27797a7244e490d5fdabfd8fc8c2a780

Sharing

Copy URL Twitter E-mail

General

Target

27797a7244e490d5fdabfd8fc8c2a780
Size

45KB
MD5

27797a7244e490d5fdabfd8fc8c2a780
SHA1

4fd76466ace1aad1e1b70e863bd8a494c4762c34
SHA256

7f5cab6d83f7b002fee2d332ed77d9ef4378c45968913d91082bddf693b28184
SHA512

0aff47313e02ef41a9081174083cd227141663b76825dbf2386bea5e3f69ddda2b78430515e924e6782bd86736fca71b087a41e9f73ddb105dc3a1cb9e77d36f
SSDEEP

768:bbV9R64P+lTQNqmd9+s7iI9IhNvDI6dr8oLL9999hgGM1:XRz+lcUmqjhNk6drJ99h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27797a7244e490d5fdabfd8fc8c2a780

Files

27797a7244e490d5fdabfd8fc8c2a780
.exe windows:5 windows x86 arch:x86

d7ea435e91cece51d9dc4fc28c04e62d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crtdll

_mbsnbicmp
_wcslwr
_rotr
_mbscspn
ferror
_strset
localeconv
fprintf
_mbsupr
iswctype
_purecall
atof
abs
iswupper
_control87
_statusfp
__argv_dll
_mbscmp
_wcsnicmp
_utime
_putch
_ismbckata
_CIexp
_getdrive
_CIlog10
wcstol
_cprintf
_ismbblead
atol
_mbsnbcpy

kernel32

SetConsoleTitleW
GetLocaleInfoA
GetDiskFreeSpaceExA
OpenEventA
GetCurrentThread
GlobalCompact
CommConfigDialogA
ConvertFiberToThread
LoadLibraryW
RemoveDirectoryA
VerifyConsoleIoHandle
AllocConsole
WriteConsoleOutputW
GetFileAttributesExA
GetModuleHandleA

sqlsrv32

SQLSetDescFieldW
WizDSNDlgProc
SQLProceduresW
WizDatabaseDlgProc
SQLBindParameter
SQLParamData
SQLBindCol
SQLSetConnectAttrW
SQLGetCursorNameW
SQLParamOptions
SQLPrepareW
BCP_columns
SQLGetDescRecW
SQLGetConnectOptionW
SQLColumnPrivilegesW
SQLAllocHandle
SQLDebug
SQLCopyDesc
WizLanguageDlgProc
SQLRowCount
SQLStatisticsW
SQLGetEnvAttr
SQLDriverConnectW
SQLConnectW
SQLPutData
ConfigDriverW
BCP_colptr
SQLMoreResults

oleaut32

VarUI1FromUI2
VarI2FromCy
SafeArrayAccessData
CreateDispTypeInfo
VarI8FromUI2
SafeArrayGetVartype
VarCyAbs
VarBstrFromR4
VarUI2FromR4
BSTR_UserFree
VarI4FromBool
VarDecAdd
VarUI2FromDisp
OleLoadPictureEx
VarDateFromUI4
VarBstrFromCy
VarCyFromR4
GetActiveObject

ifsutil

??1DP_DRIVE@@UAE@XZ
?Verify@IO_DP_DRIVE@@QAEEVBIG_INT@@0PAVNUMBER_SET@@@Z
?CheckAndAdd@NUMBER_SET@@QAEEVBIG_INT@@PAE@Z
?Initialize@NUMBER_SET@@QAEEXZ
?DoesIntersectSet@NUMBER_SET@@QBEEVBIG_INT@@0@Z
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@E@Z
?QueryRecommendedMediaType@DP_DRIVE@@QBE?AW4_MEDIA_TYPE@@XZ
??1MOUNT_POINT_MAP@@UAE@XZ
?GetDrive@SECRUN@@QAEPAVIO_DP_DRIVE@@XZ
?FileSetAttributes@IFS_SYSTEM@@SGEPBVWSTRING@@KPAK@Z
?GetAt@MOUNT_POINT_MAP@@QAEEKPAVWSTRING@@0@Z
?DumpHashTable@SPARSE_SET@@QAEXXZ
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EG@Z
?GetSortedFirst@TLINK@@QAEPAXXZ
?Initialize@INTSTACK@@QAEEXZ
?Initialize@VOL_LIODPDRV@@IAEEPBVWSTRING@@0PAVSUPERAREA@@PAVMESSAGE@@E@Z

userenv

GetAllUsersProfileDirectoryA
ExpandEnvironmentStringsForUserW
RefreshPolicyEx
ProcessGroupPolicyCompleted
UnregisterGPNotification
DllRegisterServer
DeleteProfileA
LeaveCriticalPolicySection
GetProfileType
RsopSetPolicySettingStatus

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 402B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7ea435e91cece51d9dc4fc28c04e62d

Headers

DLL Characteristics

File Characteristics

Imports

crtdll

kernel32

sqlsrv32

oleaut32

ifsutil

userenv

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 402B

.rsrc Size: 7KB - Virtual size: 7KB

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 402B

.rsrc
Size: 7KB - Virtual size: 7KB