SearchIndexer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SearchIndexer.exe
Size

755KB
MD5

a3e2b08c9be5663703d66225475d0939
SHA1

0220ba11d1423c849c98a13533f1c83a2880bcf7
SHA256

2fd7b5a0d275e95f36e659faaada443d2a17cfdc626896199af16f91906f88f8
SHA512

f3101292080d5cd2fcd8a85e58f1df16b9c3b50c2af28e8c39017034b325ae4dfe6f0c3349bf09bf0b24c337e70b074563293fd16fbb37bca91985e0e70f21b3
SSDEEP

12288:IB+nyBWikFmux9nVtpVmOsl/cWozPFddzU3TvQbjQztfkR9X:K+nyBWikFms/pVmll/cN9debQbjQc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchIndexer.exe

Files

SearchIndexer.exe
.exe windows:10 windows x86 arch:x86

bd911d0d1d10e52dbbf858301e20f3bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchIndexer.pdb

Imports

msvcrt

??0exception@@QAE@XZ
_free_locale
_get_current_locale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
abort
memcmp
??0exception@@QAE@ABV0@@Z
__pctype_func
___lc_codepage_func
___lc_handle_func
??1exception@@UAE@XZ
___mb_cur_max_func
___lc_collate_cp_func
setlocale
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
strchr
vswprintf_s
_vscwprintf
qsort
_except_handler4_common
wcspbrk
_get_errno
_set_errno
_controlfp
bsearch
realloc
_errno
strncmp
_vsnwprintf
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
swscanf
_wtol
_cexit
_exit
iswxdigit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
memcpy
iswspace
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
towupper
memcpy_s
wcschr
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memmove
_wcslwr_s
_vsnprintf_s
calloc
memset
wcsncpy_s
memmove_s
wcsncmp
_wcsnicmp
??1type_info@@UAE@XZ
wcsstr
_wcsicmp
wcstol
malloc
free

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
FreeLibraryAndExitThread
SizeofResource
GetModuleFileNameA
LoadLibraryExW
LoadResource
FreeLibrary
GetProcAddress
GetModuleHandleW
FindResourceExW
LockResource
GetModuleHandleA
LoadStringW

api-ms-win-core-file-l1-2-1

CreateFileW
RemoveDirectoryW
SetFileTime
GetVolumeNameForVolumeMountPointW
CompareFileTime
FindFirstFileW
GetLogicalDrives
GetDriveTypeW
FindFirstVolumeW
GetVolumeInformationW
CreateDirectoryW
FindNextVolumeW
GetFileAttributesExW
DeleteFileW
FindFirstFileExW
FindVolumeClose
FindNextFileW
SetFileAttributesW
FindClose
GetFileAttributesW
GetVolumePathNamesForVolumeNameW
GetFileTime

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-processthreads-l1-1-2

TlsSetValue
CreateThread
GetCurrentProcessId
OpenProcessToken
TlsFree
TerminateProcess
GetCurrentThread
TlsAlloc
GetCurrentProcess
OpenProcess
GetCurrentThreadId
SetPriorityClass
OpenThreadToken

api-ms-win-core-synch-l1-2-0

WaitForSingleObjectEx
CreateMutexW
SetEvent
OpenSemaphoreW
AcquireSRWLockExclusive
DeleteCriticalSection
InitOnceComplete
Sleep
InitializeCriticalSectionEx
InitOnceBeginInitialize
ReleaseMutex
InitOnceExecuteOnce
InitOnceInitialize
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
WaitForSingleObject
InitializeCriticalSection
ReleaseSRWLockExclusive
CreateEventW
LeaveCriticalSection
OpenEventW
ReleaseSemaphore
CreateMutexExW
EnterCriticalSection
CreateEventExW
CreateSemaphoreExW

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSetInformation
HeapFree
HeapDestroy
HeapSize

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetErrorMode
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-1

CLSIDFromString
CoGetMalloc
CoRevokeClassObject
CoInitializeSecurity
RoGetAgileReference
IIDFromString
CoTaskMemRealloc
StringFromGUID2
CoImpersonateClient
CoRevertToSelf
CoTaskMemFree
CoInitializeEx
CoMarshalInterface
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoRegisterClassObject
CoCreateInstance
PropVariantClear
CoWaitForMultipleHandles
CoGetApartmentType
CoUninitialize

api-ms-win-shcore-thread-l1-1-0

SHCreateThreadRef
SHGetThreadRef
SHSetThreadRef

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyExW
RegOpenKeyExW
RegDeleteTreeW
RegCreateKeyExW
RegSetValueExW
RegGetKeySecurity
RegQueryValueExW
RegDeleteValueW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
SetThreadpoolTimer

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError
NtOpenFile
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification

api-ms-win-core-localization-l1-2-1

GetSystemPreferredUILanguages
FormatMessageW
GetNLSVersionEx
GetLocaleInfoW
ResolveLocaleName
LocaleNameToLCID
GetSystemDefaultLCID
LCMapStringW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathAddBackslashW
PathStripToRootW
PathIsUNCServerW
PathIsUNCServerShareW
PathSkipRootW
PathCanonicalizeW
PathIsRootW
PathFindNextComponentW
PathIsUNCW
PathAppendW
PathRemoveBackslashW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SysAllocStringLen
SysStringLen
VarUI4FromStr
VarBstrCat
SysFreeString
VariantClear
LoadRegTypeLi
SysAllocString
LoadTypeLi
VariantInit
SysAllocStringByteLen
SysStringByteLen

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetTickCount64
GetVersionExA
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW

api-ms-win-core-processenvironment-l1-2-0

SetEnvironmentVariableW
SearchPathW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventEnabled
EventWrite
EventRegister
EventWriteTransfer

api-ms-win-shcore-registry-l1-1-1

SHCopyKeyW
SHGetValueW
SHDeleteKeyW
SHSetValueW

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-core-localization-obsolete-l1-3-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-kernel32-legacy-l1-1-1

GetStartupInfoA
MoveFileW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNew
ciDelete
ciNewNoThrow

shcore

ord1
SHStrDupW
SHRegGetValueW

mssrch

??1CSearchServiceObj@@QAE@XZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
?Cleanup@CSearchServiceObj@@SGXXZ
??0CSearchServiceObj@@QAE@XZ

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrCmpNICW

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-service-core-l1-1-1

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
EnumDependentServicesW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus
ControlService

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-1

GetTimeFormatW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

Sections

.text
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd911d0d1d10e52dbbf858301e20f3bd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ntdll

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-shcore-registry-l1-1-1

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-registry-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

shcore

mssrch

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l2-1-2

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-util-l1-1-0

Sections

.text Size: 517KB - Virtual size: 516KB

.data Size: 3KB - Virtual size: 9KB

.idata Size: 11KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 372B

.rsrc Size: 191KB - Virtual size: 190KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 517KB - Virtual size: 516KB

.data
Size: 3KB - Virtual size: 9KB

.idata
Size: 11KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 372B

.rsrc
Size: 191KB - Virtual size: 190KB

.reloc
Size: 31KB - Virtual size: 31KB