Static task
static1
Behavioral task
behavioral1
Sample
sqlversion2.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sqlversion2.dll
Resource
win10v2004-20230220-en
General
-
Target
sqlversion2.dll
-
Size
98KB
-
MD5
75a2d15606c54c82560738ac24da48dc
-
SHA1
d064005141091995ca7d1dd29aeebfb9e51fb394
-
SHA256
5310b7eca05ae267a4a6005f2f5a47b3aee4e2c3eef4ad16a6c0ffff28f128db
-
SHA512
c8099cee02c103279e7543a5d9d2a9168061078fb015973ffbb08df3f4742f496c8f1ce0b423d82db3a9d1d9d00f1f19f9d207d84265a8dd618e6841c93a67a1
-
SSDEEP
3072:n1uW/+jHRBQSMkbCwq/hCFAjYOksiupLg:n1uRxS3kbhlupM
Malware Config
Signatures
Files
-
sqlversion2.dll.dll windows x86
68c3f90d54b2cf6b91865a5469b4b009
Code Sign
02:6e:6c:75:6c:a2:83:b7:46:6b:c7:ba:6b:e2:be:c9Certificate
IssuerCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1300Not Before27/11/2021, 05:19Not After31/12/2023, 16:00SubjectCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#130002:6e:6c:75:6c:a2:83:b7:46:6b:c7:ba:6b:e2:be:c9Certificate
IssuerCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1300Not Before27/11/2021, 05:19Not After31/12/2023, 16:00SubjectCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#130046:c7:83:d2:46:cf:6a:4d:9d:cb:bc:76:36:44:2b:48:36:5c:6b:18:1a:ee:32:87:41:69:6b:b2:f9:21:da:5eSigner
Actual PE Digest46:c7:83:d2:46:cf:6a:4d:9d:cb:bc:76:36:44:2b:48:36:5c:6b:18:1a:ee:32:87:41:69:6b:b2:f9:21:da:5eDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#130026/04/2023, 11:40 Valid: false
1a:d7:73:3c:7d:65:b7:d4:75:3a:02:9e:a4:d8:fd:07:28:0d:86:41Signer
Actual PE Digest1a:d7:73:3c:7d:65:b7:d4:75:3a:02:9e:a4:d8:fd:07:28:0d:86:41Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#130026/04/2023, 11:40 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
CloseHandle
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
CreateFileW
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
IsDebuggerPresent
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
WideCharToMultiByte
LocalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
LCMapStringW
HeapSize
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
advapi32
SetTokenInformation
ImpersonateLoggedOnUser
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetLengthSid
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
Exports
Exports
Mark_3D_verison
SQL_verify
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