SearchProtocolHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SearchProtocolHost.exe
Size

160KB
MD5

88f23cf4a9e57d99199f3761f6a48fd9
SHA1

2a238c3ec78bc810f697897f4d541e384b7be6ca
SHA256

79cf96526832dc46a9ef88b7ffc00b8cf3762e2fbe92b42759eaee2a53e239fd
SHA512

b6ebdbdcc2189ebdf69a134310f56454151267aa6098fda5eab23c04912afe229a6a79b968a1f4e9096337e1791dfb624313b10d956b7d0902218a8a283da037
SSDEEP

3072:mu0lgs/UbeSog0CilcleYT0BUbgipF/U/9PI3RbpRTUTAf5k7KniH58VJAqRUp:mu0lgs/UbeSnmlclj4mbgiH/U/9PoZfB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchProtocolHost.exe

Files

SearchProtocolHost.exe
.exe windows:6 windows x86 arch:x86

16b81b80f65bf81003a67234b735409f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchProtocolHost.pdb

Imports

advapi32

CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
EventRegister
EventUnregister
EventWrite
AdjustTokenPrivileges
LookupPrivilegeValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
LookupAccountNameW
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
MakeSelfRelativeSD
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorLength
GetSidSubAuthority
SetSecurityDescriptorSacl
MakeAbsoluteSD
InitializeSid
GetSidLengthRequired
DeleteAce
EqualPrefixSid
LookupAccountSidW
CreateWellKnownSid
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetModuleHandleW
SetLastError
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
GlobalFree
GlobalAlloc
WaitForMultipleObjects
GetTickCount
CreateThread
LoadLibraryW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
ResetEvent
LocalFree
GetHandleInformation
OpenEventW
GetCurrentProcessId
SetErrorMode
HeapSetInformation
lstrlenA
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetThreadTimes
GetCurrentProcess
GetProcessTimes
GetCurrentThreadId
WaitForSingleObject
SetEvent
CreateEventW
GetProcAddress
FreeLibrary
CloseHandle
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
lstrlenW
GetSystemDefaultLCID
CompareStringW
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SearchPathW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetVersionExW
FindResourceExW
WaitForSingleObjectEx
OutputDebugStringW
CopyFileA
DeleteFileA
FlushViewOfFile
GetLocalTime
CreateFileA
FormatMessageA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
LCMapStringW
SetPriorityClass
IsValidCodePage
OpenFileMappingW
OpenSemaphoreW
CreateFileMappingW
VerSetConditionMask
VerifyVersionInfoW
ReleaseSemaphore
RegEnumValueW
RegQueryValueExW
RegDeleteKeyExW
ExpandEnvironmentStringsW
CreateFileW
DuplicateHandle
GetFileSize
GetFileTime
UnlockFile
LockFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
WriteFile
ReadFile
DeleteFileW
FormatMessageW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
ReleaseMutex
GetCurrentThread
GetVersionExA

msvcrt

_vsnwprintf
bsearch
fprintf
_iob
_controlfp
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
strncmp
strerror
_itow_s
_set_error_mode
_wcsicmp
_wtoi
_itow
wcsncpy_s
memcpy_s
memcpy
memset
__CxxFrameHandler3
wcschr
_purecall
_wcsnicmp
wcsncmp
_CxxThrowException
malloc
free
iswspace
_wtol
_ultow
_vsnprintf

user32

LoadStringW
UnregisterClassA
GetLastInputInfo
MsgWaitForMultipleObjects
CharNextW
PeekMessageW
DispatchMessageW

ole32

CLSIDFromProgID
CoInitializeSecurity
CoDisconnectObject
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateBindCtx
CreateStreamOnHGlobal
CoUnmarshalInterface
CoTaskMemFree
PropVariantClear
CoUninitialize
CoInitializeEx
PropVariantCopy

oleaut32

SysStringLen
SetErrorInfo
CreateErrorInfo
VarUI4FromStr
GetErrorInfo
SysFreeString

tquery

?ciNewNoThrow@@YGPAXI@Z
?ciNew@@YGPAXI@Z
?ciDelete@@YGXPAX@Z

msshooks

LoadMSSearchHooks

imm32

ImmDisableIME

shlwapi

SHRegGetValueW

ntdll

WinSqmIncrementDWORD

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16b81b80f65bf81003a67234b735409f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

tquery

msshooks

imm32

shlwapi

ntdll

Sections

.text Size: 147KB - Virtual size: 146KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 147KB - Virtual size: 146KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB