Architecture |
IMAGE_FILE_MACHINE_AMD64
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2023-Mar-29 19:26:11 |
Detected languages |
English - United States
Portuguese - Brazil Spanish - Argentina Spanish - Spain (International sort) |
TLS Callbacks | 1 callback(s) detected. |
Debug artifacts |
HostAppServiceInterface.pdb
|
CompanyName | SweetLabs, Inc. |
FileDescription | Host App Service Interface |
FileVersion | 0.273.4.677 |
InternalName | HostAppServiceInterface |
LegalCopyright | Copyright (C) 2010-2023 - SweetLabs, Inc |
OriginalFilename | HostAppServiceInterface.exe |
ProductName | Host App Service Interface |
ProductVersion | 0.273.4.677 |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses known Diffie-Helman primes Microsoft's Cryptography API |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: SweetLabs Inc
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
Safe | VirusTotal score: 0/75 (Scanned on 2024-07-31 14:49:21) | All the AVs think this file is safe. |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x130 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections | 7 |
TimeDateStamp | 2023-Mar-29 19:26:11 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xf0 |
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic | PE32+ |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0x316a00 |
SizeOfInitializedData | 0x156800 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0000000000083720 (Section: .text) |
BaseOfCode | 0x1000 |
ImageBase | 0x140000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.0 |
ImageVersion | 0.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x470000 |
SizeOfHeaders | 0x400 |
Checksum | 0x46d720 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
KERNEL32.dll |
GetDiskFreeSpaceW
LockFile GetFullPathNameA GetGeoInfoW GetUserGeoID VerSetConditionMask GetEnvironmentVariableW GetCurrentProcess GetCurrentProcessId OpenProcess GetVersionExW FreeLibrary GetModuleFileNameW LoadLibraryW VerifyVersionInfoW GetLocaleInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetLongPathNameW ReadFile SetFilePointer WriteFile GetTempPathW CopyFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId UnregisterWaitEx RegisterWaitForSingleObject CancelIo SleepEx QueueUserAPC lstrlenW ReadDirectoryChangesW SetLastError LoadLibraryA LCMapStringW GetUserDefaultLCID OutputDebugStringW GetCurrentThread GetPackagesByPackageFamily OpenPackageInfoByFullName ClosePackageInfo GetPackageInfo GetVolumeInformationW GetSystemDirectoryW GetComputerNameW GetFileAttributesW GetFileSizeEx CreateThread GetFileSize ReleaseMutex CreateMutexA CompareStringW GetEnvironmentStringsW FreeEnvironmentStringsW UnlockFileEx GetModuleHandleA LocalAlloc QueryFullProcessImageNameW InitializeCriticalSection TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue MultiByteToWideChar IsDebuggerPresent RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW EncodePointer LCMapStringEx GetCPInfo GetSystemTimeAsFileTime ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer ResumeThread TlsFree GetSystemInfo CreateWaitableTimerA InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader LoadLibraryExW RtlUnwind ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetStdHandle GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx SetEnvironmentVariableA IsValidCodePage GetOEMCP SetConsoleCtrlHandler GetCommandLineA GetCommandLineW OutputDebugStringA SetStdHandle WriteConsoleW SetEndOfFile CreateMutexW UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFullPathNameW SwitchToFiber DeleteFiber CreateFiber GetEnvironmentVariableA CompareFileTime MoveFileExA GetSystemDirectoryA ConvertFiberToThread ConvertThreadToFiber SetConsoleMode ReadConsoleA MapViewOfFile CreateFileMappingW GetSystemTime LockFileEx UnlockFile HeapCompact DeleteFileA CreateFileA WaitForSingleObject DeleteCriticalSection HeapDestroy DecodePointer HeapReAlloc HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetDefaultDllDirectories SetDllDirectoryW FreeConsole AttachConsole Sleep GetModuleHandleW GetProcAddress GetLastError WaitForMultipleObjects GetTickCount ResetEvent HeapFree GetProcessHeap HeapAlloc SetEvent WaitForSingleObjectEx CloseHandle CreateEventW CreateEventA LocalFree WideCharToMultiByte FormatMessageW FormatMessageA HeapCreate AreFileApisANSI GetCurrentDirectoryW PeekNamedPipe GetDriveTypeW FlushViewOfFile |
---|---|
gdiplus.dll |
GdiplusShutdown
GdiplusStartup |
USER32.dll |
GetUserObjectInformationW
MessageBoxW TranslateMessage DispatchMessageW LoadStringW LoadIconW LoadCursorW RegisterClassExW PostQuitMessage DefWindowProcW FindWindowW SendMessageW MsgWaitForMultipleObjects wsprintfW PeekMessageW GetProcessWindowStation CreateWindowExW |
ADVAPI32.dll |
CryptSignHashW
CryptEnumProvidersW CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken GetTokenInformation RegQueryValueExW RegNotifyChangeKeyValue RegCreateKeyExW OpenThreadToken RegOpenKeyW LookupAccountNameW RegDeleteValueW RegSetValueExW ConvertSidToStringSidW RegEnumValueW RegQueryInfoKeyW CryptDecrypt ReportEventW RegisterEventSourceW DeregisterEventSource RegEnumKeyExW RegOpenKeyExW RegCloseKey |
