azsgmmq[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

azsgmmq.exe
Size

8.3MB
MD5

f02073918a20baade043fbec1dc17bda
SHA1

a46e44965ca133f88613b935e45bbadf85684094
SHA256

e5f1d6e7f38634ffb9a04e48e2639c0076881896202e47ecfe347fcc8b75f74b
SHA512

f51e16a99a863442fde298df003025ed0291f754b15e927825164efc51cdb37503b23438a03f9320ab8d94fb45ce00164747de624231c63a18b88d31126853d2
SSDEEP

196608:Yk3OI2WFYqc8D94aTJnjaWqkvBQL28Lvfr+8:Yk3QWrJxqkQvz6

Score

1^/10

Malware Config

Signatures

Files

azsgmmq.exe
.exe windows x64

516a39d1bf2566cc690153269483d8a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-processtopology-l1-2-0

GetThreadGroupAffinity

msvcrt

_CxxThrowException

ntdll

RtlCharToInteger

advapi32

MD5Init
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

comctl32

ord410

kernel32

GetSystemDirectoryW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindowThreadProcessId

Sections

.text
Size: - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xbimy
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.odvzhly
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rqlv
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

516a39d1bf2566cc690153269483d8a6

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-processtopology-l1-2-0

msvcrt

ntdll

advapi32

comctl32

kernel32

user32

Sections

.text Size: - Virtual size: 347KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: - Virtual size: 46KB

.xbimy Size: - Virtual size: 8.3MB

.odvzhly Size: 8.2MB - Virtual size: 8.2MB

.rqlv Size: 1024B - Virtual size: 736B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 347KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: - Virtual size: 46KB

.xbimy
Size: - Virtual size: 8.3MB

.odvzhly
Size: 8.2MB - Virtual size: 8.2MB

.rqlv
Size: 1024B - Virtual size: 736B

.rsrc
Size: 512B - Virtual size: 480B