SearchIndexer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

SearchIndexer.exe
Size

857KB
MD5

a595cc3259feb5ebf5b5badad675e7ed
SHA1

8c6f45b01789039ecd6fc7fb3a95fb3642b4ed0a
SHA256

4847a26e4da8041e6c7ee5e44160935e1b8a9a6692cdd5712f8465124e181e3d
SHA512

e03232691f5b9b3b15e5b8e4c92763e3a6c4a1c071c5128f4c89f7fe9dbc5ccf05d7cf72a2258715e7d3bdef854736de35e34e69c47cd29444ab12f4eee0247f
SSDEEP

24576:Hj2kC4MF1EC4/L6mMYXioHJRI1uvhVQ50/:D2nyJMYSWJauvhVQ50/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchIndexer.exe

Files

SearchIndexer.exe
.exe windows x86

91b2ac6e46227f375f7b2db5800ab9c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__pctype_func
___lc_collate_cp_func
memcmp
setlocale
toupper
wcstok
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
strchr
vswprintf_s
_vscwprintf
_wcslwr_s
wcspbrk
qsort
_get_errno
_set_errno
bsearch
memset
strncmp
swscanf
towupper
abort
_wtol
wcschr
iswxdigit
___lc_codepage_func
iswspace
_wcsdup
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
__crtCompareStringW
_wcsicmp
_controlfp
realloc
___lc_handle_func
_errno
_except_handler4_common
??1type_info@@UAE@XZ
memcpy_s
_onexit
__dllonexit
_unlock
__crtLCMapStringW
_lock
?terminate@@YAXXZ
_acmdln
wcsstr
_initterm
__setusermatherr
memmove_s
_get_current_locale
_free_locale
_ismbblead
__p__fmode
_cexit
___mb_cur_max_func
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_vsnwprintf
memmove
__CxxFrameHandler3
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
wcstol
??0exception@@QAE@ABQBD@Z
calloc
wcsncpy_s
malloc
wcscat_s
wcscpy_s
wcsncmp
_wcsnicmp
free

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadResource
GetModuleFileNameA
LoadStringW
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
LockResource
SizeofResource
FindStringOrdinal
GetModuleHandleExW
FindResourceExW
GetProcAddress

api-ms-win-core-file-l1-1-0

FindClose
DeleteFileW
FindNextFileW
FindVolumeClose
FindFirstFileExW
CreateDirectoryW
FindFirstFileW
RemoveDirectoryW
GetVolumeInformationW
SetFileAttributesW
FindFirstVolumeW
FindNextVolumeW
GetFileTime
GetDriveTypeW
GetFileAttributesExW
GetLogicalDrives
CompareFileTime
GetFileAttributesW
CreateFileW
SetFileTime

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce
WakeAllConditionVariable

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
CreateEventW
InitializeCriticalSectionEx
OpenEventW
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
SetEvent
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
EnterCriticalSection
ReleaseSRWLockShared
CreateMutexW
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapDestroy
HeapFree
HeapSize
HeapSetInformation
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoInitializeEx
CoGetMalloc
PropVariantClear
CoImpersonateClient
CoRevertToSelf
IIDFromString
CoTaskMemAlloc
CLSIDFromString
CoUninitialize
CoCreateInstance
CoRevokeClassObject
CoInitializeSecurity
CoTaskMemRealloc
CoTaskMemFree
CoMarshalInterface
CoRegisterClassObject
StringFromGUID2

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
SetPriorityClass
GetCurrentProcess
GetStartupInfoW
TlsFree
GetCurrentThread
TerminateProcess
OpenThreadToken
CreateThread
OpenProcessToken
GetCurrentThreadId
TlsAlloc

ntdll

RtlQueryPackageClaims
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlIsStateSeparationEnabled
RtlGetPersistedStateLocation
RtlQueryWnfStateData
NtOpenFile

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegGetKeySecurity
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegGetValueW
RegEnumKeyExW
RegDeleteKeyExW
RegEnumValueW

api-ms-win-core-localization-l1-2-0

GetSystemPreferredUILanguages
ResolveLocaleName
GetLocaleInfoW
LCMapStringW
LocaleNameToLCID
GetSystemDefaultLCID
FormatMessageW
GetNLSVersionEx

oleaut32

VarUI4FromStr
SysStringLen
VariantClear
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
VarBstrCat
SysAllocString
SysAllocStringByteLen
VariantInit
SysStringByteLen
SysFreeString

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAppendW
PathIsUNCW
PathCanonicalizeW
PathIsRootW
PathSkipRootW
PathFileExistsW
PathFindNextComponentW
PathIsUNCServerW
PathStripToRootW
PathAddBackslashW
PathIsUNCServerShareW
PathRemoveBackslashW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringW
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
ExpandEnvironmentStringsW
SearchPathW
GetEnvironmentVariableW
GetCommandLineW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventActivityIdControl
EventProviderEnabled
EventWriteTransfer
EventRegister
EventEnabled

api-ms-win-shcore-registry-l1-1-0

SHSetValueW
SHGetValueW
SHCopyKeyW
SHDeleteKeyW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetSystemDirectoryW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
SetProcessMitigationPolicy

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNewNoThrow
ciDelete
ciNew

shcore

ord1
SHStrDupW

mssrch

?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
??1CSearchServiceObj@@QAE@XZ
??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGXXZ

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNICW
StrStrIW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

Sections

.text
Size: 608KB - Virtual size: 607KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91b2ac6e46227f375f7b2db5800ab9c4

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

oleaut32

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

shcore

mssrch

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

rpcrt4

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

Sections

.text Size: 608KB - Virtual size: 607KB

.data Size: 3KB - Virtual size: 10KB

.idata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 372B

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 608KB - Virtual size: 607KB

.data
Size: 3KB - Virtual size: 10KB

.idata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 372B

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 40KB - Virtual size: 39KB