedcc6309c43b602714c630c99e383face32c9fe674ef5a2d9060b76483faf0fbfc5887ca28fa065b4679cbfe6275e414abd75d1f
SSDEEP

1536:TjLY/ujZ9i0AKD+tJmNuxE3D6EdELEhRPUwUU85mHiA/VwtsL3TSBCflJd/q0HMK:TYEZo0AKDSJmNuxE3D6EdELEhRPUwUUj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
appidpolicyconverter.exe

Files

appidpolicyconverter.exe
.exe windows x86

f7b8cbe869a343f05f6a7a889e7b5a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
__CxxFrameHandler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_controlfp
_XcptFilter
toupper
_vsnwprintf_s
__RTDynamicCast
memcpy_s
_except_handler4_common
memmove_s
??0exception@@QAE@ABQBD@Z
_exit
_cexit
__wgetmainargs
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
malloc
free
_CxxThrowException
wcsstr
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_purecall
wcstol
_wtoi
exit
_ui64tow_s

ntdll

EtwTraceMessage
EtwGetTraceEnableFlags
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlNtStatusToDosErrorNoTeb
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel

api-ms-win-core-localregistry-l1-1-0

RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW

slc

SLGetWindowsInformationDWORD

kernel32

InterlockedDecrement
GetCurrentProcess
TerminateProcess
CreateBoundaryDescriptorW
GetCurrentThreadId
GetTickCount
CreateMutexExW
WaitForSingleObject
HeapSetInformation
SleepEx
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedIncrement
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
AddSIDToBoundaryDescriptor
CreatePrivateNamespaceW
OpenPrivateNamespaceW
DeleteBoundaryDescriptor
GetSystemTimeAsFileTime
UnhandledExceptionFilter
QueryPerformanceCounter
GetProcAddress
DelayLoadFailureHook
LocalFree
GetLastError
CloseHandle
DeviceIoControl
CreateFileW
ClosePrivateNamespace
GetCurrentProcessId
ReleaseMutex

appidapi

AppIDEncodeAttributeString
AppIDFreeAttributeString

rpcrt4

UuidToStringW
UuidFromStringW
RpcStringFreeW

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7b8cbe869a343f05f6a7a889e7b5a1d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

slc

kernel32

appidapi

rpcrt4

Sections

.text Size: 78KB - Virtual size: 78KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 78KB - Virtual size: 78KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 9KB