esentutl[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

esentutl.exe
Size

400KB
MD5

e2098b56cf093e165d030e27591ce498
SHA1

c1c23e7ef3e0c428ad776a25fa556c776078997d
SHA256

753feb8e2bc07b6ed0e3ba836a33ec3c6f097a237fb9d48c23938892c8a16f4a
SHA512

497521ac2f1f5ae4b1a264950c693fcadb8eac9b421e33fde2bd69368f1cfc813d8eb24c280bf03550db552e9cfc0b9751dea0c9ddb67be9b95efd9a0c90914a
SSDEEP

12288:8Rk6AXIHw5djFUHsHSdsm89sWqiG0UXd1jU:5IHMdRUOSdsm8eWnG0UXXjU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
esentutl.exe

Files

esentutl.exe
.exe windows x64

46b1ec0a16c340eba5eddd8e6be9b4f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wtol
_wcsnicmp
strchr
_wfullpath
_amsg_exit
_wcsupr_s
wcsstr
__wgetmainargs
__set_app_type
exit
swprintf_s
_onexit
?terminate@@YAXXZ
wcscat_s
wcscpy_s
memcpy
_exit
memcmp
_cexit
_snwscanf_s
_wsplitpath_s
_wmakepath_s
_XcptFilter
swscanf_s
__setusermatherr
_vsnwprintf
malloc
wprintf
free
__iob_func
printf
wcschr
_initterm
__C_specific_handler
_fmode
_commode
_purecall
_lock
_unlock
__dllonexit
iswascii
fwprintf
isprint
_vsnprintf
strtoul
strcspn
strrchr
wcsrchr
strstr
iswalpha
wcspbrk
vprintf
_wcsicmp
wcstol
_getch
memset

esent

JetEndSession
JetDBUtilitiesW
JetGetSystemParameterW
JetGetErrorInfoW
JetTestHook
JetDetachDatabaseW
JetBeginSessionW
JetInit4W
JetGetLogFileInfoW
JetInit
JetRestore2W
JetAttachDatabase3W
JetTerm2
JetSetSystemParameterA
JetGetDatabaseFileInfoW
JetSetSystemParameterW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
GetFileSizeEx
DeleteFileW
RemoveDirectoryW
SetFileValidData
SetFileInformationByHandle
GetDriveTypeW
CreateDirectoryW
FindNextFileW
GetVolumeInformationW
FindFirstFileW
GetFileAttributesExW
GetDiskFreeSpaceExW
ReadFile
WriteFile
SetEndOfFile
GetVolumePathNameW
SetFilePointerEx
CreateFileW
ReadFileScatter
WriteFileGather
GetFileSize
GetDiskFreeSpaceW
FlushFileBuffers
GetFileAttributesW
FindClose

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
GetOverlappedResult
CreateIoCompletionPort

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

SetHandleInformation
CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTime
GetLocalTime
GetSystemWindowsDirectoryW
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExA
FreeLibrary
LoadLibraryExW

api-ms-win-core-file-l2-1-0

CopyFileExW
MoveFileExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
TlsSetValue
CreateThread
GetCurrentProcess
GetExitCodeThread
TlsAlloc
SetThreadPriorityBoost
TlsGetValue
TlsFree
GetCurrentProcessId
CreateProcessW
TerminateProcess
ResumeThread
SetThreadPriority

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualFree
VirtualAlloc
MapViewOfFileEx
CreateFileMappingW
VirtualProtect
VirtualQueryEx

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
CreateEventW
SleepEx
CreateMutexW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46b1ec0a16c340eba5eddd8e6be9b4f6

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

esent

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 270KB - Virtual size: 269KB

.rdata Size: 104KB - Virtual size: 104KB

.data Size: 9KB - Virtual size: 15KB

.pdata Size: 11KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 270KB - Virtual size: 269KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 9KB - Virtual size: 15KB

.pdata
Size: 11KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB