CheckNetIsolation[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CheckNetIsolation.exe
Size

29KB
MD5

28ec10c0e25126f4461fe8472a3281d3
SHA1

09548bcace229e35ee93d4f4daebb3dceb719293
SHA256

f69d991e47258d5cc58be3a38881a4d849168c61b41e491b2eca05b0e6667ca3
SHA512

695f8cd16e3c2297dcd42bd58dad9e9202805dd4d1f438a72e29267636c23a09ab2a097a96be1e2e998cb738c4a8b313cf9558b60c913cdfafe6005792ea5282
SSDEEP

768:klglxgQu3QcCZ6IhucK+hUOHGfai8eitLr7pm:kKlyQu3QLhdhUOmfaltLr7p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CheckNetIsolation.exe

Files

CheckNetIsolation.exe
.exe windows x64

e437a3a0162600ce23b282a0dfa53d7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_exit
_cexit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
__setusermatherr
fprintf
_initterm
_wsetlocale
swprintf_s
towupper
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
wprintf
__iob_func
exit
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlVirtualUnwind
RtlIsParentOfChildAppContainer
RtlFreeSid
RtlEqualSid
EtwTraceMessage
RtlIpv4AddressToStringW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
SetConsoleCtrlHandler

ws2_32

htonl

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
SetEvent
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

fwpuclnt

FwpmEngineSetOption0
FwpmNetEventSubscribe4
FwpmEngineOpen0
FwpmFreeMemory0
FwpmNetEventUnsubscribe0
FwpmEngineClose0
FwpmProviderAdd0
FwpmFilterAdd0
FwpmEngineGetOption0

firewallapi

NetworkIsolationEnumAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationSetAppContainerConfig
FwEmptyWFAddresses

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e437a3a0162600ce23b282a0dfa53d7b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-console-l1-1-0

ws2_32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

fwpuclnt

firewallapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 708B

.didat Size: 512B - Virtual size: 152B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 108B

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 708B

.didat
Size: 512B - Virtual size: 152B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 108B