GameBarPresenceWriter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GameBarPresenceWriter.exe
Size

231KB
MD5

4d9f11d5a65dc32c3c5b9b1e539686bd
SHA1

3bf0abb6f5b043320511ed915d6d7bb3027a2f0b
SHA256

b7fd76cee9e31f6512b92caa451f6add085e92ea715ef039f9b102477107cf23
SHA512

6e25303e4e65b6548da252c29fdc109978770918e8e49355b4735f98187e8695786475a64d80b672005d13dfc8a3b25b574af9a2c63aa37a6421d2541b732e0a
SSDEEP

6144:VgmmnMk7DITkHYrl8HuVUaKp8QI/U7VHu4stmNjQR8B:BP6ITzrl85+U7VHu4stmqR8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GameBarPresenceWriter.exe

Files

GameBarPresenceWriter.exe
.exe windows x86

33532e3d7e192ac5a31b0ce9fcd79a67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegGetValueW
RegCreateKeyExW
RegCloseKey
RegNotifyChangeKeyValue
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

kernel32

GetModuleFileNameA
HeapFree
EnterCriticalSection
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
GetCurrentThreadId
FormatMessageW
OutputDebugStringW
RaiseException
HeapAlloc
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
SetLastError
CreateEventExW
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
GetLastError
WaitForThreadpoolWaitCallbacks
ReleaseSRWLockExclusive
CloseThreadpoolTimer
AcquireSRWLockExclusive
CreateThreadpoolWait
CloseHandle
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolTimer
ParseApplicationUserModelId
InitOnceExecuteOnce
EncodePointer
WaitForSingleObject
CreateEventW
Sleep
SetEvent
ReleaseSRWLockShared
DecodePointer
LocalFree
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
GetCurrentProcessId

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vfwprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__calloc_base
_o__cexit
_o__CIpow
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__free_base
_o__get_initial_wide_environment
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o___std_exception_destroy
_o__realloc_base
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__wcsdup
_o__Wcsftime
_o_abort
_o_calloc
_o_ceil
_o_exit
_o_free
_o_frexp
_o_islower
_o_isspace
_o_isupper
_o_ldexp
_o_localeconv
_o_malloc
_o_setlocale
_o_strtod
_o_strtof
_o_terminate
_o_tolower
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
wcsstr
_o___std_exception_copy
_o___p__commode
_o___pctype_func
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__CxxFrameHandler3
memchr
memcmp
memcpy
memmove

api-ms-win-crt-string-l1-1-0

strcspn
__strncnt
wcsnlen
memset

ole32

CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoReleaseServerProcess
CoTaskMemAlloc
CoRegisterClassObject
CoResumeClassObjects
CoInitializeSecurity
CoRevokeClassObject
CoAddRefServerProcess

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsIsStringEmpty

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoInitialize
RoGetActivationFactory
RoRevokeActivationFactories
RoActivateInstance
RoUninitialize

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
TryAcquireSRWLockExclusive
ResetEvent
InitializeCriticalSectionAndSpinCount

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetCPInfo
LCMapStringEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringEx

Sections

.text
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33532e3d7e192ac5a31b0ce9fcd79a67

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ole32

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-power-setting-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-core-string-l1-1-0

Sections

.text Size: 197KB - Virtual size: 196KB

.data Size: 13KB - Virtual size: 14KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 197KB - Virtual size: 196KB

.data
Size: 13KB - Virtual size: 14KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 11KB