| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2016-Jul-13 05:32:37 |
| Detected languages |
English - United States
|
| Debug artifacts |
AMMonitoringProvider.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Security Client Antimalware Monitoring Provider |
| FileVersion | 4.18.1907.16384 (WinBuild.160101.0800) |
| InternalName | AMMonitoringProvider |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | AMMonitoringProvider.dll |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 4.18.1907.16384 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Accesses the WMI:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011 |
| Safe | VirusTotal score: 0/72 (Scanned on 2025-08-16 01:39:25) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2016-Jul-13 05:32:37 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x20000 |
| SizeOfInitializedData | 0x12000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001CA0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x33000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x41339 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x40000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| msvcrt.dll |
_vsnprintf
realloc _errno ??1type_info@@UEAA@XZ _onexit __dllonexit _unlock _lock wcschr _wcstoui64 _amsg_exit _XcptFilter memmove memcpy _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@XZ memmove_s ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@AEBQEBDH@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ wcscat_s wcscpy_s memcpy_s free malloc wcsncpy_s __C_specific_handler _purecall _wchmod wcsrchr iswalpha __CxxFrameHandler4 ?terminate@@YAXXZ _vsnwprintf _vscwprintf vswprintf_s swscanf_s _initterm memset |
|---|---|
| KERNEL32.dll |
GetTickCount
OutputDebugStringA GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LeaveCriticalSection EnterCriticalSection SetThreadLocale GetThreadLocale Sleep InitializeCriticalSection DeleteCriticalSection GetModuleFileNameW FindResourceExW DecodePointer EncodePointer LoadResource GetCurrentThread CloseHandle SwitchToThread LockResource SetLastError InitializeCriticalSectionAndSpinCount CreateDirectoryW ReadFile FindFirstFileW GetFileSizeEx FindNextFileW WriteFile ExpandEnvironmentStringsW RemoveDirectoryW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetSystemDirectoryW OpenProcess CreateEventW SetEvent DeleteFileW GetNativeSystemInfo ResetEvent LocalFree CreateProcessW GetExitCodeProcess DisableThreadLibraryCalls VirtualLock FileTimeToSystemTime GetLocalTime SystemTimeToFileTime HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap HeapDestroy SizeofResource MultiByteToWideChar RaiseException lstrcmpiW GetModuleHandleW LoadLibraryExW GetProcAddress GetLastError FreeLibrary GetTempFileNameW CopyFileW GetLocaleInfoW CreateMutexW ReleaseMutex IsWow64Process GetWindowsDirectoryW GetDiskFreeSpaceExW CreateToolhelp32Snapshot Process32FirstW Process32NextW FindResourceW FreeResource K32GetModuleFileNameExW GetSystemTimeAsFileTime VerifyVersionInfoW GetFileSize GetLongPathNameW MoveFileW CreateThread GetExitCodeThread GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetSystemDefaultUILanguage GetUserDefaultUILanguage ProcessIdToSessionId GetVersionExW GetDriveTypeW GlobalFindAtomW |
| USER32.dll |
MessageBoxW
SetForegroundWindow SetTimer KillTimer IsDialogMessageW PostThreadMessageW AdjustWindowRectEx FindWindowW GetSystemMetrics SetWindowTextW CharNextW UnregisterClassA PostMessageW LoadStringW ShowWindow SendMessageW DestroyWindow CreateDialogParamW LoadIconW GetWindowThreadProcessId |
| ADVAPI32.dll |
RegDeleteKeyW
ReportEventW DeregisterEventSource RegisterEventSourceW EnableTrace ControlTraceW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken RegQueryValueExW GetUserNameW GetTokenInformation OpenThreadToken DuplicateTokenEx FreeSid CloseServiceHandle CreateProcessAsUserW LookupPrivilegeNameW InitiateSystemShutdownExW AdjustTokenPrivileges PrivilegeCheck LookupPrivilegeValueW QueryServiceStatus ControlService GetSidSubAuthority UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle TraceMessage RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey ChangeServiceConfigW OpenServiceW OpenSCManagerW CheckTokenMembership AllocateAndInitializeSid GetSidSubAuthorityCount |
| ole32.dll |
CoImpersonateClient
CoRevertToSelf StringFromGUID2 CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateGuid |
| OLEAUT32.dll |
SysStringByteLen
SysAllocStringLen VariantClear SysStringLen VarBstrCat SysFreeString VariantInit VarUI4FromStr SysAllocString |
| mpclient.dll |
MpClientUtilExportFunctions
|
| WTSAPI32.dll |
WTSQueryUserToken
WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW |
| USERENV.dll |
CreateEnvironmentBlock
DestroyEnvironmentBlock |
| ntdll.dll |
RtlGetVersion
RtlNtStatusToDosError |
| SHELL32.dll |
SHGetSpecialFolderLocation
SHGetFolderPathW SHGetPathFromIDListW |
| VERSION.dll |
VerQueryValueW
GetFileVersionInfoW GetFileVersionInfoSizeW |
| SHLWAPI.dll |
PathIsRelativeW
PathAppendW PathCombineW PathRemoveFileSpecW PathMatchSpecW PathFileExistsW PathIsDirectoryW PathFindFileNameW |
| CRYPT32.dll |
CertVerifyCertificateChainPolicy
|
| WINTRUST.dll |
CryptCATAdminReleaseCatalogContext
CryptCATAdminAcquireContext CryptCATAdminCalcHashFromFileHandle WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseContext WinVerifyTrust |
| Ordinal | 1 |
|---|---|
| Address | 0x8c20 |
| Ordinal | 2 |
|---|---|
| Address | 0x8c60 |
| Ordinal | 3 |
|---|---|
| Address | 0x8db0 |
| Ordinal | 4 |
|---|---|
| Address | 0x8eb0 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.18.1907.16384 |
| ProductVersion | 4.18.1907.16384 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Security Client Antimalware Monitoring Provider |
| FileVersion (#2) | 4.18.1907.16384 (WinBuild.160101.0800) |
| InternalName | AMMonitoringProvider |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | AMMonitoringProvider.dll |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion (#2) | 4.18.1907.16384 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2016-Jul-13 05:32:37 |
| Version | 0.0 |
| SizeofData | 49 |
| AddressOfRawData | 0x277f8 |
| PointerToRawData | 0x277f8 |
| Referenced File | AMMonitoringProvider.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2016-Jul-13 05:32:37 |
| Version | 0.0 |
| SizeofData | 880 |
| AddressOfRawData | 0x2782c |
| PointerToRawData | 0x2782c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2016-Jul-13 05:32:37 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x27b9c |
| PointerToRawData | 0x27b9c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2016-Jul-13 05:32:37 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x27bc0 |
| PointerToRawData | 0x27bc0 |
| StartAddressOfRawData | 0x180027bc4 |
|---|---|
| EndAddressOfRawData | 0x180027bcc |
| AddressOfIndex | 0x18002e5b0 |
| AddressOfCallbacks | 0x1800230d8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x18002df88 |
| GuardCFCheckFunctionPointer | 6442594264 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xd1224864 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (30795) | 4 |
| C objects (30795) | 20 |
| Total imports | 415 |
| Imports (30795) | 33 |
| C++ objects (30795) | 10 |
| Exports (30795) | 1 |
| C objects (LTCG) (30795) | 89 |
| Resource objects (30795) | 1 |
| Linker (30795) | 1 |
No comments yet.