| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2021-Jun-22 02:02:59 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| CompanyName | www.mariondata.com |
| FileDescription | MDS ComputeShare Job Processor |
| FileVersion | 0.1.0 |
| LegalCopyright | Copyright (C) 2021 mariondata.com |
| ProductName | MDS ComputeShare Task |
| ProductVersion | 0.1.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to SHA256 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2021-Jun-22 02:02:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x85200 |
| SizeOfInitializedData | 0x2bf400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000005C81C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x349000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| WS2_32.dll |
gethostbyname
WSASetLastError WSAStartup select WSARecvFrom WSASocketW WSASend WSARecv WSAIoctl socket shutdown setsockopt getsockopt ioctlsocket closesocket bind WSAGetLastError htonl htons |
|---|---|
| KERNEL32.dll |
ExitThread
CreateThread WriteConsoleW GetStdHandle SetConsoleMode GetConsoleMode GetComputerNameA SetThreadAffinityMask SetPriorityClass GetCurrentProcess SetThreadPriority Sleep GetCurrentThread GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError CloseHandle LocalFree GetCurrentThreadId AddVectoredExceptionHandler DeviceIoControl GetModuleFileNameW CreateFileW GetFileType PostQueuedCompletionStatus CreateFileA DuplicateHandle SetEvent ResetEvent WaitForSingleObject CreateEventA QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait WideCharToMultiByte GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetConsoleCtrlHandler GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime MultiByteToWideChar FreeLibraryAndExitThread SetHandleInformation CreateIoCompletionPort CancelIo SwitchToThread SetFileCompletionNotificationModes SetErrorMode GetQueuedCompletionStatus FlushFileBuffers ReadFile WriteFile ConnectNamedPipe PeekNamedPipe CreateNamedPipeW CancelIoEx CancelSynchronousIo DeleteCriticalSection TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW GetLongPathNameW ReadDirectoryChangesW DebugBreak FormatMessageA TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable RtlUnwind ReleaseSemaphore TlsAlloc TlsGetValue TlsSetValue TlsFree GetNativeSystemInfo CreateSemaphoreA GetModuleHandleA LoadLibraryA FindClose FindNextFileW GetFileSizeEx SetFilePointerEx GetStartupInfoW SetStdHandle LoadLibraryExW FreeLibrary RaiseException RtlPcToFileHeader RtlUnwindEx GetModuleHandleExW GetConsoleCP ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc HeapSize FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap SleepConditionVariableCS InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead |
| USER32.dll |
MapVirtualKeyW
DispatchMessageA TranslateMessage GetSystemMetrics GetMessageA |
| ADVAPI32.dll |
CreateServiceW
QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.1.1.0 |
| ProductVersion | 0.1.1.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | www.mariondata.com |
| FileDescription | MDS ComputeShare Job Processor |
| FileVersion (#2) | 0.1.0 |
| LegalCopyright | Copyright (C) 2021 mariondata.com |
| ProductName | MDS ComputeShare Task |
| ProductVersion (#2) | 0.1.0 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Jun-22 02:02:59 |
| Version | 0.0 |
| SizeofData | 1104 |
| AddressOfRawData | 0xa0660 |
| PointerToRawData | 0x9ec60 |
| StartAddressOfRawData | 0x1400a0ad0 |
|---|---|
| EndAddressOfRawData | 0x1400a0af8 |
| AddressOfIndex | 0x1403385f0 |
| AddressOfCallbacks | 0x140087928 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x000000014005C544
|
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400ab090 |
| XOR Key | 0x731e0387 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (26213) | 10 |
| C objects (26213) | 22 |
| C++ objects (26213) | 180 |
| 253 (28518) | 4 |
| C objects (30034) | 17 |
| ASM objects (30034) | 10 |
| C++ objects (30034) | 92 |
| Imports (26213) | 13 |
| Total imports | 304 |
| C objects (VS2019 Update 9 (16.9.0-1) compiler 29910) | 28 |
| 265 (30038) | 101 |
| ASM objects (30038) | 1 |
| Resource objects (30038) | 1 |
| 151 | 1 |
| Linker (30038) | 1 |