SecurityHealthService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecurityHealthService.exe
Size 2.1MB
Sample261011-w5bbqavycv
SHA256 94c0eb6379ad7f1a52279a152b934504ae7f68c9e5a4b09833acab963301e3ae
MD5 6e3db997422e5564c28d661d5d32e9bb
SHA1 36606fc465c0b67127319e2cd9376ea57e5d7218
SHA512 e70aeecf1184ceb7d1a5559b5f77db038f2b2add89a3ac395cda33104a7b896b03ea1ba25fa876044edeac826b594b0aa1beb718df9176c38c3816eaa64e996a
SSDEEP 49152:2q/GUQrHoyYM57oil3i10+1ud1Q2ToxXgYYIU6ie2:QOM9HY0QgYn+
TLSH
T169A58D03E69581F8D1ADC078C3579633EA32B88D4A34B2EB67D05B113E26F906F2D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecurityHealthService.exe

File Explorer

SecurityHealthService.exe

.exe 2.1MB

SecurityHealthService.exe

IMPHASH fc4dbc990aaa3d7d2a89b0367d67a7bf
SHA256 94c0eb6379ad7f1a52279a152b934504ae7f68c9e5a4b09833acab963301e3ae
MD5 6e3db997422e5564c28d661d5d32e9bb
SHA1 36606fc465c0b67127319e2cd9376ea57e5d7218
SHA512 e70aeecf1184ceb7d1a5559b5f77db038f2b2add89a3ac395cda33104a7b896b03ea1ba25fa876044edeac826b594b0aa1beb718df9176c38c3816eaa64e996a
SSDEEP 49152:2q/GUQrHoyYM57oil3i10+1ud1Q2ToxXgYYIU6ie2:QOM9HY0QgYn+
TLSH
T169A58D03E69581F8D1ADC078C3579633EA32B88D4A34B2EB67D05B113E26F906F2D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1421280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SecurityHealthService.pdb

bcryptprimitives

ProcessPrng

kernel32

InitializeSListHead GetSystemTimeAsFileTime SetHandleInformation GetFullPathNameW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo CreateProcessW GetFileAttributesW DuplicateHandle CreateThread WriteFileEx WaitForMultipleObjects FindNextFileW FindClose SetFilePointerEx GetLastError GetCurrentProcess TerminateProcess WaitForSingleObject GetExitCodeProcess CloseHandle FindFirstFileExW SleepEx ReadFileEx OpenProcess AllocConsole CreateWaitableTimerExW GetModuleHandleA GetProcAddress WriteConsoleW SetWaitableTimer GetConsoleOutputCP Sleep CreateMutexW CopyFileExW DeleteFileW GetSystemInfo GetCommandLineW GetConsoleMode SetFileInformationByHandle GetTickCount Process32NextW Process32FirstW CreateToolhelp32Snapshot AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc SetThreadStackGuarantee GetCurrentThread lstrlenW GetStdHandle ReleaseMutex GetSystemTimePreciseAsFileTime GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA WideCharToMultiByte RtlVirtualUnwind MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW SwitchToThread LoadLibraryExA GetOverlappedResult WriteFile PostQueuedCompletionStatus CreateMutexA ReadFile GetCurrentProcessId WaitForSingleObjectEx GetCurrentThreadId SetLastError GetFinalPathNameByHandleW CreateFileW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes CancelIoEx SetUnhandledExceptionFilter

advapi32

OpenProcessToken SystemFunction036 RegDeleteValueW RegSetValueExW RegOpenKeyExW RegCloseKey GetTokenInformation

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

getsockname WSAGetLastError getpeername bind setsockopt WSAStartup getsockopt connect ioctlsocket WSAIoctl WSASend shutdown send freeaddrinfo getaddrinfo WSASocketW recv WSACleanup closesocket

ntdll

NtWriteFile NtReadFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantClear GetErrorInfo

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize

user32

GetLastInputInfo

shell32

SHGetKnownFolderPath

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler memcmp memmove memcpy memset

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _seh_filter_exe _register_thread_local_exe_atexit_callback exit _exit _wassert __p___argc __p___argv _cexit _set_app_type _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _c_exit

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale