sG[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

sG.exe
Size

4.4MB
MD5

930b0cb37d4332364f0686547037ada4
SHA1

29b71f91a661c6a62cd64cd77db4c807f23c49ac
SHA256

b873befd3937949e2ba52a32378b94d0d69a16ec603717eaeff5376c74cde0b1
SHA512

a841ee01f483469047ed2a0d171f298c7ac65a39c20e8c8c828f956f910a23d1c6f3740b6a0b796b40f9c75e863324bb8bd80d8e50ba0515a08544b833ec6675
SSDEEP

49152:rOCxSImaFXmyp7U5OK91KLQBeAnUJN5pdeBv9MdoDCwYc:vUAFXmyxe1KLQBeivKd2CwJ

Score

1^/10

Malware Config

Signatures

Files

sG.exe
.exe windows:6 windows x86 arch:x86

e15799106ee5d8d4266cacc80c1e9df9

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:07:ae:18:c2:81:62:55:65:f3:bb:e6
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-01-2024 16:00

Not After

31-01-2025 16:00

Subject

SERIALNUMBER=1237700757315,CN=Stimul LLC,O=Stimul LLC,STREET=per Rastorguyevskiy\, 4A pomeshch 1/1,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5a:ee:14:df:25:0a:8c:7a:e3:17:8c:b7:b6:f0:b9:73:de:78:83:58:52:fa:af:60:f6:84:61:7d:7a:cd:77:01
Signer

Actual PE Digest

5a:ee:14:df:25:0a:8c:7a:e3:17:8c:b7:b6:f0:b9:73:de:78:83:58:52:fa:af:60:f6:84:61:7d:7a:cd:77:01

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\cpp\Notepad3\Bin\Debug_x86_v143\grepWinNP3.pdb

Imports

shlwapi

StrCmpLogicalW
SHGetValueW
AssocQueryStringW
PathCompactPathExW
StrFormatByteSizeW
SHDeleteKeyW
PathRemoveFileSpecW
PathAppendW
PathIsURLW
PathIsRootW
PathIsRelativeW
PathCanonicalizeW
PathIsDirectoryW
PathFileExistsW
SHSetValueW
PathRelativePathToW
SHAutoComplete

uxtheme

BufferedPaintSetAlpha
EndBufferedPaint
BeginBufferedPaint
SetWindowTheme
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect
GetThemeColor
GetThemeInt

kernel32

lstrlenW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetCurrentThreadId
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
GetFullPathNameW
GetLongPathNameW
GetShortPathNameW
GetTempFileNameW
GetTempPathW
CloseHandle
Sleep
GetModuleFileNameW
SetCurrentDirectoryW
GetTickCount64
FormatMessageW
GetWindowsDirectoryW
GetCurrentProcess
DeleteFileW
GetFileSizeEx
GetFileTime
ReadFile
SetFileTime
WriteFile
GlobalMemoryStatusEx
WideCharToMultiByte
FindResourceExW
FlushFileBuffers
GetFileSize
SetEndOfFile
SetFilePointer
GetCommandLineW
SetErrorMode
CreateMutexW
GetSystemDirectoryW
SetDllDirectoryW
SystemTimeToFileTime
LoadLibraryA
GetStringTypeExW
LCMapStringW
GetUserDefaultLCID
ExpandEnvironmentStringsW
CompareFileTime
CreateFileA
GetFileAttributesW
GetFileInformationByHandle
SetFileAttributesW
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateThread
CreateProcessW
GetSystemTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
MoveFileExA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringA
GetStringTypeExA
lstrcpyW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
CompareStringW
GetProcessHeap
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
SetConsoleCtrlHandler
GetCurrentThread
FreeLibraryAndExitThread
ResumeThread
ExitThread
ExitProcess
SetEnvironmentVariableW
GlobalAddAtomW
HeapAlloc
WriteConsoleW
GetFileType
GetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
CreateFileMappingA
GetModuleHandleA
MapViewOfFileEx
GetSystemInfo
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
SetFileInformationByHandle
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
RtlCaptureStackBackTrace
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
RaiseException
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStringTypeW
FormatMessageA
GlobalLock
GlobalUnlock
GlobalAlloc
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
lstrcpynW
MulDiv
GetModuleHandleW
VerifyVersionInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
GetLastError
VerSetConditionMask
LocalFree
LocalAlloc
GlobalFree
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
DeleteAtom
HeapValidate

