da852a5554e1488124c99d5b88645b0c9a431ce3e072e35665009f0d58cee2b0

Sharing

Copy URL Twitter E-mail

General

Target

da852a5554e1488124c99d5b88645b0c9a431ce3e072e35665009f0d58cee2b0
Size

731KB
MD5

3ff2034e6fd1177b5b85847b989a15fb
SHA1

9f33792e27db652d23b18df143bf5e4aacebb908
SHA256

da852a5554e1488124c99d5b88645b0c9a431ce3e072e35665009f0d58cee2b0
SHA512

6d1f4f6f3e5aca16b10f3e6be5f2a229d61f3d268897a369cb9ca9c29eac13a06a8647a2e40bf7d7d9b2b91eea875bf2ddc560054ac0f27c7940244d86a1d1d6
SSDEEP

12288:G8llT4NUmA4qwqD84J8SLB38sMR7AZ+0VLqonB+Ig201awPQKkLU:G8cNnA4qwqDXCSLihRa+0VLqoy1awPQb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da852a5554e1488124c99d5b88645b0c9a431ce3e072e35665009f0d58cee2b0

Files

da852a5554e1488124c99d5b88645b0c9a431ce3e072e35665009f0d58cee2b0
.exe windows:6 windows x86 arch:x86

3199dc6df715395199668737e36203a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sapfewtr

FEWTraceMonitor
FEWTraceExit
FEWTraceInit

mfc140

ord2298
ord8321
ord14319
ord4653
ord1519
ord286
ord12502
ord5094
ord2438
ord5769
ord9647
ord6322
ord3050
ord14510
ord7887
ord14508
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3363
ord3364
ord3258
ord12111
ord5228
ord5528
ord5739
ord12863
ord6324
ord14582
ord6323
ord6831
ord3844
ord8718
ord14322
ord4655
ord2376
ord6724
ord12291
ord14518
ord12348
ord5894
ord12182
ord8180
ord12194
ord12162
ord14571
ord10202
ord9166
ord8429
ord6103
ord8347
ord12190
ord10383
ord12869
ord12806
ord8285
ord5336
ord2484
ord12485
ord12484
ord14509
ord7886
ord14507
ord9353
ord4143
ord4082
ord12888
ord7905
ord1526
ord12503
ord5096
ord1447
ord12706
ord2986
ord5898
ord1528
ord306
ord300
ord305
ord3005
ord14238
ord5059
ord4315
ord14449
ord12475
ord1468
ord1696
ord1692
ord1529
ord14581
ord4493
ord4580
ord11972
ord4972
ord4911
ord4896
ord4958
ord5003
ord4926
ord4981
ord12871
ord12872
ord993
ord4997
ord4938
ord4944
ord4950
ord4932
ord4987
ord4920
ord1772
ord1751
ord1070
ord366
ord1765
ord1739
ord4805
ord1717
ord12201
ord12205
ord13798
ord3259
ord9213
ord10950
ord6947
ord2407
ord8922
ord14502
ord11881
ord3825
ord3830
ord12032
ord9096
ord1043
ord11672
ord11671
ord5631
ord10240
ord10236
ord296
ord10238
ord10239
ord10237
ord14699
ord8173
ord10207
ord3295
ord3841
ord3298
ord7076
ord3159
ord3396
ord3395
ord458
ord4084
ord10421
ord11343
ord10963
ord8997
ord1109
ord12115
ord9167
ord2758
ord13677
ord6193
ord12074
ord7459
ord2383
ord2027
ord11928
ord2387
ord1507
ord2381
ord1661
ord5861
ord11927
ord8146
ord14380
ord316
ord310
ord5742
ord12474
ord1044
ord9305
ord5504
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord266
ord265
ord1509
ord14583
ord7964
ord2241
ord13199
ord974
ord4807
ord8322
ord4485
ord1693

