22b89a49f04f3d4cb2453d4f8f9d5370N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

22b89a49f04f3d4cb2453d4f8f9d5370N.exe
Size

2.6MB
MD5

22b89a49f04f3d4cb2453d4f8f9d5370
SHA1

7c3ccee49ec4db2633701476836eb52ab38fb7d2
SHA256

bfb81a06c79424333edc4eb9c0b0de968305509a26e164d53450db660f7b6b25
SHA512

c4395e1fc2d24be7ba28185e309af474598d364a3951526758637cb4c0c58d78dffa0d67a26c4e7c3c641752113c71484fecb22eab4dc44d68a8eacba7af50dd
SSDEEP

49152:TZ4Qzr6q0e/bkJaA2MHn4V9mE8C+yezDOQ0K:1wmyroF8TyyDb0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22b89a49f04f3d4cb2453d4f8f9d5370N.exe

Files

22b89a49f04f3d4cb2453d4f8f9d5370N.exe
.exe windows:6 windows x64 arch:x64

0b406fedda8fd53b01a223315b044511

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf_64.pdb

Imports

kernel32

OutputDebugStringA
GetModuleHandleA
RaiseException
GetTickCount64
SetEndOfFile
HeapSize
GetStringTypeW
OutputDebugStringW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
GetCurrentThreadId
GetThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
WideCharToMultiByte
GetTimeZoneInformation
GetFileAttributesExW
GetFileSizeEx
CreateFileA
DeviceIoControl
GetEnvironmentVariableA
GetTempPathW
GetTempPathA
SetLastError
CreateMutexA
WriteConsoleW
SetPriorityClass
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemWindowsDirectoryA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
FormatMessageA
CreateMutexW
GetStdHandle
GetCommandLineW
TerminateProcess
GetExitCodeProcess
ExitThread
GetExitCodeThread
CreateProcessW
AddDllDirectory
WriteConsoleInputW
SetFilePointerEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
ReleaseMutex
LocalFree
LoadLibraryExA
GetProcAddress
FreeLibrary
GetLastError
FindNextFileA
FindFirstFileA
FindClose
QueryPerformanceFrequency
QueryPerformanceCounter
AcquireSRWLockShared
WTSGetActiveConsoleSessionId
CreateDirectoryW
SetStdHandle
DeleteFileW
CopyFileW
ReleaseSRWLockShared
CreateThread
CloseHandle
GetCurrentProcess
CreateSemaphoreW
Sleep
CreateEventW
WaitForSingleObject
ReleaseSemaphore
ResetEvent
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
DuplicateHandle
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapReAlloc
MoveFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
WaitForMultipleObjects
LoadLibraryExW
TlsFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
__C_specific_handler
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetCommandLineA
HeapFree
HeapAlloc
GetCurrentThread
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind

powrprof

PowerReadPossibleFriendlyName
SetSuspendState
PowerWriteSettingAttributes
PowerRemovePowerSetting
PowerWritePossibleFriendlyName

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification
PowerGetActiveScheme
PowerSetActiveScheme

ole32

CoUninitialize
CoCreateInstance
CoIncrementMTAUsage
CoDecrementMTAUsage
StringFromCLSID
CoInitializeEx
CoTaskMemFree

advapi32

ControlService
EventWrite
EventUnregister
EventRegister
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
ConvertStringSidToSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
GetAclInformation
AddAce
AddAccessAllowedAce
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-devices-config-l1-1-1

CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_DevNode_Registry_PropertyW
CM_Locate_DevNodeW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 874KB - Virtual size: 873KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0b406fedda8fd53b01a223315b044511

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

powrprof

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-power-setting-l1-1-0

ole32

advapi32

userenv

api-ms-win-devices-config-l1-1-1

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 874KB - Virtual size: 873KB

.data Size: 65KB - Virtual size: 80KB

.pdata Size: 55KB - Virtual size: 54KB

minATL Size: 512B - Virtual size: 24B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 874KB - Virtual size: 873KB

.data
Size: 65KB - Virtual size: 80KB

.pdata
Size: 55KB - Virtual size: 54KB

minATL
Size: 512B - Virtual size: 24B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 576KB - Virtual size: 580KB