4639ea9b8d5d3ce026085b264d0968a8fbba792d27d7abd51afc98887f599d3b

Sharing

Copy URL Twitter E-mail

General

Target

4639ea9b8d5d3ce026085b264d0968a8fbba792d27d7abd51afc98887f599d3b
Size

1.6MB
MD5

29520085da36ae44d5bfd4dee1bc528e
SHA1

2fcd9d59d92909d2afeadcb2f9bd818b9d1fe615
SHA256

4639ea9b8d5d3ce026085b264d0968a8fbba792d27d7abd51afc98887f599d3b
SHA512

7f3fb8c302b3068955e308cfdf7dfedccf38011574cac77580e585d95609ea370b3790366b2f54e6b7e8d20428d9d819fe49fe10bd01125aa7145c434a9618ee
SSDEEP

24576:v/ixhu48HARzgVHvEfCMEFEmlsdpvQ4UMj3C/Uvw3B8atQVpZJ:NHARz+HsfCMkxlsrQs3OPV6Vp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4639ea9b8d5d3ce026085b264d0968a8fbba792d27d7abd51afc98887f599d3b

Files

4639ea9b8d5d3ce026085b264d0968a8fbba792d27d7abd51afc98887f599d3b
.exe windows:10 windows x64 arch:x64

eb9977ba8fad2d4d581515a014008fc3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

SearchIndexer.pdb

Imports

msvcrt

_free_locale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
abort
memcmp
_get_current_locale
__pctype_func
___lc_codepage_func
swscanf
towupper
___mb_cur_max_func
___lc_collate_cp_func
realloc
setlocale
_errno
wcstok
??1type_info@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
wcschr
_wtol
??1bad_cast@@UEAA@XZ
_onexit
??0bad_cast@@QEAA@AEBV0@@Z
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_acmdln
__CxxFrameHandler3
strchr
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
vswprintf_s
_XcptFilter
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_vscwprintf
_wcslwr_s
wcspbrk
qsort
??0exception@@QEAA@AEBQEBD@Z
calloc
_get_errno
_set_errno
memset
wcsncpy_s
malloc
wcscat_s
iswspace
bsearch
wcscpy_s
__C_specific_handler
wcsncmp
_wcsnicmp
iswxdigit
___lc_handle_func
free
wcsstr
_wcsicmp
wcstol
strncmp
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
memmove
_vsnwprintf
wcscmp

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
FindStringOrdinal
GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibrary
LoadResource
GetModuleHandleW
LockResource
FindResourceExW
GetModuleHandleExW
SizeofResource

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetFileTime
FindFirstVolumeW
FindFirstFileExW
FindClose
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
SetFileTime
CompareFileTime
GetVolumeInformationW
GetLogicalDrives
CreateFileW
GetDriveTypeW
FindNextVolumeW
GetFileAttributesExW
FindNextFileW
FindVolumeClose
CreateDirectoryW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceInitialize
InitOnceBeginInitialize
Sleep

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
CreateThread
TlsFree
SetPriorityClass
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
TlsSetValue
TlsAlloc
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseMutex
CreateEventExW
CreateSemaphoreExW
OpenEventW
CreateEventW
SetEvent
AcquireSRWLockExclusive
EnterCriticalSection
WaitForSingleObjectEx
CreateMutexW
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapSetInformation
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
RaiseException
SetErrorMode
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoRevokeClassObject
CoInitializeSecurity
CoImpersonateClient
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoInitializeEx
CoRegisterClassObject
IIDFromString
CLSIDFromString
CoGetMalloc
CoMarshalInterface
CoTaskMemAlloc
CoUninitialize
PropVariantClear
StringFromGUID2
CoTaskMemFree
CoWaitForMultipleHandles
CoGetApartmentType
CoRevertToSelf

api-ms-win-shcore-thread-l1-1-0

SHSetThreadRef
SHCreateThreadRef
SHGetThreadRef

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

CloseThreadpool
CloseThreadpoolWork
CreateThreadpool
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroupMembers
CallbackMayRunLong
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup

ntdll

RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtOpenFile
RtlNtStatusToDosError
RtlInitUnicodeString
RtlQueryPackageClaims

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegDeleteKeyExW
RegGetValueW
RegEnumKeyExW
RegEnumValueW
RegCreateKeyExW
RegGetKeySecurity
RegDeleteValueW
RegDeleteTreeW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetTickCount64
GetVersionExW

api-ms-win-core-localization-l1-2-0

GetNLSVersionEx
GetSystemPreferredUILanguages
LCMapStringW
FormatMessageW
GetLocaleInfoW
GetSystemDefaultLCID
LocaleNameToLCID
ResolveLocaleName

oleaut32

SysAllocStringLen
VariantClear
SysStringLen
SafeArrayDestroy
LoadRegTypeLi
LoadTypeLi
SafeArrayGetElement
VarUI4FromStr
SysFreeString
VariantInit
SysStringByteLen
SysAllocStringByteLen
VarBstrCat
SafeArrayGetUBound
SysAllocString

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAppendW
PathSkipRootW
PathIsUNCW
PathStripToRootW
PathFindNextComponentW
PathFileExistsW
PathRemoveBackslashW
PathIsUNCServerShareW
PathAddBackslashW
PathCanonicalizeW
PathIsUNCServerW
PathIsRootW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
SearchPathW
GetCommandLineW
ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
EventWrite
EventActivityIdControl

api-ms-win-shcore-registry-l1-1-0

SHDeleteKeyW
SHGetValueW
SHCopyKeyW
SHSetValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNew
ciDelete
ciNewNoThrow

shcore

SHStrDupW
ord1

mssrch

??1CSearchServiceObj@@QEAA@XZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
??0CSearchServiceObj@@QEAA@XZ
?Cleanup@CSearchServiceObj@@SAXXZ

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrCmpNICW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

Sections

.text
Size: 549KB - Virtual size: 548KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eb9977ba8fad2d4d581515a014008fc3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

oleaut32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

shcore

mssrch

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

Sections

.text Size: 549KB - Virtual size: 548KB

.rdata Size: 242KB - Virtual size: 241KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 36KB - Virtual size: 36KB

.didat Size: 1024B - Virtual size: 768B

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 549KB - Virtual size: 548KB

.rdata
Size: 242KB - Virtual size: 241KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 36KB - Virtual size: 36KB

.didat
Size: 1024B - Virtual size: 768B

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 572KB - Virtual size: 576KB