KStudioHostService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

KStudioHostService.exe
Size

1.2MB
MD5

0f0258b6624ba30eb07f3e8f89815986
SHA1

8f31d1e711f0d9614fdb6c8826c012c00668d973
SHA256

0e156d2554a46f869db7fdf88740e33e262d7ac2768ae4d52c93822a1df56707
SHA512

31abe1eb440959e4b688184eba755d3fa1bd18b06dc95282c0881104c366b087f02a831d7d0efd0c2f5c3897a0e01004f091d3c564b321d78c66f2d6ba2fc83e
SSDEEP

24576:jw1Gk8YrbADw2gGZs7T13GZp7hfvP1Nra5Ae8/CMMdpu:jtDYHAPg5TlGZp7hfvXa5Ae8/CMMd

Score

1^/10

Malware Config

Signatures

Files

KStudioHostService.exe
.exe windows:6 windows x64

20b3844f4b0ea7da38fc4b0ac7b98142

Code Sign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:52:b4:ea:12:e4:bb:75:0e:23:35:8b:ad:af:d1:39:ae:db:78:46:4e:93:69:48:71:89:4c:ff:85:e0:03:4e
Signer

Actual PE Digest

42:52:b4:ea:12:e4:bb:75:0e:23:35:8b:ad:af:d1:39:ae:db:78:46:4e:93:69:48:71:89:4c:ff:85:e0:03:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateNamedPipeW
PeekNamedPipe
PostQueuedCompletionStatus
VirtualAlloc
GetFileSizeEx
VirtualFree
SetFilePointerEx
GetQueuedCompletionStatus
SetEndOfFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ConnectNamedPipe
UnmapViewOfFile
MultiByteToWideChar
ProcessIdToSessionId
MapViewOfFileFromApp
OpenFileMappingW
ReadFile
SetNamedPipeHandleState
CreateEventExW
WriteFile
GetOverlappedResultEx
GetCurrentProcess
DuplicateHandle
FreeLibrary
GetModuleFileNameW
SetConsoleCtrlHandler
CreateMutexW
CreateEventW
WaitForSingleObject
ReleaseMutex
ResetEvent
SetEvent
GetLastError
InitializeSRWLock
CloseHandle
CreateFileW
GetProcessHeap
HeapFree
HeapAlloc
QueryPerformanceFrequency
CreateIoCompletionPort
DeviceIoControl
SetLastError
GetOverlappedResult
DecodePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
GetCurrentThreadId
GetSystemTime
DeleteFileW
FindNextFileW
FindClose
InitializeCriticalSectionEx
GetFileAttributesW
GetSystemDirectoryW
CreateDirectoryW
OutputDebugStringW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateThread
GetTickCount64
FindFirstFileW

msvcr110

_amsg_exit
memset
memcpy
memcmp
wprintf
_wcsicmp
wcschr
swprintf_s
wcsncpy_s
wcscat_s
_vsnwprintf_s
free
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtSetUnhandledExceptionFilter
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__CxxFrameHandler3
??2@YAPEAX_K@Z
?terminate@@YAXXZ
_XcptFilter
_fmode
__winitenv
__C_specific_handler
_initterm
malloc
strnlen
wcsstr
printf
??_V@YAXPEAX@Z
_snwprintf_s
strcpy_s
_purecall
??3@YAXPEAX@Z
memcpy_s
realloc
memmove
__wgetmainargs
qsort
_wcsnicmp
wcsrchr
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
vswprintf_s
_vsnwprintf
towlower
_itow_s
_commode
exit
__set_app_type
wcscpy_s

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

rpcrt4

UuidCreate
UuidFromStringW

advapi32

EventWrite
RegOpenKeyExW
EventRegister
RegCloseKey
EventUnregister
RegQueryValueExW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

k4wcll

EtxEventWrite
EtxUnregister
EtxRegister
EtxFillCommonFields_v7

Exports

Exports

?s_pSingleton@SnapshotController@XStudio2@@0PEAV12@EA

Sections

.text
Size: 508KB - Virtual size: 507KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 467KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20b3844f4b0ea7da38fc4b0ac7b98142

Code Sign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

42:52:b4:ea:12:e4:bb:75:0e:23:35:8b:ad:af:d1:39:ae:db:78:46:4e:93:69:48:71:89:4c:ff:85:e0:03:4eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr110

setupapi

rpcrt4

advapi32

version

k4wcll

Exports

Exports

Sections

.text Size: 508KB - Virtual size: 507KB

RT_CODE Size: 2KB - Virtual size: 2KB

.rdata Size: 215KB - Virtual size: 215KB

.data Size: 467KB - Virtual size: 499KB

.pdata Size: 25KB - Virtual size: 24KB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 14KB - Virtual size: 13KB

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

42:52:b4:ea:12:e4:bb:75:0e:23:35:8b:ad:af:d1:39:ae:db:78:46:4e:93:69:48:71:89:4c:ff:85:e0:03:4e
Signer

.text
Size: 508KB - Virtual size: 507KB

RT_CODE
Size: 2KB - Virtual size: 2KB

.rdata
Size: 215KB - Virtual size: 215KB

.data
Size: 467KB - Virtual size: 499KB

.pdata
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 14KB - Virtual size: 13KB