Static task
static1
Behavioral task
behavioral1
Sample
SearchFilterHost.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SearchFilterHost.exe
Resource
win10v2004-20241007-en
General
-
Target
SearchFilterHost.exe
-
Size
1.3MB
-
MD5
963032914cce47a62034777a8cb7ab1c
-
SHA1
9e2bb12a1851e35f5bc09dcd248b91d22515ace9
-
SHA256
a15aad03c7d939baa3e149b8f41e7c0421986a1a1758ccac135ce097db34cf6b
-
SHA512
c100f3f0c75143883a6077c49d4f5cdfae5ac1ef3b84be96acbbfd346807cdc42cce81a330faf3700dbd850d590a0c8ebb73be6013ceea642865ec6f035761b2
-
SSDEEP
24576:LRk9s/X7y1j3jNPnHHgyV+3ED6T9wno0G9e/5AQrg:Fbzy1DRHAORiwo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SearchFilterHost.exe
Files
-
SearchFilterHost.exe.exe windows:76 windows x64 arch:x64
c8dc68782a64a11abc93ebe1d834325b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
GetFileVersionInfoSizeA
kernel32
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetCurrentProcessId
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetExitCodeProcess
AllocConsole
CreateProcessA
GetProcAddress
CloseHandle
Process32Next
LoadLibraryA
TlsFree
GetLastError
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
HeapSize
GetTimeZoneInformation
DeleteFileW
GetStringTypeW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
CreateProcessW
WaitForSingleObject
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
EncodePointer
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteFile
GetModuleFileNameW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
Sleep
CreateToolhelp32Snapshot
OpenProcess
LoadLibraryExA
TerminateProcess
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
Process32First
GetModuleFileNameA
WriteConsoleW
TlsSetValue
RtlUnwind
RaiseException
RtlPcToFileHeader
CreateThread
FileTimeToSystemTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
SystemTimeToTzSpecificLocalTime
user32
GetWindowThreadProcessId
ShowWindow
MessageBoxA
EnumWindows
advapi32
GetTokenInformation
AdjustTokenPrivileges
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
OpenProcessToken
LookupPrivilegeValueA
shell32
ShellExecuteExA
normaliz
IdnToUnicode
IdnToAscii
ws2_32
getsockopt
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
wldap32
ord41
ord217
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord50
ord45
ord60
ord211
ord46
ord143
crypt32
CertOpenStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCloseStore
CertFreeCertificateChain
sensapi
IsDestinationReachableW
IsNetworkAlive
IsDestinationReachableA
bcrypt
BCryptGenRandom
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 13B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