c41d41f7415e6828f38111eac75039c8addd92ea3ea967c7ac6935a9df9f38c5

Sharing

Copy URL Twitter E-mail

General

Target

c41d41f7415e6828f38111eac75039c8addd92ea3ea967c7ac6935a9df9f38c5
Size

1.8MB
MD5

70498b1a9098f7c045ed152cc53515e2
SHA1

c5a024468fa67582edad273fec3ff9e82dbfcfff
SHA256

c41d41f7415e6828f38111eac75039c8addd92ea3ea967c7ac6935a9df9f38c5
SHA512

f50c456c2ac525b38feebb5ed2ad205d0b065a849216ffdb430cfbcdf1e9f7869be74827dd42ee76d782a510019c4a49c4070d61e92627b56e2851a5a79e75e0
SSDEEP

49152:fBozXmvnGPiSI33gfqvLZoUzYXZxv0Dmg27RnWGj:fCyG1Iyqv9oUzYXTv0D527BWG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c41d41f7415e6828f38111eac75039c8addd92ea3ea967c7ac6935a9df9f38c5

Files

c41d41f7415e6828f38111eac75039c8addd92ea3ea967c7ac6935a9df9f38c5
.exe windows:6 windows x64 arch:x64

4960e695fa4082d76d1d5a220985c6c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\paul1_lee\Desktop\ScreenXpert3\AsusScreenXpertService\x64\Release\AsusScreenXpertHostService.pdb

Imports

rpcrt4

RpcEpUnregister
RpcEpRegisterW
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcServerRegisterIf3
RpcServerListen
RpcServerInqBindings
RpcBindingVectorFree
NdrServerCallAll
NdrServerCall2

kernel32

GetModuleFileNameW
Sleep
GetUserDefaultLCID
EnumSystemLocalesW
FileTimeToLocalFileTime
SetLastError
lstrcmpA
GetFileSizeEx
MultiByteToWideChar
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
LocalFree
HeapSize
CreateFileW
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetTimeZoneInformation
CreateDirectoryW
DeleteFileW
FindFirstFileW
FindNextFileW
GetFileAttributesW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
OutputDebugStringW
OutputDebugStringA
ProcessIdToSessionId
OpenProcess
SetEndOfFile
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
WTSGetActiveConsoleSessionId
WideCharToMultiByte
DecodePointer
SubmitThreadpoolWork
CreateThreadpoolWork
SetConsoleCtrlHandler
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReadConsoleW
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
IsValidLocale
GetEnvironmentStringsW
GetOEMCP
FileTimeToSystemTime
GetACP
RtlUnwind
GetLocaleInfoW
IsValidCodePage
FindFirstFileExW
__C_specific_handler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
GetStringTypeW
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
EncodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateThread
ExitThread
ResumeThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
GetProcAddress
WriteFile
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapFree
HeapAlloc
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
FindClose

shlwapi

PathFileExistsW

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
SetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
OpenProcessToken
CreateProcessAsUserW
CreateServiceW
DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
EventRegister
EventSetInformation
EventWriteTransfer
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
ControlService
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
SetEntriesInAclW
QueryServiceStatus
StartServiceW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

crypt32

CryptDecodeObjectEx
CryptDecodeObject
CryptFindOIDInfo
CryptMsgOpenToDecode
CryptMsgClose
CryptMsgUpdate
CryptMsgGetParam
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertGetNameStringW
CryptQueryObject

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationW

Sections

.text
Size: 726KB - Virtual size: 726KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 333KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4960e695fa4082d76d1d5a220985c6c1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

shlwapi

user32

advapi32

api-ms-win-security-base-l1-2-2

crypt32

wintrust

userenv

wtsapi32

Sections

.text Size: 726KB - Virtual size: 726KB

.rdata Size: 171KB - Virtual size: 170KB

.data Size: 10KB - Virtual size: 19KB

.pdata Size: 38KB - Virtual size: 38KB

_RDATA Size: 512B - Virtual size: 384B

.rsrc Size: 333KB - Virtual size: 332KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 726KB - Virtual size: 726KB

.rdata
Size: 171KB - Virtual size: 170KB

.data
Size: 10KB - Virtual size: 19KB

.pdata
Size: 38KB - Virtual size: 38KB

_RDATA
Size: 512B - Virtual size: 384B

.rsrc
Size: 333KB - Virtual size: 332KB

.reloc
Size: 572KB - Virtual size: 576KB