sg_agent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

sg_agent.exe
Size

1.5MB
MD5

43c9cffc11afb80be809f65ecd40b4f2
SHA1

030c2178148fc351983504b3b5ceff1f131ec55c
SHA256

6d9539d7f78d4f20d89b365e62449e9667fb22f4f9fbb3883a060cdfc61dbca6
SHA512

1e515ac7bc5f68cec71e35bdeb5d1ccf048dfb506060b1150b9696324772db57c24f1e57e746b6725e4aa46008a3013c1c1fb97ad3f714ef2e45c68af2039df3
SSDEEP

24576:cm4EAGdnCbn+Hubb0Sfyuj6HqPMQmSUHZRGpsiAmZfRY45cVy7uAqj92gR:7eFr+Obb0Sf0HchPAJGZIVo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sg_agent.exe

Files

sg_agent.exe
.exe windows x86

4d3f8bc3ba3a727816d44c886601bb1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

winscard

SCardState
SCardBeginTransaction
SCardAccessStartedEvent
SCardListReadersW
SCardStatusW
SCardEstablishContext
SCardGetStatusChangeA
SCardCancel
SCardIsValidContext
SCardGetStatusChangeW
SCardEndTransaction
SCardReconnect
SCardStatusA
SCardControl
SCardListReadersA
SCardListReaderGroupsW
SCardDisconnect
SCardConnectA
SCardFreeMemory
SCardGetAttrib
SCardLocateCardsByATRA
SCardLocateCardsByATRW
SCardTransmit
SCardConnectW
SCardListReaderGroupsA
SCardReleaseContext

twaindsm

DSM_Entry

advapi32

SystemFunction036

kernel32

UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
ReleaseMutex
WriteConsoleW
CreateThread
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetModuleFileNameW
FormatMessageW
SetHandleInformation
DeleteFileW
GetModuleHandleW
GetStdHandle
GetConsoleMode
SetConsoleMode
GetConsoleWindow
GetSystemTimeAsFileTime
QueryPerformanceCounter
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
QueryPerformanceFrequency
lstrlenW
CloseHandle
DeleteCriticalSection
FindClose
LeaveCriticalSection
TlsGetValue
TlsSetValue
SwitchToThread
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
SetLastError
GetCurrentDirectoryW
GetLastError
GetEnvironmentVariableW
GetCommandLineW
WriteFile
ReadFile
SetFilePointerEx
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObject
TerminateProcess
GetCurrentProcessId
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
HeapReAlloc
AddVectoredExceptionHandler
GetProcAddress
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
FindFirstFileW

ole32

CoCreateInstance
CoTaskMemFree
CoInitialize

oleaut32

SysStringLen
SysAllocStringLen

shell32

SHGetKnownFolderPath

user32

GetMessageW
TranslateMessage
DispatchMessageW
BringWindowToTop

ws2_32

listen
WSASend
getsockname
accept
WSASocketW
connect
bind
WSACleanup
WSAStartup
closesocket
WSAGetLastError
shutdown
recv
setsockopt
WSARecv
send

vcruntime140

_CxxThrowException
memmove
_except_handler4_common
memcpy
memcmp
__CxxFrameHandler3
memset

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-math-l1-1-0

log2f
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

exit
_exit
_initialize_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initterm_e
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_initterm
_get_initial_narrow_environment
_seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 741KB - Virtual size: 741KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 803KB - Virtual size: 802KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d3f8bc3ba3a727816d44c886601bb1c

Headers

DLL Characteristics

File Characteristics

Imports

winscard

twaindsm

advapi32

kernel32

ole32

oleaut32

shell32

user32

ws2_32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 741KB - Virtual size: 741KB

.rdata Size: 803KB - Virtual size: 802KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 741KB - Virtual size: 741KB

.rdata
Size: 803KB - Virtual size: 802KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 24KB