PhotosService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

PhotosService.exe
Size

564KB
MD5

5be534d662441225f54b4da84d28a42e
SHA1

463ae4dfc138951d5e9db666847a552c8895eaf2
SHA256

d27c7d549fc4a109a2384e553e10bdf4d9053f8a2780e566761157370aad8ac8
SHA512

92c05dc81331c8586b362abec155491445834734421ac66692a74738aad8ec0de0c1cd756d155731a299d282789a9b074de709914c2100c9c4902629ae7b0906
SSDEEP

12288:TvyXYYrf4Y/Lz85twEh0g3wubAIph0lhSMXl+FxlG:Tvy3RusOh0lhSMXlaxk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PhotosService.exe

Files

PhotosService.exe
.exe windows:6 windows x64 arch:x64

bd6aded23bdf003e3e53065a448ca4b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

photosdatabase

?IntToDBOrderBy@Shared@DBSchema@Core@@YA?AW4SelectMediaItemsOrderBy@123@H@Z
?Success@DatabaseResult@Core@@QEBA_NXZ
?IntToDBOrderByDir@Shared@DBSchema@Core@@YA?AW4SelectMediaItemsOrderByDir@123@H@Z

photosservicesdk

??0EventHandler@PhotosService@Core@@QEAA@V?$shared_ptr@VFileSystem@PhotosService@Core@@@std@@V?$shared_ptr@VInstance@Shared@DBSchema@Core@@@4@AEBV?$function@$$A6AXAEBV?$variant@UFileAddEvent@PhotosService@Core@@UFileUpdateEvent@23@UFilePropertiesUpdateEvent@23@UFileDeleteEvent@23@UFileRenameEvent@23@UFolderAddEvent@23@UFolderDeleteEvent@23@UFolderRenameEvent@23@UHeartbeatEvent@23@ULastMessageSentinelEvent@23@UPicturesLibPathAddedEvent@23@UPicturesLibPathRemovedEvent@23@UThumbnailLoadStatusChangedEvent@23@@std@@@Z@4@@Z
??0EventListener@PhotosService@Core@@QEAA@V?$shared_ptr@VFileSystem@PhotosService@Core@@@std@@PEAUHWND__@@V?$shared_ptr@VEventHandler@PhotosService@Core@@@4@@Z
??0PhotosService@0Core@@QEAA@XZ
?OneDrive_GetQuota@PhotosService@1Core@@QEAA?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@XZ
?OneDrive_GetSignInState@PhotosService@1Core@@QEAA?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@XZ
?OneDrive_IsDimeAvailable@PhotosService@1Core@@QEAA?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@XZ
?OneDrive_LaunchDimeDialog@PhotosService@1Core@@QEAA?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@@Z
?UpdateMediaCollection@PhotosService@1Core@@QEAA?AU?$pair@IH@std@@XZ
??1FileSystem@PhotosService@Core@@QEAA@XZ
?CreateStartupMediaItemSet@PhotosService@1Core@@QEAAXW4SelectMediaItemsOrderBy@Shared@DBSchema@2@W4SelectMediaItemsOrderByDir@452@@Z
?ClearDBPropertyStore@PhotosService@1Core@@QEAA?AUDatabaseResult@2@XZ
??1EventHandler@PhotosService@Core@@QEAA@XZ
??1EventListener@PhotosService@Core@@QEAA@XZ
??1PhotosService@0Core@@QEAA@XZ
?HandleEvent@EventListener@PhotosService@Core@@QEAA_NPEAUHWND__@@I_K_J@Z
?InitEventHandler@PhotosService@1Core@@QEAAXV?$shared_ptr@VEventHandler@PhotosService@Core@@@std@@@Z
?InitFileSystem@PhotosService@1Core@@QEAAXV?$shared_ptr@VFileSystem@PhotosService@Core@@@std@@@Z
?DebugLogError@PhotosService@Core@@YAXAEBUDatabaseResult@2@@Z
?CreateSchema@Database@PhotosService@Core@@YA?AU?$pair@V?$shared_ptr@VInstance@Shared@DBSchema@Core@@@std@@UDatabaseResult@Core@@@std@@XZ
?EnableEventHandling@EventListener@PhotosService@Core@@AEAAX_N@Z
?SaveRatingHEIC@PhotosService@1Core@@QEAA_NV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@G@Z
?GetRatingHEIC@PhotosService@1Core@@QEAAGV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?IsVaultItem@PhotosService@1Core@@QEAA_NV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?GetIndexingStatus@PhotosService@1Core@@QEAA?AU?$pair@HH@std@@XZ
?HydrateFile@PhotosService@1Core@@QEAA_NV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?IsReverseGeocodeComplete@PhotosService@1Core@@QEAA_NXZ
?PicturesLibrary_RemoveFolder@PhotosService@1Core@@QEAAHV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?PicturesLibrary_AddFolder@PhotosService@1Core@@QEAAHV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?OneDrive_GetContentURI@PhotosService@1Core@@QEAA?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@@Z
?OneDrive_LaunchShareDialog@PhotosService@1Core@@QEAA?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@@Z
?StopReverseGeocode@PhotosService@1Core@@QEAAXXZ
?StartReverseGeocode@PhotosService@1Core@@QEAAXXZ
?SetIsViewingReparseFolder@PhotosService@1Core@@QEAAX_N@Z
?OnFolderAdded@PhotosService@1Core@@QEAA?AV?$optional@UFolder@PhotosService@Core@@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@@Z
?StartEventListener@PhotosService@1Core@@QEAA_NXZ
??0FileSystem@PhotosService@Core@@QEAA@V?$shared_ptr@VInstance@Shared@DBSchema@Core@@@std@@@Z
?SetDisabledSyncRoots@PhotosService@1Core@@QEAAXV?$span@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@$0?0@std@@@Z
?GetSyncRoots@PhotosService@1Core@@QEAA?AV?$vector@UProviderSyncRoot@PhotosService@Core@@V?$allocator@UProviderSyncRoot@PhotosService@Core@@@std@@@std@@XZ
?OnAppMediaCollectionLoadComplete@PhotosService@1Core@@QEAAXXZ
?ClearMediaCollection@PhotosService@1Core@@QEAA_NXZ

