smartscreen[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
smartscreen.exe
Size 596KB
Sample260712-2j89hsbw21
SHA256 5eba5b6b1dbedcd7db79a7bcbb4a0abd58cb14c0538f12d7fd7b3722beed3d06
MD5 840d5571de5fa889dbd28fcc41e8fffc
SHA1 98266ab0ef2146eb396f087d9b5a2f5a25bb3727
SHA512 7d27ca9a388caf81b64ba097061f9dc78485fe17277f91cb31085a92d0a463ae8aa617cc0ce355b352e48dea5118a12e66cc45f5120a495794580ecb294ceb9b
SSDEEP 12288:Ht9OevGd37vbbpm4cJcuKoEKf08tsh4Nnv:N9XGh7vUVubh4Nnv
TLSH
T1D2D42C5E66AC07E1E17AD07DC983460EE6B178355332D7CF036142AA4F27AE85F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
smartscreen.exe

File Explorer

smartscreen.exe

.exe 596KB

smartscreen.exe

IMPHASH c84171df6e7f087ea4e625ccce2ab167
SHA256 5eba5b6b1dbedcd7db79a7bcbb4a0abd58cb14c0538f12d7fd7b3722beed3d06
MD5 840d5571de5fa889dbd28fcc41e8fffc
SHA1 98266ab0ef2146eb396f087d9b5a2f5a25bb3727
SHA512 7d27ca9a388caf81b64ba097061f9dc78485fe17277f91cb31085a92d0a463ae8aa617cc0ce355b352e48dea5118a12e66cc45f5120a495794580ecb294ceb9b
SSDEEP 12288:Ht9OevGd37vbbpm4cJcuKoEKf08tsh4Nnv:N9XGh7vUVubh4Nnv
TLSH
T1D2D42C5E66AC07E1E17AD07DC983460EE6B178355332D7CF036142AA4F27AE85F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

117904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

smartscreen.pdb

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table abort terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vsprintf __p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

strcpy_s wcsnlen __strncnt islower strncmp towlower strcspn _wcsicmp isspace _wcsdup isupper tolower

ntdll

RtlFreeHeap RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry NtCreateSection NtQuerySection RtlSubscribeWnfStateChangeNotification RtlUnsubscribeWnfNotificationWaitForCompletion RtlIpv4AddressToStringExW RtlIpv6AddressToStringExW

combase

ord69

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA GetProcAddress GetModuleHandleW GetModuleHandleExA LoadLibraryExW GetModuleFileNameW FreeLibrary GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection InitializeCriticalSectionEx ReleaseMutex LeaveCriticalSection EnterCriticalSection ReleaseSRWLockExclusive ReleaseSemaphore SetEvent WaitForSingleObject AcquireSRWLockExclusive WaitForSingleObjectEx OpenSemaphoreW CreateSemaphoreExW CreateMutexExW ReleaseSRWLockShared CreateEventExW AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetLastError RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetProcessId GetProcessTimes GetCurrentProcess OpenThreadToken GetCurrentThreadId OpenProcessToken GetCurrentThread

api-ms-win-core-localization-l1-2-0

LCMapStringEx FormatMessageW GetCPInfo GetThreadPreferredUILanguages GetLocaleInfoEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW MultiByteToWideChar CompareStringEx

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventUnregister EventSetInformation EventRegister

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsIsStringEmpty WindowsDuplicateString WindowsStringHasEmbeddedNull WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString

api-ms-win-core-com-l1-1-0

CoRegisterClassObject CoGetInterfaceAndReleaseStream CoCreateFreeThreadedMarshaler CoReleaseMarshalData CoTaskMemAlloc CoRevokeClassObject CoGetObjectContext CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance CoDecrementMTAUsage CoWaitForMultipleHandles CoInitializeSecurity CoIncrementMTAUsage CoTaskMemFree CoMarshalInterface CreateStreamOnHGlobal CoImpersonateClient CoGetCallContext CoRevertToSelf CoResumeClassObjects

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW Sleep InitOnceExecuteOnce InitOnceComplete InitOnceBeginInitialize

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoRegisterActivationFactories RoInitialize RoUninitialize RoRevokeActivationFactories

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoTransformError RoOriginateError RoOriginateErrorW SetRestrictedErrorInfo GetRestrictedErrorInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsSetValue FlsFree

smartscreen

FreeExperience UriReputationFactory GetEnforcementPolicy SetEnforcementLevel GetEnforcementLevel CheckReputation EventLogger ReportLaunch GetAppReputationEnforcementLevel SetAppReputationEnforcementLevel GetAppControlEnforcementLevel SetAppControlEnforcementLevel RegisterEventLogger ResetLogger ClearCache CheckAppxPackageReputation CheckFileReputation

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _unlock_locales _lock_locales setlocale _configthreadlocale ___lc_collate_cp_func ___lc_locale_name_func localeconv __pctype_func ___lc_codepage_func

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free _free_base _calloc_base calloc realloc _realloc_base _malloc_base

api-ms-win-crt-convert-l1-1-0

strtof strtod

api-ms-win-crt-math-l1-1-0

_ldclass frexp ceilf _dclass

api-ms-win-crt-time-l1-1-0

_Strftime _Getdays _Gettnames _Getmonths _W_Getdays _W_Gettnames _W_Getmonths _Wcsftime

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask SHTaskPoolAllowThreadReuse

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l1-1-0

CreateFileW GetLongPathNameW GetDriveTypeW

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize PathCchStripToRoot PathCchIsRoot PathAllocCombine

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled RoGetMatchingRestrictedErrorInfo RoReportFailedDelegate

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork CloseThreadpoolTimer CloseThreadpoolWork WaitForThreadpoolTimerCallbacks SetThreadpoolTimer SubmitThreadpoolWork CreateThreadpoolTimer

api-ms-win-core-featurestaging-l1-1-0

GetFeatureEnabledState SubscribeFeatureStateChangeNotification UnsubscribeFeatureStateChangeNotification RecordFeatureUsage

api-ms-win-rtcore-ntuser-window-l1-1-0

GetForegroundWindow GetWindowThreadProcessId AllowSetForegroundWindow

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

RevertToSelf ImpersonateLoggedOnUser GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree

crypt32

CryptStringToBinaryW CryptUnprotectData CryptBinaryToStringW CryptProtectData

oleaut32

SysFreeString

ws2_32

ntohs htons

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

424KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

smartscreen.exe

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

smartscreen

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

crypt32

oleaut32

ws2_32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic