d478eece6bbdbf6624d76f95f614544e

Sharing

Copy URL Twitter E-mail

General

Target

d478eece6bbdbf6624d76f95f614544e
Size

709KB
MD5

d478eece6bbdbf6624d76f95f614544e
SHA1

05f9c055da51fb1f89905923c607009874a33b51
SHA256

a810f0d783e073a206bdad8156c947e07f7931d2635b84f28df492179583498d
SHA512

e37e76d93f8fc4e0768269412d6c3524ff3b930c4d18f09b04bebb652e425b24ac049f0e181c38ddcbefad0ba42539e9280976c94e7a3eb1d3f2ef2b7164cfc2
SSDEEP

12288:RDJnJM4OpSpnO8kT1laguJnV0QJETmvF2UdLr7ql:ZJnJM4OqTWTatviTJP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d478eece6bbdbf6624d76f95f614544e

Files

d478eece6bbdbf6624d76f95f614544e
.exe windows:10 windows x64 arch:x64

28877d46492df107820e0b11fd73235f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TieringEngineService.pdb

Imports

msvcrt

_lock
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_unlock
__dllonexit
_onexit
realloc
_CxxThrowException
_vsnwprintf
wcsncmp
_snwprintf_s
wcsstr
wcscat_s
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_purecall
__C_specific_handler
swprintf_s
memset

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
RtlDoesNameContainWildCards
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlNumberOfClearBits
WinSqmAddToStreamEx
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetThreadErrorMode

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CoRevokeClassObject
CoInitializeEx
CoUninitialize
CoResumeClassObjects
CoRegisterClassObject
CreateStreamOnHGlobal
CoCreateGuid
CoCreateInstance
CoSuspendClassObjects

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
CreateEventW
InitializeCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObject
ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
GetModuleHandleW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
OpenProcessToken
GetStartupInfoW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpool
CreateThreadpoolWait
SetThreadpoolTimer
SetThreadpoolWait
SubmitThreadpoolWork
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
CreateThreadpool
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
FindVolumeClose
FindNextVolumeW
FindFirstFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryW
FindClose
GetVolumePathNameW
GetFinalPathNameByHandleW
CreateFileW
DeleteFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegNotifyChangeKeyValue
RegCreateKeyExW

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

PrivilegeCheck
AdjustTokenPrivileges

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchStripPrefix
PathCchStripToRoot
PathCchSkipRoot

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetCreateTableColumnIndex2W
JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetGetColumnInfoW
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetEnableMultiInstanceW
JetResetSessionContext
JetSetSessionContext
JetComputeStats
JetGetObjectInfoW
JetEndSession
JetRollback
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetBeginTransaction
JetRetrieveColumn
JetDelete
JetCommitTransaction
JetOpenTempTable

clusapi

GetClusterInformation
CloseCluster
OpenCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28877d46492df107820e0b11fd73235f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 253KB - Virtual size: 253KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 400KB - Virtual size: 1.1MB

.text
Size: 253KB - Virtual size: 253KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 400KB - Virtual size: 1.1MB