AppHostRegistrationVerifier[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AppHostRegistrationVerifier.exe
Size

111KB
MD5

d941415b8862e74d78f9a8ea13587ab0
SHA1

f7c51abfbce9058bb0403874267ce90520b4a9f9
SHA256

f9cd903372e1ac1982d94ce279d420ce99a865d54681edf4d9512f319d7ede36
SHA512

bc5ff0af3cc00017846a55077fc83a3c67f758bf58ce0c2adb92a4d3454bdda12334db8677fa82b61001b0ab24c39872767d9a3c532b56bf35fe5b7737c3592a
SSDEEP

3072:J0dRChZTm//FD8FFE1tvj+L6Kt1qIvq5npMv:J0qhWFuOrvjqdt1BIp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppHostRegistrationVerifier.exe

Files

AppHostRegistrationVerifier.exe
.exe windows x64

8d965fb1b2ed7357844ce14892233cd3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
__uncaught_exception
fseek
_wfsopen
abort
_wcsdup
__crtLCMapStringW
_get_current_locale
_free_locale
memmove
setvbuf
memcpy
_CxxThrowException
_ismbblead
malloc
ungetwc
ungetc
fputwc
_errno
fgetwc
fgetc
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
__mb_cur_max
?what@exception@@UEBAPEBDXZ
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
free
_purecall
??0exception@@QEAA@AEBQEBD@Z
??_V@YAXPEAX@Z
__iob_func
fclose
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
fwrite
fgetpos
__C_specific_handler
_fseeki64
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
setlocale
fflush
fsetpos
memcpy_s
freopen
_vsnwprintf
wprintf
__pctype_func
__CxxFrameHandler3

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

CreateEventExW
CreateMutexExW
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
SetEvent
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
GetStringTypeW
WideCharToMultiByte

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-console-l1-2-0

AttachConsole

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey

api-ms-win-appmodel-state-l1-2-0

CloseState
GetSystemAppDataKey
OpenStateExplicit

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d965fb1b2ed7357844ce14892233cd3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-appmodel-state-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

Sections

.text Size: 70KB - Virtual size: 69KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 848B

.text
Size: 70KB - Virtual size: 69KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 848B