kernel32

ReleaseMutex
CreateMutexA
DeleteFileA
GetFileAttributesA
GetTempFileNameA
FindResourceExW
LockResource
FindResourceW
OutputDebugStringW
HeapSize
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
SetLastError
ExpandEnvironmentStringsA
GetEnvironmentVariableA
GetUserDefaultLangID
VirtualProtect
VirtualAlloc
TlsFree
GetCurrentThread
GetCurrentProcess
InitializeCriticalSection
SetUnhandledExceptionFilter
HeapReAlloc
HeapDestroy
CreateThread
CreateEventA
WaitForSingleObject
SetEvent
CloseHandle
GetSystemDefaultLCID
GetLocaleInfoA
LocalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetTempPathW
GetLongPathNameW
IsDBCSLeadByte
MultiByteToWideChar
FindResourceA
lstrcmpiA
SizeofResource
LoadResource
LoadLibraryExA
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
GetVersionExA
InitializeCriticalSectionEx
GetLastError
DecodePointer
VirtualFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
OutputDebugStringA
GetTempPathA
CreateDirectoryA
GetCurrentDirectoryA
GetACP
WideCharToMultiByte
LoadLibraryA
GetProcAddress
FreeLibrary

user32

CharNextA
CharNextW
SendMessageA
PostMessageA
ShowWindow
BringWindowToTop
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
SetActiveWindow
GetDC
GetDesktopWindow
PostThreadMessageA
MessageBoxA
GetSystemMetrics
EnableWindow

gdi32

GetTextExtentPoint32A

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegSetValueExA
RegQueryValueExA
OpenProcessToken
OpenThreadToken
GetTokenInformation
LookupAccountSidA
RegCreateKeyA

shell32

ShellExecuteA
SHGetFolderPathA

ole32

CoSuspendClassObjects
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance

oleaut32

VariantInit
SafeArrayDestroy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayDestroyData
SafeArrayCreate
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString
VariantCopy
VariantClear

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_set_se_translator
memmove
_except_handler4_common
memcpy
__std_terminate
_purecall
__CxxFrameHandler3
memset
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
exit
_invalid_parameter_noinfo
_register_onexit_function
_crt_atexit
_errno
_controlfp_s
_resetstkoflw
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
terminate
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm
_exit
_initterm_e
_initialize_onexit_table

api-ms-win-crt-multibyte-l1-1-0

_mbscmp
_mbsstr
_mbsicmp
_mbsnbcpy_s
_mbschr
_mbsinc
_mbsncmp
_mbsspn
_ismbcdigit
_mbslen
_mbsnbicmp
_mbsnbcpy
_mbstok_s
_mbccpy_s
_ismbcalpha
_ismbclower
_ismbcupper
_mbsnbcmp
_ismbcspace

api-ms-win-crt-stdio-l1-1-0

fflush
__acrt_iob_func
fopen_s
feof
__stdio_common_vsprintf
_set_fmode
__stdio_common_vfprintf_s
__stdio_common_vsprintf_s
__p__commode
fgets
fwrite
fopen
fclose
__stdio_common_vfprintf

api-ms-win-crt-environment-l1-1-0

_putenv
getenv
_dupenv_s

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s
wcsncpy_s
strlen
isleadbyte
isalnum
strnlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_recalloc
malloc
free
realloc

api-ms-win-crt-time-l1-1-0

_localtime64_s
strftime
_time64

api-ms-win-crt-locale-l1-1-0

_setmbcp
___mb_cur_max_func
_configthreadlocale

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

Exports

Exports

SapPcTxtGetDefaultLanguage
SapPcTxtGetInfo
SapPcTxtGetLangId
SapPcTxtGetLangId2
SapPcTxtGetMaxLen
SapPcTxtLoad
SapPcTxtRead
SapPcTxtSetDefaultLanguage
SapPcTxtSetErrorMode
SapPcTxtTestRead
SapPcTxtTrace
SapPcTxtUnLoad
SapPcTxtVerifyLanguage

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3199dc6df715395199668737e36203a4

Headers

DLL Characteristics

File Characteristics

Imports

sapfewtr

mfc140

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 576KB - Virtual size: 580KB