Architecture |
IMAGE_FILE_MACHINE_AMD64
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2023-Mar-29 19:26:08 |
Detected languages |
English - United States
Portuguese - Brazil Spanish - Argentina Spanish - Spain (International sort) |
TLS Callbacks | 1 callback(s) detected. |
Debug artifacts |
HostAppServiceUpdater.pdb
|
CompanyName | SweetLabs, Inc |
FileDescription | Host App Service Updater |
FileVersion | 0.273.4.677 |
InternalName | hostappserviceupdater |
LegalCopyright | Copyright (C) 2010-2023 - SweetLabs, Inc |
OriginalFilename | HostAppServiceUpdater.exe |
ProductName | Host App Service Updater |
ProductVersion | 0.273.4.677 |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses known Diffie-Helman primes Microsoft's Cryptography API |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: SweetLabs Inc
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
Safe | VirusTotal score: 0/75 (Scanned on 2024-08-13 16:39:24) | All the AVs think this file is safe. |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x140 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections | 7 |
TimeDateStamp | 2023-Mar-29 19:26:08 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xf0 |
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic | PE32+ |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0x550c00 |
SizeOfInitializedData | 0x1ef400 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x000000000038FBA8 (Section: .text) |
BaseOfCode | 0x1000 |
ImageBase | 0x140000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.0 |
ImageVersion | 0.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x744000 |
SizeOfHeaders | 0x400 |
Checksum | 0x7412da |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
KERNEL32.dll |
GetCurrentThreadId
TerminateProcess GetCurrentProcess CreateWaitableTimerW Sleep CancelWaitableTimer SetWaitableTimer CreateEventW WaitForSingleObject ResetEvent GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError SetUnhandledExceptionFilter SetDefaultDllDirectories CreateFileW CreateDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetProcAddress GetModuleHandleW ProcessIdToSessionId GetCurrentProcessId CreateEventA SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLastError SetDllDirectoryW OOBEComplete RegisterWaitUntilOOBECompleted UnregisterWaitUntilOOBECompleted DecodePointer GetGeoInfoW AreFileApisANSI HeapCreate GetDiskFreeSpaceW LockFile UnlockFileEx MapViewOfFile CreateFileMappingW LockFileEx UnlockFile HeapCompact DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW WriteConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter GetTickCount QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA MultiByteToWideChar MoveFileExA WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree WriteFile SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryW FindClose FindFirstFileW FindNextFileW GetSystemTime SystemTimeToFileTime RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetTickCount64 CreateHardLinkW DuplicateHandle TerminateThread CreateSemaphoreA GetStringTypeExW LCMapStringW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetUserDefaultLCID GetLocaleInfoEx ExpandEnvironmentStringsA ExpandEnvironmentStringsW DeleteFileW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetLongPathNameW GetTempFileNameW SetFilePointer GetTempPathW IsWow64Process CopyFileW MoveFileExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OpenEventW OpenProcess LocalAlloc QueryFullProcessImageNameW GetVolumeInformationW GetSystemDirectoryW GetComputerNameW GetUserGeoID GetVersionExW GetModuleFileNameW GetCurrentPackageFamilyName LoadLibraryExW EnumResourceNamesW OutputDebugStringW GetCurrentThread GetThreadLocale SetThreadLocale GetExitCodeProcess GetFileAttributesW GetFileSizeEx FreeResource LoadResource LockResource SizeofResource FindResourceW CreateThread SetThreadPriority GetThreadPriority GetExitCodeThread InitializeCriticalSection TryEnterCriticalSection ReleaseMutex CreateMutexA FindResourceExW GetFileSize DosDateTimeToFileTime CompareStringW GlobalFree FreeConsole AttachConsole GetConsoleDisplayMode CreateDirectoryA IsDebuggerPresent InitializeSRWLock TryAcquireSRWLockExclusive GetStringTypeW EncodePointer LCMapStringEx CompareStringEx GetCPInfo SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA ResumeThread GetLogicalProcessorInformation CreateWaitableTimerA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlUnwind ExitProcess GetModuleHandleExW GetDriveTypeW ExitThread FreeLibraryAndExitThread SetFilePointerEx SetConsoleCtrlHandler GetModuleFileNameA GetACP GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW GetFullPathNameA GetTimeZoneInformation SetEnvironmentVariableA IsValidCodePage GetOEMCP FindFirstFileExA FindNextFileA GetCommandLineA GetCommandLineW OutputDebugStringA CloseHandle |
