Behavioral task
behavioral1
Sample
DuplicateClients (SQL).exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
DuplicateClients (SQL).exe
Resource
win10v2004-20230915-en
General
-
Target
DuplicateClients (SQL).exe
-
Size
77KB
-
MD5
071bc682f59d022c795f63a06a51e8a7
-
SHA1
fe5e80cdd0053a06502fa98518a873c4280accd0
-
SHA256
2a31c12eaea04361424ec948388df40ab5b1d67c5b5cadeac51df988d2935771
-
SHA512
e71b6e9d6f2330debcd1b754d82cfbbb7dc3a6eb570e5961a3eae5d29e702ce15fac89eb2a328adb6fb56ece1563e89ff7ff1d1815f0d2df90170ba1fa7924ea
-
SSDEEP
1536:sToUOeWebiLKaM2zG8qHuSxBRqFWcNYPpd7tpQ6Se6:s10XLKMqOSxBREY/7tG6B6
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DuplicateClients (SQL).exe
Files
-
DuplicateClients (SQL).exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 308KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 53KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE