esimtool[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

esimtool.exe
Size

52KB
MD5

e4b810430c0d759ab6e4ce90e02486d0
SHA1

c8b93372311fc9103080a71b508451a6a7dc8a78
SHA256

5fa4f78f01d6b4de79fe03dc18ab70dcbe095f04b044ad720385e4a83ecf62e2
SHA512

7484f9aa0932f0abb0deacad5bf36f814ea4d0b18508c4dd8ca608cb1cfb77125e81f75391a4f3a64587e261509b565dbe9ba396f90f736c71ffc4bc9fd9d08b
SSDEEP

384:WBR5l9RX5NMGv4KkYJE0iLpi2xrq2m5xM1OipVcfZDyLhzBA4dysuSQg:2T9WG4UaM2xMGQipVoy1BAoyH3g

Score

1^/10

Malware Config

Signatures

Files

esimtool.exe
.exe windows:10 windows x64

3aeaa653c08dec60679fe0824a7702c2

Code Sign

33:00:00:06:ad:ac:dd:3c:98:83:5e:29:49:00:00:00:00:06:ad
Certificate

Issuer

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13-07-2023 22:37

Not After

15-09-2024 22:37

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-05-2014 17:33

Not After

28-05-2029 17:43

Subject

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:2e:4f:a8:ca:9b:76:49:4b:e8:46:83:96:54:c8:94:d7:95:4a:df:f5:9d:5c:fe:3a:bc:84:94:aa:e1:89:33
Signer

Actual PE Digest

b1:2e:4f:a8:ca:9b:76:49:4b:e8:46:83:96:54:c8:94:d7:95:4a:df:f5:9d:5c:fe:3a:bc:84:94:aa:e1:89:33

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_c_exit
_initterm_e
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__crt_atexit
_o__wcsicmp
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__cexit
_o__callnewh
_o___p__commode
_o___p___wargv
_o___stdio_common_vfwprintf
_o___p___argc
_o__configure_wide_argv
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler4
_o__configthreadlocale
_o___std_exception_destroy
_o___std_exception_copy
memmove
memcpy

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
DeleteCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-2-3

GetOsManufacturingMode

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW

luiapi

LuiCloseHandle
LuiWipeEsim
LuiRegisterForLpaNotifications
LuiDeleteProfile
LuiRegisterForEsimNotifications
LuiRegisterForAllProfileNotifications
LuiDisableProfile
LuiOpenHandle
LuiEnableProfile

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3aeaa653c08dec60679fe0824a7702c2

Code Sign

33:00:00:06:ad:ac:dd:3c:98:83:5e:29:49:00:00:00:00:06:adCertificate

Extended Key Usages

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03Certificate

Key Usages

b1:2e:4f:a8:ca:9b:76:49:4b:e8:46:83:96:54:c8:94:d7:95:4a:df:f5:9d:5c:fe:3a:bc:84:94:aa:e1:89:33Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-3

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

luiapi

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 792B

.reloc Size: 4KB - Virtual size: 104B

33:00:00:06:ad:ac:dd:3c:98:83:5e:29:49:00:00:00:00:06:ad
Certificate

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

b1:2e:4f:a8:ca:9b:76:49:4b:e8:46:83:96:54:c8:94:d7:95:4a:df:f5:9d:5c:fe:3a:bc:84:94:aa:e1:89:33
Signer

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 792B

.reloc
Size: 4KB - Virtual size: 104B