smartscreen[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

smartscreen.exe
Size

2.3MB
MD5

0b474d4ec76ceca0c28b79bc89f51151
SHA1

1a4d341a9fb5e5161731f8ceea5202d0465348e2
SHA256

f1cffb8ba8c7ed4ee688bb37778b72d3ab8a1c1a7986fd3d2bffa783540d088c
SHA512

1b9cbdac5e628e00a621b2e6e4a7e6b998dc2d91c1901511334a0b3116a60c2ce643286467d1933d3792ad00fd4d36346f74ab9ab80c8a98d738ca0ce8c85e3c
SSDEEP

49152:XYVj023KlPnSekFFhsBeSqTr108y1pCbE4mj4NA/u8r37UnxNDi:TPS+r37eN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
smartscreen.exe

Files

smartscreen.exe
.exe windows:10 windows x64 arch:x64

ce3b5f238dd7a7ebc8f28d4250477a41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

smartscreen.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_crt_atexit
_cexit
_set_app_type
_exit
_beginthreadex
_configure_wide_argv
__p___wargv
__p___argc
_initialize_wide_environment
_get_initial_wide_environment
abort
_initterm
terminate
_invalid_parameter_noinfo_noreturn
_initterm_e
_errno
exit
_invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

fsetpos
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
setvbuf
_wfsopen
fflush
ungetc
fclose
_get_stream_buffer_pointers
fread
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
fgetc
fputc
__stdio_common_vsprintf_s
fwrite
fgetpos
_fseeki64
__p__commode
fseek
_set_fmode

api-ms-win-crt-string-l1-1-0

iswdigit
toupper
iswxdigit
tolower
strcpy_s
_wcsicmp
strnlen
_wcsdup
iswlower
_stricmp
towlower
iswupper
iswspace
isxdigit
strcspn
wcsnlen
iswascii
isupper
islower
__strncnt
wcscmp

api-ms-win-crt-heap-l1-1-0

_malloc_base
realloc
_callnewh
_calloc_base
calloc
_free_base
_set_new_mode
malloc
free

ntdll

NtQuerySection
NtCreateSection
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlGetDeviceFamilyInfoEnum
RtlIpv4StringToAddressExW
RtlGetVersion
RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlFreeHeap

api-ms-win-core-fibers-l2-1-0

DeleteFiber
SwitchToFiber
ConvertThreadToFiber
ConvertFiberToThread

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
FreeLibrary
GetModuleHandleA
SizeofResource
LockResource
LoadResource

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
CreateEventExW
ReleaseSRWLockShared
ReleaseSemaphore
WaitForSingleObject
AcquireSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateMutexW
LeaveCriticalSection
ReleaseMutex
TryAcquireSRWLockExclusive
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread
GetProcessTimes
GetCurrentProcess
GetCurrentThread
OpenThreadToken
GetProcessId
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetThreadPreferredUILanguages
GetUserPreferredUILanguages
LCMapStringEx
GetSystemPreferredUILanguages
SetThreadPreferredUILanguages
IdnToAscii
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsGetValue
FlsSetValue

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty

api-ms-win-core-com-l1-1-0

CoReleaseMarshalData
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoResumeClassObjects
CoRegisterClassObject
CoWaitForMultipleObjects
CoDecrementMTAUsage
StringFromGUID2
CoTaskMemRealloc
CoAddRefServerProcess
CoReleaseServerProcess
CreateStreamOnHGlobal
CoInitializeSecurity
CoIncrementMTAUsage
CoImpersonateClient
CoMarshalInterface
CoGetCallContext
CoRevertToSelf
CoRevokeClassObject
PropVariantClear
CoCreateGuid
CoCreateFreeThreadedMarshaler

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
InitOnceExecuteOnce
Sleep
SleepConditionVariableSRW

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory
RoRegisterActivationFactories
RoRevokeActivationFactories
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

combase

ord69

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
__pctype_func
_configthreadlocale
___lc_locale_name_func
setlocale
_lock_locales
_unlock_locales
___lc_codepage_func
localeconv

api-ms-win-crt-convert-l1-1-0

_itow_s
wcstol
wcstoull
_i64toa_s
wcstoll
wcstod
_ui64tow_s
_i64tow_s
_ui64toa_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-math-l1-1-0

ceilf
ceil
log2
frexp

api-ms-win-crt-utility-l1-1-0

rand_s

bcrypt

BCryptCreateHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathFileExistsW

api-ms-win-core-fibers-l2-1-1

CreateFiberEx

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetFinalPathNameByHandleW
FindNextFileW
CreateFileW
DeleteFileW
GetDriveTypeW
GetLongPathNameW
GetFileAttributesW
GetFileSizeEx
FindClose
SetFilePointerEx
SetEndOfFile

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

crypt32

CryptUnprotectData
CertGetNameStringW
CryptFindOIDInfo
CryptMsgGetParam
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CryptStringToBinaryW
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateChain
CryptBinaryToStringW
CryptProtectData

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
OpenProcess

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
GetLengthSid
CopySid

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpool

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-path-l1-1-0

PathCchFindExtension
PathCchIsRoot
PathCchRemoveFileSpec
PathAllocCanonicalize
PathAllocCombine
PathCchStripToRoot

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

ws2_32

ntohs
htons

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-rtcore-ntuser-window-l1-1-0

AllowSetForegroundWindow

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-url-l1-1-0

PathIsURLW

urlmon

CoInternetCreateSecurityManager

api-ms-win-appmodel-runtime-l1-1-0

GetPackagesByPackageFamily
GetPackageFullName

wintrust

WTGetSignatureInfo
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 777KB - Virtual size: 784KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce3b5f238dd7a7ebc8f28d4250477a41

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

ntdll

api-ms-win-core-fibers-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

combase

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

bcrypt

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-fibers-l2-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-fibers-l1-1-1

crypt32

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-psapi-l1-1-0

ws2_32

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-winrt-robuffer-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-url-l1-1-0

urlmon

api-ms-win-appmodel-runtime-l1-1-0

wintrust

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 245KB - Virtual size: 244KB

.data
Size: 777KB - Virtual size: 784KB

.pdata
Size: 51KB - Virtual size: 51KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 11KB - Virtual size: 11KB