d28ac025e86301d06f4c95f24c68ace2815367ad6a73cff5b47a1bb099364b9e

Sharing

Copy URL Twitter E-mail

General

Target

d28ac025e86301d06f4c95f24c68ace2815367ad6a73cff5b47a1bb099364b9e
Size

344KB
MD5

0daa4fb285f5f140b0e3b30a4e8a1b63
SHA1

38a974f18b0e6607e8482e38744717c12468887d
SHA256

d28ac025e86301d06f4c95f24c68ace2815367ad6a73cff5b47a1bb099364b9e
SHA512

67290eed2f8d1ae323f74c683216e86ae80cbcfb434650b7100390125a0ea594ec28c753e2aaabf699153198ebb016171e2ccd8a28727e9742411ab39d425378
SSDEEP

6144:1pitrZ0qqWuKe9IDuhNTBGAOtqEh+ZpxjVfBMFZ92HRHaCRq6JtL:1pitruqe/hNTUL0fqUvL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d28ac025e86301d06f4c95f24c68ace2815367ad6a73cff5b47a1bb099364b9e

Files

d28ac025e86301d06f4c95f24c68ace2815367ad6a73cff5b47a1bb099364b9e
.exe windows:5 windows x86

df3b36862cd876faf49dbe93d7f4e763

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
HeapSize
HeapReAlloc
SetFilePointerEx
WriteConsoleW
CreateDirectoryA
WideCharToMultiByte
GetOEMCP
FindNextFileA
FindClose
FindFirstFileA
GetTickCount
GetPrivateProfileIntA
Sleep
GetUserDefaultUILanguage
GetStdHandle
WritePrivateProfileSectionA
WritePrivateProfileStringA
GetPrivateProfileStringA
HeapFree
GetLastError
GetPrivateProfileSectionNamesA
GetProcessHeap
HeapAlloc
GetTempPathA
ExitProcess
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
SetStdHandle
GetFileType
WriteFile
GetModuleFileNameA
GetModuleHandleExW
GetACP
GetStringTypeW
LCMapStringW
CloseHandle
FindFirstFileExA
IsValidCodePage
DecodePointer

user32

GetDlgItemTextA
ShowWindow
SetDlgItemTextA
GetDlgItem
SendMessageA
LoadStringA
MessageBoxA
DialogBoxParamA

comdlg32

GetOpenFileNameA

advapi32

RegEnumValueA
RegQueryInfoKeyA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCloseKey
RegOpenKeyA

shell32

SHFileOperationA
SHGetFolderPathA
ShellExecuteExA

crypt32

CryptStringToBinaryA

shlwapi

PathAppendA
StrStrIA
PathRemoveFileSpecA
StrTrimA
PathFileExistsA

extension

ResolveIt

clients

Ex_GetCommandLineDBvKingbaseES
Ex_GetCommandLineDBvPostgresql
Ex_GetCommandLinePgadmin3
Ex_GetCommandLinePsql
Ex_GetCommandLineDMManager
Ex_GetCommandLineDMISQL
Ex_GetCommandLineDISQL
Ex_GetCommandLineDBvDM
Ex_GetCommandLineToadForDB2
Ex_GetCommandLineDBvDRDA
Ex_GetCommandLineQuest
Ex_GetCommandLineDB2CMD
Ex_ExcuteNavicatForOracle
Ex_ExcuteNavicatPremiumOracle
Ex_GetCommandLineKSQL
Ex_GetCommandLineToad
Ex_GetCommandLineSQLPlus
Ex_GetCommandLinePLSQL
Ex_ExcuteNavicatForMysql
Ex_ExcuteNavicatPremiumMysql
Ex_GetCommandLineMySQLFront
Ex_GetCommandLineDBvMySQL
Ex_GetCommandLineMySQLWorkbench
Ex_GetCommandLineMYSQLCli
Ex_ExcuteNavicatForMSSQL
Ex_GetCommandLineKingbaseESISQL
Ex_GetCommandLineMongo
Ex_GetCommandLineDBvGBase
Ex_GetCommandLineGBase
Ex_GetCommandLineDBvGBase8S
Ex_GetCommandLineGBase8S
Ex_SearchRDP
Ex_CreateProfileRemoteApp
Ex_CreateProfileMSTSC
Ex_SearchWinTelnet
Ex_ExcuteNavicatPremiumMSSQL
Ex_GetCommandLineSSMS
Ex_GetCommandLineSQLWB
Ex_GetCommandLineRealVNC
Ex_GetCommandLineDBvTNS
Ex_GetCommandLineDBeaver
MobaXtermGUISSO
Ex_GetCommandLineXftp
Ex_GetCommandLineSecureFX
Ex_GetCommandLineFlashFXP
Ex_GetCommandLineFileZilla
Ex_GetCommandLineWinSCP
Ex_GetCommandLineWinTelnet
Ex_GetCommandLineXshellTelnet
AssignCustomTitle
Ex_CheckMSTSC
Ex_CheckPuTTY
Ex_CheckSecureCRT
Ex_CheckXshell
Ex_CheckFileZilla
Ex_CheckWinSCP
Ex_CheckFlashFXP
Ex_CheckSecureFX
Ex_CheckXftp
Ex_CheckWinTelnet
Ex_CheckRealVNC
Ex_CheckSQLWB
Ex_CheckSSMS
Ex_CheckMYSQLCli
Ex_CheckMySQLWorkbench
Ex_CheckPLSQL
Ex_CheckSQLPlus
Ex_CheckToadForDB2
Ex_CheckNavicatPremium
Ex_CheckToad
Ex_CheckDB2CMD
Ex_CheckQuest
Ex_CheckDbVisualizer
Ex_CheckDISQL
Ex_CheckISQL
Ex_CheckDMManager
Ex_CheckPsql
Ex_CheckKSQL
Ex_CheckPgadmin3
Ex_CheckMongo
Ex_CheckMobaXterm
Ex_CheckDBeaver
Ex_CheckMySQLFront
Ex_CheckGBaseDataStudio
Ex_CheckKingbaseESManager
Ex_CheckNavicat
Ex_GetCommandLinePuTTYSSH
Ex_GetCommandLineSecureCRTSSH
Ex_GetCommandLineXshellSSH
Ex_GetCommandLineMobaXtermSSH
Ex_GetCommandLinePuTTYTelnet
Ex_GetCommandLineSecureCRTTelnet

Sections

.text
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df3b36862cd876faf49dbe93d7f4e763

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

shell32

crypt32

shlwapi

extension

clients

Sections

.text Size: 186KB - Virtual size: 186KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 15KB - Virtual size: 517KB

.rsrc Size: 75KB - Virtual size: 75KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 186KB - Virtual size: 186KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 15KB - Virtual size: 517KB

.rsrc
Size: 75KB - Virtual size: 75KB

.reloc
Size: 10KB - Virtual size: 9KB