98090b37c93e8c4feb7f0962606ecd92038722c0d8252b20e16e2aafad7957dcN

Sharing

Copy URL

Twitter E-mail

General

Target

98090b37c93e8c4feb7f0962606ecd92038722c0d8252b20e16e2aafad7957dcN
Size

904KB
MD5

dcd64d1b10137656d859e3d0fa626a20
SHA1

a5ae058bd02e6dad93d61aa61db0dc3507425ee0
SHA256

98090b37c93e8c4feb7f0962606ecd92038722c0d8252b20e16e2aafad7957dc
SHA512

7b7887e8a0b2462cbfaee5c43743cfb5fbb0cec605c906254d48722ede2d0fe20188057369b34e3f80a3ded631d420f5bb0dde8ba33c7d44a079ae2222db7410
SSDEEP

24576:ITJnJpqQIBikSTNjx+mZCkt76f/24pN+XNqNG6hditW:ITJnJsQIBikCf9Ckt7c20+9qNxUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
98090b37c93e8c4feb7f0962606ecd92038722c0d8252b20e16e2aafad7957dcN

Files

98090b37c93e8c4feb7f0962606ecd92038722c0d8252b20e16e2aafad7957dcN
.exe windows:10 windows x64 arch:x64

8024b39b86b78aff74217879efd412c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TieringEngineService.pdb

Imports

msvcrt

_wcmdln
__setusermatherr
_fmode
_initterm
__CxxFrameHandler4
_commode
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
realloc
_CxxThrowException
_vsnwprintf
wcsncmp
_snwprintf_s
swprintf_s
wcscat_s
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_purecall
__C_specific_handler
wcsstr
memset

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
RtlDoesNameContainWildCards
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlSetThreadErrorMode
RtlNumberOfClearBits
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask
WinSqmAddToStreamEx

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoMarshalInterface
CoSuspendClassObjects
CoInitializeEx
CoUninitialize
CoCreateInstance
CoCreateGuid
CoTaskMemFree
CoReleaseMarshalData
CoTaskMemAlloc
CoUnmarshalInterface

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
ResetEvent
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
InitializeSRWLock
ReleaseSRWLockExclusive

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
GetModuleHandleW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
CreateThread
TerminateProcess
OpenProcessToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolCleanupGroup
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolWait
SubmitThreadpoolWork
CloseThreadpoolWait
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpool
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetFinalPathNameByHandleW
CreateFileW
FindClose
GetVolumePathNameW
GetFileAttributesW
CreateDirectoryW
DeleteFileW
FindNextVolumeW
FindVolumeClose
FindNextFileW
FindFirstVolumeW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegNotifyChangeKeyValue
RegCreateKeyExW

api-ms-win-eventing-controller-l1-1-0

StartTraceW
EnableTraceEx2
ControlTraceW

api-ms-win-eventing-consumer-l1-1-0

ProcessTrace
OpenTraceW
CloseTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

PrivilegeCheck
AdjustTokenPrivileges

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathCchStripPrefix
PathCchStripToRoot
PathCchSkipRoot
PathCchRemoveFileSpec

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification
CM_Register_Notification

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetEndSession
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetEnableMultiInstanceW
JetResetSessionContext
JetSetSessionContext
JetRollback
JetCommitTransaction
JetBeginTransaction
JetDelete
JetCreateTableColumnIndex2W
JetGetColumnInfoW
JetComputeStats
JetGetObjectInfoW
JetOpenTempTable
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetRetrieveColumn

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 268KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8024b39b86b78aff74217879efd412c9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

esent

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 268KB - Virtual size: 264KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 8KB - Virtual size: 6KB

.didat Size: 4KB - Virtual size: 48B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 268KB - Virtual size: 264KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 6KB

.didat
Size: 4KB - Virtual size: 48B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 572KB - Virtual size: 576KB