vsql[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vsql.exe
Size

2.0MB
MD5

a8424e187c8eca1c30f5199934a6a60c
SHA1

e1bb733ade673220f5bfb3aa78e5bf40b8f12f36
SHA256

167ea0a15214e1914a25403c61ee8cf1d61a32fcfc7a97c12aadded46c6e1679
SHA512

f8e038d9418eeefcbd542aa06303abe8c3a4451816b95a26b77c5c6918ed2a50a74e6c155bc53fad5936298f1546ffe09fbfc4f01bb5eff35d5096c172114f26
SSDEEP

49152:s8DqFqwvP+w/tbR9QgyC8ZSVMXGPMrQWJ4UOjPWONAqIU6ileKiGyxPE:5uttCaxHNC+lhyG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vsql.exe

Files

vsql.exe
.exe windows x64

7e727929964a869bca29424c46d889cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetStdHandle
GetFileType
WriteFile
GetCurrentThreadId
GetVersion
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
RtlVirtualUnwind
CloseHandle
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
FreeLibrary
GlobalMemoryStatus
SystemTimeToFileTime
FlushConsoleInputBuffer
LoadLibraryA
GetCurrentProcess
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
IsDebuggerPresent
GetSystemTime
SetLastError
GetLastError
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
EncodePointer
LoadLibraryExW
Sleep
SetConsoleMode
GetConsoleMode
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryW
GetTempPathA
GetCurrentDirectoryW
FormatMessageW
GetVersionExW
FormatMessageA

user32

GetProcessWindowStation
GetUserObjectInformationW
GetSystemMetrics
MessageBoxW

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
GetUserNameW

ws2_32

closesocket
recv
WSASetLastError
WSAGetLastError
getsockopt
WSACleanup
send
getsockname
htonl
WSAStartup
connect
ntohs
htons
select
ntohl
freeaddrinfo
getaddrinfo
ioctlsocket
setsockopt
shutdown
socket

msvcr100

fopen
_chdir
fprintf
strcpy_s
ferror
fwrite
realloc
puts
getenv
fclose
exit
_fdopen
sscanf
isspace
calloc
malloc
strtol
_ftime64
_strdup
_fileno
vfprintf
_write
_isatty
fgetc
fread
_strnicmp
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@XZ
system
??0exception@std@@QEAA@AEBV01@@Z
memmove
strncmp
_purecall
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
putchar
putc
iscntrl
strspn
strncat
strncpy
isalpha
strcspn
strstr
getc
clearerr
_access
setvbuf
setlocale
memset
_time64
memcmp
printf
abort
qsort
_exit
strtoul
wcsstr
_vsnprintf
_vsnwprintf
raise
isdigit
strcmp
isalnum
memchr
tolower
fseek
ftell
_wfopen
_setmode
isxdigit
_stat64i32
isupper
_stricmp
__C_specific_handler
_gmtime64
signal
_getch
_putenv
wcstombs
getenv_s
_stat64
mbstowcs_s
wcsncmp
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_XcptFilter
_cexit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
fgets
remove
memcpy
_errno
_popen
_snprintf
atoi
fflush
_getpid
strchr
__iob_func
fputs
strerror
?_open@@YAHPEBDHH@Z
_pclose
free
feof
sprintf
fputc
isprint
_CxxThrowException
??0exception@std@@QEAA@AEBQEBD@Z
__CxxFrameHandler3

msvcp100

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

secur32

AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextA

shell32

SHGetFolderPathW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 493KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 282KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e727929964a869bca29424c46d889cf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

msvcr100

msvcp100

secur32

shell32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 493KB - Virtual size: 493KB

.data Size: 282KB - Virtual size: 309KB

.pdata Size: 56KB - Virtual size: 55KB

.rsrc Size: 16KB - Virtual size: 15KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 493KB - Virtual size: 493KB

.data
Size: 282KB - Virtual size: 309KB

.pdata
Size: 56KB - Virtual size: 55KB

.rsrc
Size: 16KB - Virtual size: 15KB