CheckNetIsolation[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CheckNetIsolation.exe
Size

52KB
MD5

fc6d9ae86e0f91c5c2b246eb63ddf6f8
SHA1

76d0d51b3107540546637948e51c9f481be25cb5
SHA256

c5769e6a5782eed6c5e71375d24d365dc9341f3ec49689d4d55e224103331b64
SHA512

1d9c19233fe96ddf4685027b8f48e84f66c8c56553be6887f8e703074a8450625ff37774eba6365426910f7b310a45472fd6d2ab33f52a09556ca6f209fdb84e
SSDEEP

768:qw7adATtR10H/MDJKQ78Hza94ZSIkKt2HIoj7pU:qwmdpH/3Q8za9Y3t2Hnj7p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CheckNetIsolation.exe

Files

CheckNetIsolation.exe
.exe windows:10 windows x64 arch:x64

e437a3a0162600ce23b282a0dfa53d7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_exit
_cexit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
__setusermatherr
fprintf
_initterm
_wsetlocale
swprintf_s
towupper
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
wprintf
__iob_func
exit
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlVirtualUnwind
RtlIsParentOfChildAppContainer
RtlFreeSid
RtlEqualSid
EtwTraceMessage
RtlIpv4AddressToStringW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
SetConsoleCtrlHandler

ws2_32

htonl

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
SetEvent
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

fwpuclnt

FwpmEngineSetOption0
FwpmNetEventSubscribe4
FwpmEngineOpen0
FwpmFreeMemory0
FwpmNetEventUnsubscribe0
FwpmEngineClose0
FwpmProviderAdd0
FwpmFilterAdd0
FwpmEngineGetOption0

firewallapi

NetworkIsolationEnumAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationSetAppContainerConfig
FwEmptyWFAddresses

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e437a3a0162600ce23b282a0dfa53d7b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-console-l1-1-0

ws2_32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

fwpuclnt

firewallapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 16KB - Virtual size: 14KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 720B

.didat Size: 4KB - Virtual size: 152B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 124B

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 720B

.didat
Size: 4KB - Virtual size: 152B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 124B