utils

?LogForLevel@Logger@Utils@@CAXW4LoggingLevel@Diagnostics@Foundation@Windows@winrt@@PEB_W1PEAD@Z

kernel32

GetCurrentThreadId
WriteFile
WaitNamedPipeW
CreateFileW
ProcessIdToSessionId
GetCurrentProcessId
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
CloseHandle
TrySubmitThreadpoolCallback
MultiByteToWideChar
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InterlockedPushEntrySList
FormatMessageW
HeapAlloc
HeapFree
GetProcessHeap
LoadLibraryW
FreeLibrary
GetProcAddress
InitializeSListHead
GetSystemTimeAsFileTime
UnhandledExceptionFilter
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RtlVirtualUnwind

user32

LoadCursorW
EndDialog
LoadIconW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
CreateWindowExW
LoadAcceleratorsW
PostQuitMessage
KillTimer
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
SetTimer
RegisterClassExW
LoadStringW
GetMessageW

ole32

CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoGetObjectContext
CoInitialize

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
??1_Lockit@std@@QEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Thrd_yield
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Incref@facet@locale@std@@UEAAXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1_Locinfo@std@@QEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
__std_exception_destroy
_purecall
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
memset
memcpy
__std_exception_copy
memmove

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
exit
_errno
_invalid_parameter_noinfo
abort
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

toupper
iswspace

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
malloc
_callnewh
free

api-ms-win-crt-math-l1-1-0

_fdsign
ceilf
_dsign
_dclass
_ldsign
__setusermatherr
_ldclass
_fdclass

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

oleaut32

SetErrorInfo
GetErrorInfo
SysFreeString
SysAllocString
SysStringLen

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd6aded23bdf003e3e53065a448ca4b0

Headers

DLL Characteristics

File Characteristics

Imports

photosdatabase

photosservicesdk

utils

kernel32

user32

ole32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

oleaut32

Sections

.text Size: 212KB - Virtual size: 212KB

.rdata Size: 215KB - Virtual size: 214KB

.data Size: 29KB - Virtual size: 32KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 212KB - Virtual size: 212KB

.rdata
Size: 215KB - Virtual size: 214KB

.data
Size: 29KB - Virtual size: 32KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 1KB - Virtual size: 1KB