SQL Promt Trial Resetter[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SQL Promt Trial Resetter.exe
Size

69KB
MD5

9300239faa35094ce7f831cb409bda92
SHA1

9dfa3a98767b4c4aa4f9224fc1aa40a73dedb4be
SHA256

a19b9cc594b98b604087ff17b4a46079de210d45de3f6fb5bb52f61c3a7aebc9
SHA512

b6f3c784a8996757217a278a14f49829a8ba9d126732d9817acac57695f4e13628b48b997c761d53fce731bbb6dee51630edde8e4dfe4c3affbaa1bb230dda94
SSDEEP

1536:nAf9qWr1v6WLJ75tGyilVt3BRsGLOSoL/7Ml2:nAf93NGyilP3BFLOSoL2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SQL Promt Trial Resetter.exe

Files

SQL Promt Trial Resetter.exe
.exe windows:4 windows x86 arch:x86

bf020afffb0169705d5c7726e8345b67

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetLastError
SetLastError
GetCurrentThreadId
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo

mscoree

_CorExeMain

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