---|---|
gdiplus.dll |
GdipFlush
GdipSetImageAttributesColorMatrix GdipAlloc GdiplusShutdown GdipMeasureString GdipCreateFromHWND GdipCreateStringFormat GdipDeletePen GdipDeleteStringFormat GdipDrawString GdipDeleteFont GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathLine GdipClosePathFigures GdipDeletePath GdipCreatePath GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipSetCompositingQuality GdipCreateFromHDC GdipCreateFromHWNDICM GdipGetImageEncoders GdipGetImageEncodersSize GdipSetPixelOffsetMode GdipBitmapSetPixel GdipBitmapGetPixel GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdiplusStartup GdipSaveImageToFile GdipDrawImageRectRectI GdipSetInterpolationMode GdipSetSmoothingMode GdipSetCompositingMode GdipDeleteGraphics GdipSetImageAttributesWrapMode GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSetClipRectI GdipDrawImageRectRect GdipDrawImage GdipFillPath GdipFillEllipse GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipFree GdipFillRectangle GdipGraphicsClear GdipDrawRectangle GdipDrawLines GdipDrawLine GdipCreatePen1 GdipSetTextRenderingHint |
WLDAP32.dll |
#211
#46 #200 #60 #301 #45 #50 #30 #79 #33 #41 #22 #26 #27 #32 #143 #35 #217 |
Normaliz.dll |
IdnToAscii
|
dbghelp.dll |
MiniDumpWriteDump
|
WTSAPI32.dll |
WTSQueryUserToken
WTSFreeMemory WTSEnumerateSessionsW WTSRegisterSessionNotification WTSUnRegisterSessionNotification |
Secur32.dll |
GetUserNameExW
|
NETAPI32.dll |
NetApiBufferFree
NetGetJoinInformation |
GDI32.dll |
SelectObject
CreateDIBSection GetObjectW DeleteObject CreateCompatibleDC GetDIBits CreateBitmap DeleteDC |
ADVAPI32.dll |
CryptHashData
OpenProcessToken RegQueryValueExW RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegQueryInfoKeyW RegSetValueExW RegDeleteTreeW RegCopyTreeW AddAccessAllowedAceEx AddAce DuplicateTokenEx GetAce GetAclInformation GetLengthSid GetSecurityDescriptorSacl GetTokenInformation InitializeAcl CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegOpenKeyExW RegCloseKey GetUserNameW ConvertSidToStringSidW ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityInfo SetSecurityInfo LookupAccountNameW CryptGetHashParam GetSidSubAuthority OpenThreadToken RegOpenKeyW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW |
SHELL32.dll |
SHEvaluateSystemCommandTemplate
SHQueryUserNotificationState ShellExecuteExW SHGetSettings SHGetDesktopFolder SHGetKnownFolderPath SHGetFolderPathW SHCreateDirectoryExW SHGetMalloc SHGetFileInfoW SHFileOperationW ShellExecuteW SHAppBarMessage CommandLineToArgvW SHBindToParent |
ole32.dll |
PropVariantClear
StringFromGUID2 CoUninitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoCreateGuid CoSetProxyBlanket CoCreateInstance CoInitializeSecurity |
OLEAUT32.dll |
SysFreeString
SysAllocString VariantClear VariantInit CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo SysStringLen VariantCopy SysAllocStringLen |
bcrypt.dll |
BCryptGenRandom
|
msi.dll |
#173
#217 |
RPCRT4.dll |
UuidCreateSequential
UuidToStringW RpcStringFreeW |
WININET.dll |
InternetQueryOptionW
DeleteUrlCacheEntryW |
WINHTTP.dll |
WinHttpCloseHandle
WinHttpOpen WinHttpGetProxyForUrl |
WINTRUST.dll |
WinVerifyTrust
WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData |
CRYPT32.dll |
CryptQueryObject
CryptVerifyMessageSignature CertGetNameStringW CryptMsgGetParam CryptMsgClose CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertOpenSystemStoreA |
USERENV.dll |
ExpandEnvironmentStringsForUserW
GetUserProfileDirectoryW |
SHLWAPI.dll |
StrChrIW
AssocQueryStringW PathGetArgsW #487 SHRegDuplicateHKey #176 PathFileExistsW StrRetToBufW |
WS2_32.dll |
ntohs
WSASetLastError WSAStartup WSACleanup setsockopt WSAIoctl htons socket __WSAFDIsSet select accept bind connect getsockname htonl listen recv getaddrinfo freeaddrinfo recvfrom sendto WSAGetLastError ioctlsocket gethostname gethostbyname getnameinfo getpeername getsockopt send WSACloseEvent closesocket WSAWaitForMultipleEvents WSACreateEvent WSAEnumNetworkEvents WSASetEvent WSAResetEvent WSAEventSelect |
VERSION.dll |
VerQueryValueW
|
COMDLG32.dll |
GetSaveFileNameW
|
USER32.dll (delay-loaded) |
LoadStringW
