EASPolicyManagerBrokerHost[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

EASPolicyManagerBrokerHost.exe
Size

63KB
MD5

ab4f38cea3afd9382a8081eb0da1554f
SHA1

5df5a38fe9331a5248d8fc28959d425f5a32af2a
SHA256

cd1ee45681368023009c9a25fd447cc8c1d8c6cff11413a50a89c26b604754fa
SHA512

26f8cd0932b3602081954d85cafcba93cf07035ec04efcf488637af791fdd4c27b676b38b3ed477f51e7801cd2d39ea5422c7af1ca1a940fb02170c32a4171dc
SSDEEP

1536:FY0zvEC2g1sXbQuFeFtJF/z6R1kn+ugTT7FCVs:cfEuFeFrFO1k+BTT7z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EASPolicyManagerBrokerHost.exe

Files

EASPolicyManagerBrokerHost.exe
.exe windows x64

247a62f930c6646e6f2e8ee408142ffb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_fmode
_onexit
_initterm
__setusermatherr
_cexit
__CxxFrameHandler3
exit
__set_app_type
_commode
_amsg_exit
_XcptFilter
_callnewh
malloc
?terminate@@YAXXZ
free
memcpy
_vsnwprintf_s
_unlock
_vsnwprintf
_lock
__wgetmainargs
_errno
_wcsicmp
__dllonexit
_exit
_purecall
_strnicmp
memcpy_s
__C_specific_handler
memset

ntdll

RtlCaptureContext
RtlReportException
RtlVirtualUnwind
RtlLookupFunctionEntry

combase

ord69

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
OpenSemaphoreW
CreateEventW
ReleaseSemaphore
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
OpenThreadToken
TerminateProcess
ProcessIdToSessionId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-com-l1-1-0

CoResumeClassObjects
CoRevertToSelf
CoTaskMemFree
CoRegisterClassObject
CoInitializeEx
CoAddRefServerProcess
StringFromGUID2
CoInitializeSecurity
CoReleaseServerProcess
CoImpersonateClient
CoRevokeClassObject
CoCreateInstance
CoDisconnectContext
CoUninitialize
CoWaitForMultipleObjects

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoRevokeActivationFactories

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegDeleteTreeW
RegGetValueW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

AccessCheck

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

policymanager

EnterprisePolicyManagerStore_GetAllProviderContextSidAreas

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

247a62f930c6646e6f2e8ee408142ffb

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

oleaut32

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

policymanager

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 96B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 264B

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 96B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 264B