gpresult[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

gpresult.exe
Size

232KB
MD5

509b3a846f5cea0f8a18e6a9388fa98d
SHA1

8c5538554a08acb1d0b57ca7c58b6a616e35a988
SHA256

6c3a6c4929e468f158f03da312e54350fcab3fcc23558094c77c25ab9811bdc4
SHA512

e15cb646883209b2c1e7fdd3498e8fbc126bbef2c88fc3f751b0f5ea141a891b99fdb59f0c4df30d5476f87f74ad1bf975530ca897881f9fcc706030938e7aa4
SSDEEP

6144:gGEuM5g8vSWNr0J3XrI55J/ApSGFnBAMvM:9En1vSWNr0hrIvqpJhpM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gpresult.exe

Files

gpresult.exe
.exe windows:10 windows x64 arch:x64

e1f3835209ec4b0e01d101284bd1a751

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
LookupAccountSidW
RegOpenKeyExW
RegCloseKey
RegGetValueW
LsaOpenPolicy
LsaNtStatusToWinError
LsaClose
LsaEnumerateAccountRights
LookupPrivilegeDisplayNameW
LsaFreeMemory

kernel32

SetThreadPreferredUILanguages
SetLastError
GetFileAttributesExW
GetLastError
CloseHandle
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
WriteConsoleW
OpenMutexW
CreateMutexW
LocalFree
WaitForSingleObject
ReleaseMutex
GetComputerNameExW
GetComputerNameW
GetLocalTime
GetDateFormatW
GetTimeFormatW
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalAlloc
FormatMessageW
VerifyVersionInfoW
CompareStringA

msvcrt

??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_lock
__CxxFrameHandler3
memcpy
wcstok
??1type_info@@UEAA@XZ
_commode
_fmode
__C_specific_handler
__dllonexit
memset
_unlock
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
memmove
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
wcscmp
_purecall
_callnewh
malloc
_vsnwprintf
_wcsicmp
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
__iob_func
_errno
wcstod
wcstol
wcstoul
wcschr
wcsstr
_fileno
_get_osfhandle
fprintf
fflush
wcstok_s
__CxxFrameHandler4
_onexit
?terminate@@YAXXZ

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoInitializeSecurity

sspicli

GetUserNameExW

oleaut32

SafeArrayGetLBound
VariantClear
VariantInit
SysFreeString
SafeArrayGetUBound
SysAllocString
VariantChangeType
SysStringLen
VariantCopy
SysAllocStringByteLen
SafeArrayGetElement

logoncli

DsGetDcNameW

netutils

NetApiBufferFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
ExitProcess

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
LoadStringW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

FindNLSString
GetUserDefaultLCID
GetThreadLocale

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

mpr

WNetCancelConnection2W
WNetGetLastErrorW
WNetAddConnection2W

ws2_32

WSAGetLastError
WSACleanup
inet_addr
GetNameInfoW
WSAStartup

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

ReadFile
GetFileType

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleOutputCP
ReadConsoleW
SetConsoleMode

api-ms-win-core-heap-l1-1-0

HeapValidate
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
HeapSize

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-string-l2-1-0

CharUpperW

srvcli

NetServerGetInfo

framedynos

??YCHString@@QEAAAEBV0@PEBG@Z
??H@YA?AVCHString@@PEBGAEBV0@@Z
?AllocSysString@CHString@@QEBAPEAGXZ
??H@YA?AVCHString@@AEBV0@0@Z
??0CHString@@QEAA@PEBG@Z
??H@YA?AVCHString@@AEBV0@PEBG@Z
??0CHString@@QEAA@AEBV0@@Z
??YCHString@@QEAAAEBV0@AEBV0@@Z
?GetBuffer@CHString@@QEAAPEAGH@Z
??0CHString@@QEAA@PEBD@Z
?FindOneOf@CHString@@QEBAHPEBG@Z
?MakeLower@CHString@@QEAAXXZ
?Format@CHString@@QEAAXPEBGZZ
?SetAt@CHString@@QEAAXHG@Z
?Find@CHString@@QEBAHPEBG@Z
?Mid@CHString@@QEBA?AV1@HH@Z
?Left@CHString@@QEBA?AV1@H@Z
??4CHString@@QEAAAEBV0@AEBV0@@Z
?Find@CHString@@QEBAHG@Z
??1CHString@@QEAA@XZ
??0CHString@@QEAA@XZ
?Empty@CHString@@QEAAXXZ
?Compare@CHString@@QEBAHPEBG@Z
?GetData@CHString@@IEBAPEAUCHStringData@@XZ
?Mid@CHString@@QEBA?AV1@H@Z
?ReleaseBuffer@CHString@@QEAAXH@Z
?GetBufferSetLength@CHString@@QEAAPEAGH@Z
??4CHString@@QEAAAEBV0@PEBG@Z

ntdsapi

DsBindWithCredW
DsCrackNamesW
DsUnBindW
DsFreeNameResultW

secur32

TranslateNameW
GetComputerObjectNameW

user32

wsprintfW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1f3835209ec4b0e01d101284bd1a751

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

api-ms-win-core-com-l1-1-0

sspicli

oleaut32

logoncli

netutils

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

mpr

ws2_32

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-string-l2-1-0

srvcli

framedynos

ntdsapi

secur32

user32

api-ms-win-core-processthreads-l1-1-1

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 640B

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 640B