MonitorFromRect TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW MsgWaitForMultipleObjects SetTimer KillTimer LoadCursorW LoadIconW UnregisterClassW GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetSystemMetrics OpenInputDesktop CloseDesktop OpenWindowStationA CloseWindowStation SetProcessWindowStation DestroyWindow GetDC ReleaseDC EnumWindows GetWindowThreadProcessId SystemParametersInfoW FindWindowW IsWindowVisible AllowSetForegroundWindow GetShellWindow PostMessageW PrivateExtractIconsW DestroyIcon LoadImageW SetProcessDefaultLayout wsprintfW CreateIconIndirect CreatePopupMenu DestroyMenu SetActiveWindow SetForegroundWindow GetWindowRect CopyRect GetDesktopWindow EnumChildWindows FindWindowExW GetClassNameW MonitorFromWindow GetMonitorInfoW GetIconInfo ScreenToClient SetRect GetForegroundWindow IntersectRect EqualRect GetWindowLongW GetDisplayConfigBufferSizes QueryDisplayConfig EnumDisplayMonitors |
Attributes | 0x1 |
---|---|
Name | USER32.dll |
ModuleHandle | 0x6bbd18 |
DelayImportAddressTable | 0x6b81e8 |
DelayImportNameTable | 0x6a7b30 |
BoundDelayImportTable | 0x6a81b8 |
UnloadDelayImportTable | 0 |
TimeStamp | 1970-Jan-01 00:00:00 |
HOSTAPPSERVICEUPDATER |
HostAppServiceUpdater |
秒 |
分钟 |
小时 |
天 |
kB |
MB |
GB |
sekunder |
minutter |
timer |
dage |
kB |
MB |
GB |
Sekunden |
Minuten |
Stunden |
Tage |
kB |
MB |
GB |
sekuntia |
minuuttia |
tuntia |
päivää |
Kt |
Mt |
Gt |
secondes |
minutes |
heures |
jours |
Ko |
Mo |
Go |
secondi |
minuti |
ore |
giorni |
KB |
MB |
GB |
秒 |
分 |
時間 |
日 |
kB |
MB |
GB |
초 |
분 |
시간 |
일 |
kB |
MB |
GB |
sekunder |
minutter |
timer |
dager |
kB |
MB |
GB |
секунд |
минут |
часов |
дней |
КБ |
МБ |
ГБ |
sekunder |
minuter |
timmar |
dagar |
kB |
MB |
GB |
seconds |
minutes |
hours |
days |
kB |
MB |
GB |
segundos |
minutos |
horas |
dias |
kB |
MB |
GB |
segundos |
minutos |
horas |
días |
kB |
MB |
GB |
segundos |
minutos |
horas |
días |
kB |
MB |
GB |
秒數 |
分鐘 |
小時 |
日 |
kB |
MB |
GB |
{received}/{total} |
剩下 {time} |
{received}/{total} |
{time} tilbage |
{received}/{total} |
Noch {time} |
{received}/{total} |
{time} jäljellä oleva |
{received}/{total} |
Il reste {time} |
{received}/{total} |
{time} di tempo rimanente |
{received}/{total} |
残り{time} |
{received}/{total} |
{time} 남음 |
{received}/{total} |
{time} gjenværende |
{received}/{total} |
Осталось {time} |
{received}/{total} |
{time} återstår |
{received}/{total} |
{time} left |
{received}/{total} |
{time} restante(s) |
{received}/{total} |
{time} restante |
{received}/{total} |
{time} restante |
{received}/{total} |
還剩下 {time} |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 0.273.4.677 |
ProductVersion | 0.273.4.677 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | English - United States |
CompanyName | SweetLabs, Inc |
FileDescription | Host App Service Updater |
FileVersion (#2) | 0.273.4.677 |
InternalName | hostappserviceupdater |
LegalCopyright | Copyright (C) 2010-2023 - SweetLabs, Inc |
OriginalFilename | HostAppServiceUpdater.exe |
ProductName | Host App Service Updater |
ProductVersion (#2) | 0.273.4.677 |
Resource LangID | UNKNOWN |
---|
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:08 |
Version | 0.0 |
SizeofData | 50 |
AddressOfRawData | 0x62e1e0 |
PointerToRawData | 0x62d1e0 |
Referenced File | HostAppServiceUpdater.pdb |
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:08 |
Version | 0.0 |
SizeofData | 20 |
AddressOfRawData | 0x62e214 |
PointerToRawData | 0x62d214 |
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:08 |
Version | 0.0 |
SizeofData | 1292 |
AddressOfRawData | 0x62e228 |
PointerToRawData | 0x62d228 |
StartAddressOfRawData | 0x14062e758 |
---|---|
EndAddressOfRawData | 0x14062e760 |
AddressOfIndex | 0x1406be818 |
AddressOfCallbacks | 0x140553b50 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
Callbacks |
0x000000014038E200
|
Size | 0x140 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x1406b22d8 |
XOR Key | 0xcb942923 |
---|---|
Unmarked objects | 0 |
241 (40116) | 12 |
242 (40116) | 35 |
243 (40116) | 184 |
253 (VS2022 Update 4 (17.4.2) compiler 31935) | 6 |
ASM objects (VS2022 Update 4 (17.4.2) compiler 31935) | 10 |
C objects (LTCG) (VS2022 Update 5 (17.5.0-2) compiler 32215) | 4 |
C objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |
C++ objects (VS2022 Update 4 (17.4.2) compiler 31935) | 101 |
C objects (VS2022 Update 4 (17.4.2) compiler 31935) | 707 |
244 (40116) | 8 |
C objects (VS2022 Update 3 (17.3.0-3) compiler 31629) | 8 |
239 (40116) | 51 |
Total imports | 605 |
C++ objects (VS2022 Update 3 (17.3.0-3) compiler 31629) | 1 |
C++ objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 81 |
Resource objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |
151 | 3 |
Linker (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |