esentutl[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

esentutl.exe
Size

366KB
MD5

f4a95fa21d15e8f93b75ea73d6e915ca
SHA1

488e665a9727699d65ef1e16258cb50b3a649376
SHA256

a3ee005c46f1dea44f2affd99c3bd1545b7d5448cb54cf774841cf93da5a7208
SHA512

461d6b69110ef0c948aa85006f8e3a6fc241ee660981fe3d34c3da237cdddeb78de97def43de752aaaca802b3212b172849f95b23c806221273159d856a15624
SSDEEP

6144:fDv96MPOaLjjT3LpVEcZZ06TkVzxtaEpVJo5BeOuLK2G0LaoYd5kHjz:7l6MpjXLpnZUMBeOuLG0Nj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
esentutl.exe

Files

esentutl.exe
.exe windows x64

9cd95101939be1ed73a8ebe85664eb5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wtol
_wcsnicmp
strchr
_cexit
__setusermatherr
_wcsupr_s
_initterm
__C_specific_handler
_fmode
swprintf_s
_commode
_lock
wcscat_s
wcscpy_s
_amsg_exit
__dllonexit
__set_app_type
_onexit
_snwscanf_s
_wsplitpath_s
_wmakepath_s
_XcptFilter
swscanf_s
wcstol
_vsnwprintf
malloc
wprintf
free
__wgetmainargs
printf
wcschr
_unlock
_exit
?terminate@@YAXXZ
memcpy
_purecall
memcmp
_getch
exit
iswascii
fwprintf
isprint
_vsnprintf
strtoul
strcspn
strrchr
wcsrchr
strstr
iswalpha
wcspbrk
vprintf
_wcsicmp
__iob_func
_wfullpath
memset

esent

JetBeginSessionW
JetDBUtilitiesW
JetGetSystemParameterW
JetInit4W
JetGetLogFileInfoW
JetGetErrorInfoW
JetRestore2W
JetEndSession
JetTestHook
JetSetSystemParameterA
JetInit
JetTerm2
JetGetDatabaseFileInfoW
JetSetSystemParameterW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-file-l1-1-0

GetVolumeInformationW
GetFileInformationByHandle
GetDriveTypeW
FindFirstFileW
SetFileInformationByHandle
GetDiskFreeSpaceW
FindClose
CreateFileW
SetFileValidData
CreateDirectoryW
GetFileAttributesExW
ReadFile
WriteFile
SetEndOfFile
GetFileSizeEx
GetDiskFreeSpaceExW
RemoveDirectoryW
SetFilePointerEx
GetVolumePathNameW
FindNextFileW
ReadFileScatter
WriteFileGather
FlushFileBuffers
GetFileAttributesW
DeleteFileW
GetFileSize

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapDestroy
HeapFree
HeapSetInformation
HeapAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl
CreateIoCompletionPort
PostQueuedCompletionStatus
GetOverlappedResult
GetQueuedCompletionStatus

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle
SetHandleInformation

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetWindowsDirectoryW
GetSystemInfo
GetSystemWindowsDirectoryW
GetLocalTime
GetVersionExW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemTime

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameW
LoadLibraryExA

api-ms-win-core-file-l2-1-0

MoveFileExW
CopyFileExW

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
ResumeThread
GetCurrentProcess
TerminateProcess
GetExitCodeThread
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
CreateThread
SetThreadPriorityBoost
CreateProcessW

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-memory-l1-1-0

VirtualQueryEx
UnmapViewOfFile
VirtualFree
VirtualAlloc
CreateFileMappingW
VirtualProtect
MapViewOfFileEx

api-ms-win-core-synch-l1-1-0

ReleaseMutex
DeleteCriticalSection
LeaveCriticalSection
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
CreateEventW
SleepEx
CreateMutexW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

LCMapStringW
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cd95101939be1ed73a8ebe85664eb5e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

esent

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 243KB - Virtual size: 242KB

.rdata Size: 99KB - Virtual size: 98KB

.data Size: 9KB - Virtual size: 15KB

.pdata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 243KB - Virtual size: 242KB

.rdata
Size: 99KB - Virtual size: 98KB

.data
Size: 9KB - Virtual size: 15KB

.pdata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB