4b742fc6a6846b2792312430289a4b9e

Sharing

Copy URL

Twitter E-mail

General

Target

4b742fc6a6846b2792312430289a4b9e
Size

432KB
MD5

4b742fc6a6846b2792312430289a4b9e
SHA1

7f8bcab29014dfcd3dab38f8d24fcd662d134d3d
SHA256

09fe8ffbebca2853f2bba333cf95fc5f37799de83d7309c672c5e6b79615df29
SHA512

fed53d8404672f858607f7e7c8cb9d4c0700e3376c16f770deeac7e7a9f8da4b22f32be8bfb773fd71bf612e9847077ac32fe8fc644353af6467068d66b069d2
SSDEEP

6144:p4/MBChuOphxRuLzytUg1BDvuVPJnZYgXM/m/WJRPShDyJW434T4xz:prB4ZphiLzyug15vuVPJBM/JAhmpaA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b742fc6a6846b2792312430289a4b9e

Files

4b742fc6a6846b2792312430289a4b9e
.dll windows:4 windows x86 arch:x86

56c24ce67c27ca3c3fc0e8c041c9d54b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

_lopen
GetTempFileNameA
GetTempPathA
SetErrorMode
_lclose
_lwrite
_llseek
_lread
lstrcatA
lstrcmpA
lstrcmpiA
LoadLibraryA
lstrcpynA
GlobalUnlock
GlobalLock
GetSystemTime
GetPrivateProfileStringA
IsDBCSLeadByte
GetProcAddress
FreeLibrary
GetProfileStringA
GetModuleFileNameA
GlobalAlloc
GlobalFree
lstrcpyA
lstrlenA

user32

GetDlgItemTextA
GetDlgItemInt
GetSystemMetrics
ShowWindow
SendDlgItemMessageA
SetFocus
GetFocus
DialogBoxParamA
CheckDlgButton
SetDlgItemTextA
GetDlgItem
EnableWindow
IsDlgButtonChecked
SetCursor
GetActiveWindow
EndDialog
SendMessageA
CharLowerA
CharUpperBuffA
LoadCursorA
wsprintfA
LoadStringA
CharNextA
OemToCharA
MessageBoxA
wvsprintfA

gdi32

DeleteObject

comdlg32

GetOpenFileNameA

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

odbc32

ord40
ord3
ord5
ord18
ord58
ord76
ord47
ord60
ord44
ord8
ord27
ord4
ord54
ord67
ord7
ord75
ord41
ord9
ord45
ord72
ord19
ord11
ord12
ord13
ord43
ord20
ord16
ord66
ord31
ord10
ord24
ord57
ord39

msvcrt

malloc
_initterm
free
?terminate@@YAXXZ
_adjust_fdiv
_except_handler3
wcstombs
mbstowcs
_fullpath
isprint
memmove
_gcvt
memset
isalnum
_strlwr
_findfirst
_findnext
_findclose
_itoa
_stricmp
atol
_unlink
_strcmpi
_ltoa
memcmp
_memicmp
_splitpath
__CxxFrameHandler
strcpy
atof
strcmp
memcpy
strncmp
strtok
strncpy
_strnicmp
_strupr
toupper
strlen
_makepath
isdigit
_errno
strrchr
strchr
sprintf
atoi
strstr
strcat
??2@YAPAXI@Z
??3@YAXPAX@Z
_ftol

Exports

Exports

PhysSQLVersionNumber
SQLBuildAndExecSQLQueryVer20
SQLBuildAndExecSQLQueryVer70
SQLCanBuildIndex
SQLCanDoServerSideProcess
SQLCanFetchDataFileIndexInfo
SQLCanFetchDataFileInfo
SQLCanFetchNRecurringRecords
SQLCanProcessSelection
SQLCanProcessSorting
SQLCanReadRangeOfValues
SQLCanReadSortedOrder
SQLCanRecognizeDataFile
SQLCanUseFileLocking
SQLCanUseRecordLocking
SQLCancelExecution
SQLCheckThreadSafeModeForDriver
SQLChooseSQLTable
SQLCloseDataFile
SQLFetchConnectInfo
SQLFetchDataFileIndexInfo
SQLFetchDataFileInfo
SQLFetchDataFileInfoVer70
SQLFetchDatabaseNameVer17
SQLFetchJoinOptionInfo
SQLFetchMemoField
SQLFetchPersistentMemoField
SQLFetchStdProcParamInfo
SQLFetchTableNameListVer19
SQLFetchTableParamInfo
SQLFreeDataFileIndexInfo
SQLFreeDataFileInfo
SQLFreeDatabaseNameVer17
SQLFreeFunctionInfoFromServer
SQLFreeJoinOptionInfo
SQLFreeMemoField
SQLFreePersistentMemoField
SQLFreeQuoteCharInfoFromServer
SQLFreeSQLQueryVer110
SQLFreeStdProcParamInfo
SQLFreeTableLinkPathInfo
SQLFreeTableNameList
SQLFreeTableParamInfo
SQLGetCapability
SQLGetFunctionInfoFromServer
SQLGetQuoteCharInfoFromServer
SQLGetTableLinkPathInfo
SQLGetThreadSafeModeForDriver
SQLInitPhysicalDatabase
SQLLogOffSQLServer
SQLLogOnSQLServerVer16
SQLLogOnSQLServerWithExtendableOptions
SQLLogOnSQLServerWithPrivateInfo
SQLLookupMatchingRecurringRecord
SQLNRecurringRecordsToRead
SQLOpenDataAndIndexFileIfRecog
SQLOpenDataFileAndIndexChoice
SQLOpenDataFileIfRecognizedVer19
SQLOpenTableEx
SQLParseSQLExpressionOnServer
SQLPromptForTableParams
SQLReadFlatRecord
SQLReadFlatRecord20
SQLReadNextRecurringRecord
SQLReadNextRecurringRecord20
SQLServerCompatible
SQLSetThreadSafeModeForDriver
SQLTermDataFileForReading
SQLTermPhysicalDatabase
SQLUseFileLocking
SQLUseRecordLocking

Sections

.text
Size: 216KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56c24ce67c27ca3c3fc0e8c041c9d54b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

odbc32

msvcrt

Exports

Exports

Sections

.text Size: 216KB - Virtual size: 213KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 176KB - Virtual size: 177KB

.rsrc Size: 20KB - Virtual size: 18KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 216KB - Virtual size: 213KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 176KB - Virtual size: 177KB

.rsrc
Size: 20KB - Virtual size: 18KB

.reloc
Size: 8KB - Virtual size: 7KB