SHELL32.dll |
SHGetDesktopFolder
SHGetFolderPathW SHCreateDirectoryExW SHGetMalloc CommandLineToArgvW SHFileOperationW |
ole32.dll |
CoCreateGuid
CoTaskMemFree PropVariantClear CoCreateInstance CoUninitialize CoInitializeEx StringFromGUID2 |
OLEAUT32.dll |
SysAllocStringLen
VariantClear SysFreeString |
msi.dll |
#173
#217 |
RPCRT4.dll |
UuidToStringW
RpcStringFreeW |
USERENV.dll |
ExpandEnvironmentStringsForUserW
|
SHLWAPI.dll |
StrRetToBufW
#487 PathFindFileNameW SHRegDuplicateHKey PathFileExistsW |
bcrypt.dll |
BCryptGenRandom
|
CRYPT32.dll |
CertDuplicateCertificateContext
CertFindCertificateInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertFreeCertificateContext CertOpenSystemStoreA CertGetEnhancedKeyUsage CertGetIntendedKeyUsage |
WS2_32.dll |
htons
socket setsockopt listen WSAIoctl select gethostname WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect htonl connect closesocket bind accept WSASetLastError send recv freeaddrinfo getaddrinfo WSAGetLastError WSACleanup ntohs getsockopt getsockname ioctlsocket recvfrom sendto getpeername __WSAFDIsSet |
WLDAP32.dll |
#200
#30 #79 #35 #33 #32 #27 #26 #301 #46 #143 #22 #41 #50 #45 #60 #211 #217 |
Normaliz.dll |
IdnToAscii
|
AppIndexer |
APPINDEXER |
秒 |
分钟 |
小时 |
天 |
kB |
MB |
GB |
sekunder |
minutter |
timer |
dage |
kB |
MB |
GB |
Sekunden |
Minuten |
Stunden |
Tage |
kB |
MB |
GB |
sekuntia |
minuuttia |
tuntia |
päivää |
Kt |
Mt |
Gt |
secondes |
minutes |
heures |
jours |
Ko |
Mo |
Go |
secondi |
minuti |
ore |
giorni |
KB |
MB |
GB |
秒 |
分 |
時間 |
日 |
kB |
MB |
GB |
초 |
분 |
시간 |
일 |
kB |
MB |
GB |
sekunder |
minutter |
timer |
dager |
kB |
MB |
GB |
секунд |
минут |
часов |
дней |
КБ |
МБ |
ГБ |
sekunder |
minuter |
timmar |
dagar |
kB |
MB |
GB |
seconds |
minutes |
hours |
days |
kB |
MB |
GB |
segundos |
minutos |
horas |
dias |
kB |
MB |
GB |
segundos |
minutos |
horas |
días |
kB |
MB |
GB |
segundos |
minutos |
horas |
días |
kB |
MB |
GB |
秒數 |
分鐘 |
小時 |
日 |
kB |
MB |
GB |
{received}/{total} |
剩下 {time} |
{received}/{total} |
{time} tilbage |
{received}/{total} |
Noch {time} |
{received}/{total} |
{time} jäljellä oleva |
{received}/{total} |
Il reste {time} |
{received}/{total} |
{time} di tempo rimanente |
{received}/{total} |
残り{time} |
{received}/{total} |
{time} 남음 |
{received}/{total} |
{time} gjenværende |
{received}/{total} |
Осталось {time} |
{received}/{total} |
{time} återstår |
{received}/{total} |
{time} left |
{received}/{total} |
{time} restante(s) |
{received}/{total} |
{time} restante |
{received}/{total} |
{time} restante |
{received}/{total} |
還剩下 {time} |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 0.273.4.677 |
ProductVersion | 0.273.4.677 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | English - United States |
CompanyName | SweetLabs, Inc. |
FileDescription | Host App Service Interface |
FileVersion (#2) | 0.273.4.677 |
InternalName | HostAppServiceInterface |
LegalCopyright | Copyright (C) 2010-2023 - SweetLabs, Inc |
OriginalFilename | HostAppServiceInterface.exe |
ProductName | Host App Service Interface |
ProductVersion (#2) | 0.273.4.677 |
Resource LangID | UNKNOWN |
---|
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:11 |
Version | 0.0 |
SizeofData | 52 |
AddressOfRawData | 0x3d1018 |
PointerToRawData | 0x3cfe18 |
Referenced File | HostAppServiceInterface.pdb |
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:11 |
Version | 0.0 |
SizeofData | 20 |
AddressOfRawData | 0x3d104c |
PointerToRawData | 0x3cfe4c |
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:11 |
Version | 0.0 |
SizeofData | 1068 |
AddressOfRawData | 0x3d1060 |
PointerToRawData | 0x3cfe60 |
Characteristics |
0
|
---|---|
TimeDateStamp | 2023-Mar-29 19:26:11 |
Version | 0.0 |
SizeofData | 0 |
AddressOfRawData | 0 |
PointerToRawData | 0 |
StartAddressOfRawData | 0x1403d14b0 |
---|---|
EndAddressOfRawData | 0x1403d14b8 |
AddressOfIndex | 0x14040d578 |
AddressOfCallbacks | 0x140319378 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
Callbacks |
0x0000000140082F30
|
Size | 0x140 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x140401260 |
XOR Key | 0x5f6c0351 |
---|---|
Unmarked objects | 0 |
241 (40116) | 12 |
242 (40116) | 35 |
243 (40116) | 185 |
253 (VS2022 Update 4 (17.4.2) compiler 31935) | 6 |
ASM objects (VS2022 Update 4 (17.4.2) compiler 31935) | 10 |
C++ objects (VS2022 Update 4 (17.4.2) compiler 31935) | 97 |
C objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |
C++ objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 68 |
C objects (VS2022 Update 4 (17.4.2) compiler 31935) | 707 |
244 (40116) | 8 |
C objects (VS2022 Update 3 (17.3.0-3) compiler 31629) | 8 |
239 (40116) | 47 |
Total imports | 584 |
C++ objects (VS2022 Update 3 (17.3.0-3) compiler 31629) | 1 |
C++ objects (LTCG) (VS2022 Update 5 (17.5.0-2) compiler 32215) | 9 |
Resource objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |
151 | 2 |
Linker (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |