StoreMcpServer[.]exe

General

Target
StoreMcpServer.exe
Size 99KB
Sample260804-vb6p4aszcs
SHA256 ba417768b4cffb4440d773e0e6f9e6e4afdda0e32013dd845a592cf9b143469e
MD5 2d06f682a53f266f607e5fad90e36792
SHA1 44a085603f921de390832e27605a2b59b58b6fd7
SHA512 842e988f54d1d0d2176b87bfc726cda66d06b822b7353136fcb20e7068aa27cecdd2751fe465ee1c2edfe168647ec08cfb86a8c241ea4a8ecd7194625f4d006e
SSDEEP 3072:EqR0aMOGyy06Nlx9RuEb4oP9OJzsHhylnNd:sOGyy06/Jd4oPUNnNd
TLSH
T116A32957B3E520F9E2B28A3884954A49D775F8351B219FEF03B442961F237E48D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StoreMcpServer.exe

File Explorer

StoreMcpServer.exe

.exe 99KB

StoreMcpServer.exe

IMPHASH 5c82018e83dd5f1d305454ecd57a9cf1
SHA256 ba417768b4cffb4440d773e0e6f9e6e4afdda0e32013dd845a592cf9b143469e
MD5 2d06f682a53f266f607e5fad90e36792
SHA1 44a085603f921de390832e27605a2b59b58b6fd7
SHA512 842e988f54d1d0d2176b87bfc726cda66d06b822b7353136fcb20e7068aa27cecdd2751fe465ee1c2edfe168647ec08cfb86a8c241ea4a8ecd7194625f4d006e
SSDEEP 3072:EqR0aMOGyy06Nlx9RuEb4oP9OJzsHhylnNd:sOGyy06/Jd4oPUNnNd
TLSH
T116A32957B3E520F9E2B28A3884954A49D775F8351B219FEF03B442961F237E48D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winstore.app

__managed__Main

api-ms-win-crt-string-l1-1-0

memset

kernel32

FindFirstFileExW WriteConsoleW CloseHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

ntdll

__chkstk wcschr

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage

Name

.text

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

StoreMcpServer.exe

winstore.app

api-ms-win-crt-string-l1-1-0

kernel32

ntdll

api-ms-win-core-com-l1-1-0

generic