officebackgroundtaskhandler[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

officebackgroundtaskhandler.exe
Size

23KB
MD5

d069d79aa42e0b46091a65d88331317e
SHA1

126ddd0dda7a81eb221081aad79d02c85303ca8e
SHA256

87134574f28f167f11db5e2ac373d1fc9aeba9cdca047af1cb68d43702267958
SHA512

13aa38f5a4947d26afa7c8a10090137f520844fcccd561cb08503420ce6f5c5674a8618992d7e827df1bf3e216e8f6f9553e179d5f793ba0a16041bfc560e35a
SSDEEP

384:R5Ku9AzKJK7ys7VXCCvT1Nq0GftpBjMHpFrxT4bHRN7t0zlZpDJR:R8uCePQJC21viKJFr6buHtf

Score

1^/10

Malware Config

Signatures

Files

officebackgroundtaskhandler.exe
.exe windows:6 windows x86

144ccd7f4cd7939c86705a069bbe12d0

Code Sign

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 22:09

Not After

17/02/2018, 22:09

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:66:9c:3f:05:f1:39:87:f6:8d:7c:f5:7b:cf:d5:b2:cd:e5:df:5d:cd:51:4d:3a:81:76:53:e9:3c:cb:da:63
Signer

Actual PE Digest

71:66:9c:3f:05:f1:39:87:f6:8d:7c:f5:7b:cf:d5:b2:cd:e5:df:5d:cd:51:4d:3a:81:76:53:e9:3c:cb:da:63

Digest Algorithm

sha256

PE Digest Matches

true

8e:52:84:2e:3f:f8:67:ff:ce:b0:48:13:51:9e:cf:fd:57:f1:3b:9b
Signer

Actual PE Digest

8e:52:84:2e:3f:f8:67:ff:ce:b0:48:13:51:9e:cf:fd:57:f1:3b:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
TlsFree
FlsFree
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WerRegisterMemoryBlock
GetTickCount
GetProcessHeap
HeapSetInformation
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter

vcruntime140

_except_handler4_common
memset
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

exit
_crt_atexit
_controlfp_s
_initialize_onexit_table
_cexit
_initterm_e
_initterm
_exit
_register_thread_local_exe_atexit_callback
_c_exit
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
terminate
_set_app_type
_register_onexit_function
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
__initialize_lconv_for_unsigned_char

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

144ccd7f4cd7939c86705a069bbe12d0

Code Sign

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9Certificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

71:66:9c:3f:05:f1:39:87:f6:8d:7c:f5:7b:cf:d5:b2:cd:e5:df:5d:cd:51:4d:3a:81:76:53:e9:3c:cb:da:63Signer

8e:52:84:2e:3f:f8:67:ff:ce:b0:48:13:51:9e:cf:fd:57:f1:3b:9bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 920B

.reloc Size: 512B - Virtual size: 376B

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

71:66:9c:3f:05:f1:39:87:f6:8d:7c:f5:7b:cf:d5:b2:cd:e5:df:5d:cd:51:4d:3a:81:76:53:e9:3c:cb:da:63
Signer

8e:52:84:2e:3f:f8:67:ff:ce:b0:48:13:51:9e:cf:fd:57:f1:3b:9b
Signer

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 920B

.reloc
Size: 512B - Virtual size: 376B