CheckNetIsolation[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CheckNetIsolation.exe
Size

28KB
MD5

d10c9b005f33bf144a26a18ef0d73213
SHA1

77a2d770c1ca10a1e01db8e83d067a729e22e90c
SHA256

67bc058c8ea0b7fd21c412efc0d2eecc4afb67cf5bdc5981a8212e1af8fdf49e
SHA512

c152df850c66d9018f8310e44fa989145317e80374bb33ec9a008d96f9931a2eb9ce3ff502b54cca0e3c2d381739bb316c30fe84630bec7bf2db7db3c2209e75
SSDEEP

384:JumhBXqAPA+fPt1NTSNq5XbdnGWEBFg1tf1qaaUeQVtdtNtqObOW77pOWM:PhB6A4+t1PmHBFg1ia4QJ3tLbr7p8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CheckNetIsolation.exe

Files

CheckNetIsolation.exe
.exe windows x64

e437a3a0162600ce23b282a0dfa53d7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_exit
_cexit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
__setusermatherr
fprintf
_initterm
_wsetlocale
swprintf_s
towupper
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
wprintf
__iob_func
exit
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlVirtualUnwind
RtlIsParentOfChildAppContainer
RtlFreeSid
RtlEqualSid
EtwTraceMessage
RtlIpv4AddressToStringW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
SetConsoleCtrlHandler

ws2_32

htonl

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
SetEvent
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

fwpuclnt

FwpmEngineSetOption0
FwpmNetEventSubscribe4
FwpmEngineOpen0
FwpmFreeMemory0
FwpmNetEventUnsubscribe0
FwpmEngineClose0
FwpmProviderAdd0
FwpmFilterAdd0
FwpmEngineGetOption0

firewallapi

NetworkIsolationEnumAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationSetAppContainerConfig
FwEmptyWFAddresses

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e437a3a0162600ce23b282a0dfa53d7b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-console-l1-1-0

ws2_32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

fwpuclnt

firewallapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 684B

.didat Size: 512B - Virtual size: 152B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 108B

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 684B

.didat
Size: 512B - Virtual size: 152B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 108B