IMESEARCH[.]EXE

Sharing

Copy URL

Twitter E-mail

General

Target

IMESEARCH.EXE
Size

126KB
MD5

fdf041baea144d81207789044dfa5d58
SHA1

30df4c423b54d308461db2a3b106371f1790d453
SHA256

259f7cd7136d63183db9e738aeb85065189858821b0c08223d817d13eb5bfa71
SHA512

61c80c95b97ffe23f84ba2265f4088cb36d41faf18a22a51eaeed313f2e0d31eca3131b46d2c161aa128b0a04f975799b3b3a446d2757678e555e0bda84bd56a
SSDEEP

1536:Ml++4JhoJrHVUpXqZZKhRWysq76O/czbS5lbiUbtM+tUE5+lVDBQa9uk:Mw+ah4VjZZqm4LiEt/UEkljl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IMESEARCH.EXE

Files

IMESEARCH.EXE
.exe windows:10 windows x86

5d163e12349cb1f43749ec0ad3773de3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
GetTokenInformation
OpenProcessToken
IsValidSid
GetSidSubAuthority
GetSidSubAuthorityCount
RegDeleteKeyW

kernel32

lstrcmpiW
LoadLibraryExW
LockResource
GetUserDefaultUILanguage
GetCommandLineW
SetEvent
GetCurrentThreadId
GetSystemInfo
GetExitCodeThread
TerminateThread
CloseHandle
CreateEventW
CreateIoCompletionPort
LocalFree
ResetEvent
PostQueuedCompletionStatus
WaitForSingleObject
Sleep
CreateThread
GetQueuedCompletionStatus
WideCharToMultiByte
GetCurrentProcessId
CompareFileTime
FreeLibrary
SizeofResource
EnterCriticalSection
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetVersionExW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW

user32

DispatchMessageW
SetWindowLongW
GetWindowLongW
TranslateMessage
CharUpperW
PostMessageW
SetForegroundWindow
GetClientRect
GetMessageW
PostThreadMessageW
CharNextW
SetProcessDPIAware
GetFocus
CharLowerBuffW
UnregisterClassA
SendMessageW
GetDlgItem
EndDialog
LoadIconW
GetWindowTextW
SetWindowTextW
EnableWindow
DialogBoxIndirectParamW
MessageBoxW

msvcrt

__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
exit
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_exit
ldiv
_except_handler4_common
_controlfp
_callnewh
memset
memmove_s
wcscat_s
wcscpy_s
_beginthreadex
_wcsicmp
_vscwprintf
vswprintf_s
wcsncpy_s
malloc
free
_purecall
memcpy_s
memmove
??_V@YAXPAX@Z
??3@YAXPAX@Z
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_wcmdln
_initterm
__setusermatherr
__p__fmode
??0exception@@QAE@ABV0@@Z
_cexit
__set_app_type

ole32

CoSuspendClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoInitializeEx
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysStringByteLen
VarBstrCmp
VariantInit
SysStringLen
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
VariantClear
SysAllocString
SysAllocStringByteLen
SysFreeString
VarUI4FromStr

shell32

CommandLineToArgvW
ShellExecuteW

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d163e12349cb1f43749ec0ad3773de3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

shell32

shlwapi

comctl32

Sections

.text Size: 66KB - Virtual size: 65KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 49KB - Virtual size: 48KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 66KB - Virtual size: 65KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 49KB - Virtual size: 48KB

.reloc
Size: 4KB - Virtual size: 4KB