705f5d24ef8780386e98d6d0b50b0a70
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2047-Oct-13 07:26:21 |
| Detected languages |
English - United States
|
| Debug artifacts |
MpUxAgent.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Defender MpUxAgent |
| FileVersion | 4.18.2102.4 (WinBuild.160101.0800) |
| InternalName | MpUxAgent |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | MpUxAgent.dll |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 4.18.2102.4 |
Plugin Output
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011 |
| Safe | VirusTotal score: 0/69 (Scanned on 2021-03-17 12:40:50) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2047-Oct-13 07:26:21 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2a000 |
| SizeOfInitializedData | 0x42000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000022FD0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x6e000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x7372a |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x40000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
.reloc
Imports
| api-ms-win-crt-string-l1-1-0.dll |
_wcsdup
_wcsicmp strcpy_s wcsnlen wcscmp |
|---|---|
| api-ms-win-crt-convert-l1-1-0.dll |
_wtoi
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vsprintf
__stdio_common_vsprintf_s __stdio_common_vswscanf |
| api-ms-win-crt-runtime-l1-1-0.dll |
_errno
_invalid_parameter_noinfo _cexit _initterm _invalid_parameter_noinfo_noreturn _crt_atexit _seh_filter_dll _configure_narrow_argv terminate _initialize_narrow_environment _initialize_onexit_table _register_onexit_function abort _execute_onexit_table _initterm_e |
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
_calloc_base _free_base free _callnewh |
| api-ms-win-crt-locale-l1-1-0.dll |
___mb_cur_max_func
_lock_locales _unlock_locales ___lc_locale_name_func __pctype_func ___lc_codepage_func setlocale |
| ADVAPI32.dll |
CheckTokenMembership
FreeSid GetSecurityDescriptorOwner ConvertStringSidToSidW GetNamedSecurityInfoW CopySid SetNamedSecurityInfoW AllocateAndInitializeSid GetLengthSid OpenProcessToken RegDeleteKeyW RegCreateKeyExW RegSetValueExW GetSecurityDescriptorDacl RegOpenKeyExW OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage RegCloseKey EventWriteTransfer AccessCheck AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW EventUnregister EventRegister |
| CRYPT32.dll |
CertVerifyCertificateChainPolicy
|
| KERNEL32.dll |
DisableThreadLibraryCalls
GetCurrentThread CloseHandle LocalFree ProcessIdToSessionId RaiseException GetCurrentProcessId GetSystemTimeAsFileTime lstrcmpW GetVersionExW FreeLibrary GetLastError MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCurrentProcess RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree LoadLibraryExW CreateFileW GetFileAttributesW WaitForSingleObject GetProcAddress ResetEvent WaitForSingleObjectEx ReleaseSemaphore GetModuleFileNameW InitializeCriticalSectionAndSpinCount GetSystemDirectoryW Sleep CreateSemaphoreW ExpandEnvironmentStringsW CreateEventW RtlCaptureContext SetEvent |
| ole32.dll |
CoRevertToSelf
CoImpersonateClient CoTaskMemFree StringFromCLSID |
| RPCRT4.dll |
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect CStdStubBuffer_DebugServerRelease NdrOleAllocate CStdStubBuffer_QueryInterface CStdStubBuffer_CountRefs IUnknown_Release_Proxy CStdStubBuffer_AddRef CStdStubBuffer_IsIIDSupported CStdStubBuffer_DebugServerQueryInterface IUnknown_AddRef_Proxy CStdStubBuffer_Invoke NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrDllRegisterProxy NdrDllUnregisterProxy NdrOleFree UuidCreate CStdStubBuffer_Connect |
| WINTRUST.dll |
WinVerifyTrust
WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminAcquireContext |
| api-ms-win-core-winrt-string-l1-1-0.dll |
WindowsCreateStringReference
WindowsGetStringRawBuffer WindowsDeleteString |
| api-ms-win-core-winrt-l1-1-0.dll |
RoActivateInstance
RoGetActivationFactory |
| api-ms-win-core-com-midlproxystub-l1-1-0.dll |
ObjectStublessClient7
ObjectStublessClient4 ObjectStublessClient9 ObjectStublessClient8 ObjectStublessClient6 ObjectStublessClient3 ObjectStublessClient5 |
| mpclient.dll |
MpFreeMemory
MpConfigGetValueAlloc MpConfigClose MpHandleClose MpConveyDlpBypass MpConfigOpen MpConveyUserChoiceForDlpNotification MpConfigGetValue MpManagerOpen MpConfigInitialize MpConfigUninitialize MpClientUtilExportFunctions MpUtilsExportFunctions MpManagerVersionQuery MpShowDlpDetailsDialog |
Delayed Imports
DllCanUnloadNow
| Ordinal | 1 |
|---|---|
| Address | 0x2400 |
DllGetClassObject
| Ordinal | 2 |
|---|---|
| Address | 0x2310 |
DllMain
| Ordinal | 3 |
|---|---|
| Address | 0x37a0 |
DllRegisterServer
| Ordinal | 4 |
|---|---|
| Address | 0x32a0 |
DllUnregisterServer
| Ordinal | 5 |
|---|---|
| Address | 0x3410 |
1
1 (#2)
2
3
4
5
6
7
8
9
10
11
12
101
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.18.2102.4 |
| ProductVersion | 4.18.2102.4 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Defender MpUxAgent |
| FileVersion (#2) | 4.18.2102.4 (WinBuild.160101.0800) |
| InternalName | MpUxAgent |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | MpUxAgent.dll |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion (#2) | 4.18.2102.4 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2047-Oct-13 07:26:21 |
| Version | 0.0 |
| SizeofData | 38 |
| AddressOfRawData | 0x33f6c |
| PointerToRawData | 0x33f6c |
| Referenced File | MpUxAgent.pdb |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2047-Oct-13 07:26:21 |
| Version | 0.0 |
| SizeofData | 1132 |
| AddressOfRawData | 0x33f94 |
| PointerToRawData | 0x33f94 |
UNKNOWN
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2047-Oct-13 07:26:21 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x34428 |
| PointerToRawData | 0x34428 |
UNKNOWN (#2)
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2047-Oct-13 07:26:21 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x3444c |
| PointerToRawData | 0x3444c |
TLS Callbacks
| StartAddressOfRawData | 0x180034470 |
|---|---|
| EndAddressOfRawData | 0x180034478 |
| AddressOfIndex | 0x18003b5c8 |
| AddressOfCallbacks | 0x18002ce50 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x18003ad50 |
| GuardCFCheckFunctionPointer | 6442634616 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
RICH Header
| XOR Key | 0x369cc9d9 |
|---|---|
| Unmarked objects | 0 |
| Imports (29395) | 20 |
| C objects (29395) | 14 |
| ASM objects (29395) | 10 |
| Imports (VS2008 SP1 build 30729) | 25 |
| Total imports | 366 |
| C++ objects (29395) | 43 |
| Exports (29395) | 1 |
| 265 (29395) | 88 |
| Resource objects (29395) | 1 |
| Linker (29395) | 1 |