escUnattend[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

escUnattend.exe
Size

82KB
MD5

218719c38d2a27b9788782ce92ecdd84
SHA1

48e8ee7c34084bae62758d03894a3d0cb0c1f408
SHA256

10bbc02017496413f6d31ad21561b96443d9582d5a4fe528f54fcb479eef4fc9
SHA512

fe61f70579fa103acc2fb990ef6a9cf70e48973652da11b60227c79be7e7d5a3b974878893427d5b68fc53436bea06ac9f53132c2b497f8340d48ba2c0148d85
SSDEEP

1536:lBRGiEZmylLzo+IDUmh7peWqm/VqL4lp7C8ti:40+g5QngpO2i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
escUnattend.exe

Files

escUnattend.exe
.exe windows x64

8b048653c852c221057f23f7f73ae071

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
SetSecurityDescriptorDacl
EqualSid
OpenProcessToken
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
CheckTokenMembership

kernel32

FlushFileBuffers
IsDebuggerPresent
DeviceIoControl
GetWindowsDirectoryW
MultiByteToWideChar
OutputDebugStringA
GetFileSizeEx
LoadLibraryExW
DebugBreak
FreeLibrary
CreateFileMappingA
GetProcAddress
HeapSize
HeapDestroy
GetModuleHandleW
GetLastError
WideCharToMultiByte
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsSetValue
HeapFree
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
UnmapViewOfFile
FormatMessageW
TlsAlloc
HeapReAlloc
RaiseException
GetWindowsDirectoryA
HeapAlloc
GetLocalTime
LocalFree
GetFileSize
DeleteCriticalSection
ExitProcess
GetProcessHeap
TlsGetValue
GetTempFileNameW
TlsFree
CreateFileMappingW
MapViewOfFile
VirtualQuery
GetModuleFileNameA
WriteFile
ExpandEnvironmentStringsW
GetModuleFileNameW
SetFilePointer
CreateMutexW
CreateMutexA
WaitForSingleObject
CreateFileW
ReleaseMutex
GetVersion
CreateFileA
GetCurrentThread
DeleteFileA
DeleteFileW
CloseHandle

msvcrt

_fmode
_acmdln
__C_specific_handler
_initterm
__CxxFrameHandler3
_vsnwprintf
_vsnprintf
wcsrchr
_wcsicmp
iswctype
_wcsnicmp
swscanf_s
fclose
_wtoi
wcstok_s
_commode
fgetws
feof
towlower
free
malloc
_callnewh
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
memcpy
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_wfopen
memset

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

iesetup

IEHardenLMSettings

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime

user32

UnregisterClassA

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b048653c852c221057f23f7f73ae071

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

iesetup

oleaut32

user32

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 316B

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 316B