SearchFilterHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SearchFilterHost.exe
Size

178KB
MD5

64737e42a9c4b578ec4cc3a85023ee20
SHA1

24ffb2829abba89b5389e8e0de48d37d478af48b
SHA256

a674a1e3942eef2fe5e468008cb1b714726d700bb67d25dd31ee98c921c158ef
SHA512

00247b72ef182c66ee948879a8121a32d84b31d14a4ff2dcd5084658b6e77f8b77cf65e08a7eb317a1756a50011216873be6c92681332521e6806b908fafed3a
SSDEEP

3072:X9NUdPmrJmnMpayvz2GCVL2S1ihk6kvtfGq0ev3U5WNq4:oRCm0ayvSGCVLIrkR10efUKq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchFilterHost.exe

Files

SearchFilterHost.exe
.exe windows:10 windows x86 arch:x86

c2d0ead7447e528db58e12f42db95b83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchFilterHost.pdb

Imports

msvcrt

bsearch
wcsncmp
_amsg_exit
_wcsnicmp
__p__commode
_XcptFilter
_wcsicmp
__wgetmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_errno
realloc
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_controlfp
memset
wcsncpy_s
malloc
_except_handler4_common
free
_vsnprintf_s
_wtoi64
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
exit
??1exception@@UAE@XZ
_purecall
_itow_s
strerror
_wtoi
memcpy_s
_vsnwprintf
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-security-base-l1-2-0

AddAce
GetLengthSid
GetAclInformation
InitializeSecurityDescriptor
AddAccessAllowedAce
SetSecurityDescriptorOwner
IsValidSid
CreateWellKnownSid
InitializeAcl
GetAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
GetTokenInformation
CopySid

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleExW
GetModuleHandleA
GetProcAddress
SizeofResource
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
FreeLibrary
FindResourceExW
LoadStringW

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW
LookupAccountSidW

api-ms-win-core-com-l1-1-1

CoInitializeSecurity
CoGetMarshalSizeMax
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
CoMarshalInterface
CoTaskMemFree
StringFromCLSID
CoInitializeEx
CoReleaseMarshalData
CoTaskMemAlloc
CreateStreamOnHGlobal

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
ReleaseMutex
EnterCriticalSection
CreateSemaphoreExW
SetEvent
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
Sleep
ReleaseSemaphore
WaitForSingleObject
DeleteCriticalSection

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
HeapSetInformation
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetErrorMode
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
GetHandleInformation

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetProcessTimes
OpenProcessToken
OpenThreadToken
GetCurrentThread
TerminateProcess
SetPriorityClass
GetThreadTimes

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-localization-obsolete-l1-3-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNewNoThrow
ciDelete

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-1

GetTimeFormatW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2d0ead7447e528db58e12f42db95b83

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-security-base-l1-2-0

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-localization-obsolete-l1-3-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 79KB - Virtual size: 78KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 79KB - Virtual size: 78KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 6KB - Virtual size: 5KB