user32

GetSysColor
LoadIconA
RedrawWindow
GetDCEx
AppendMenuW
InsertMenuW
CheckMenuItem
DestroyMenu
CreatePopupMenu
GetKeyState
SendDlgItemMessageW
DrawFocusRect
SendMessageW
GetFocus
GetCapture
GetSystemMetrics
DrawTextW
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRgn
GetWindowTextW
GetWindowTextLengthW
GetClientRect
CheckDlgButton
CreateWindowExA
PostMessageW
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
FrameRect
InflateRect
IntersectRect
PtInRect
GetWindowLongW
GetParent
GetClassNameW
SystemParametersInfoW
GetMessageW
TranslateMessage
DispatchMessageW
GetMessagePos
PostQuitMessage
CreateWindowExW
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
GetWindowPlacement
BringWindowToTop
CreateDialogParamW
CreateDialogIndirectParamW
DialogBoxParamW
DialogBoxIndirectParamW
LoadStringA
KillTimer
SetTimer
IsDlgButtonChecked
EnumWindows
RegisterWindowMessageW
ClientToScreen
TrackPopupMenu
EndDialog
GetDlgItem
GetDlgItemTextW
DefDlgProcW
GetSubMenu
LoadMenuW
LoadStringW
DrawIconEx
GetSysColorBrush
SetDlgItemTextW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
GetMonitorInfoW
EnumThreadWindows
EnumChildWindows
SetWindowTextW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
GetSystemMenu
CloseWindow
LoadCursorW
CheckRadioButton
SetCursor
ReleaseCapture
SetCapture
RemovePropW
GetPropW
SetPropW
RegisterClipboardFormatW
InvalidateRect
SetWindowRgn
IsZoomed
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
FindWindowExW
CallWindowProcW
SetWindowPlacement
RegisterClassExW
DefWindowProcW
IsDialogMessageW
LoadImageW
GetDesktopWindow
SetWindowLongW
OffsetRect
CopyRect
SetCursorPos
MessageBoxW
GetWindowDC
SetForegroundWindow
TranslateAcceleratorW
LoadAcceleratorsW
EnableWindow
SetFocus

gdi32

SetBkMode
GetObjectW
CreateSolidBrush
EnumFontsW
SetTextColor
DeleteObject
SetRectRgn
CreateRectRgn
GetStockObject
PatBlt
SelectObject
SetPixel
SetBkColor
CreateRectRgnIndirect
ExtTextOutW
CreateFontIndirectW
GetDeviceCaps
CombineRgn

comdlg32

GetOpenFileNameW

advapi32

CryptAcquireContextW
CryptReleaseContext
RegOpenKeyW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam

shell32

SHBrowseForFolderW
SHGetKnownFolderPath
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHGetFolderPathW
CommandLineToArgvW
DragQueryFileW
SHGetDesktopFolder
ord701
SHCreateItemFromParsingName
SHGetMalloc
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
DoDragDrop
OleDuplicateData
ReleaseStgMedium
CoUninitialize
CoInitialize
OleInitialize
CoInitializeEx
RegisterDragDrop
OleRun
CoCreateInstance
CoTaskMemFree
OleUninitialize

oleaut32

CreateErrorInfo
SysFreeString
GetErrorInfo
VariantInit
VariantClear
VariantChangeType
SetErrorInfo
SysAllocString

gdiplus

GdipCloneImage
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipClosePathFigure
GdipStartPathFigure
GdipResetPath
GdipDeletePath
GdipCreatePath
GdipDisposeImage
GdiplusStartup
GdipFree
GdipAlloc
GdipDrawCachedBitmap
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipFillRectangleI
GdiplusShutdown
GdipDrawPath
GdipDrawRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP

comctl32

ImageList_GetImageInfo
ord410
ord412
ord381
ord413
InitCommonControlsEx
ImageList_GetImageCount

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CryptProtectData
CryptUnprotectData

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e15799106ee5d8d4266cacc80c1e9df9

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

27:07:ae:18:c2:81:62:55:65:f3:bb:e6Certificate

Extended Key Usages

Key Usages

5a:ee:14:df:25:0a:8c:7a:e3:17:8c:b7:b6:f0:b9:73:de:78:83:58:52:fa:af:60:f6:84:61:7d:7a:cd:77:01Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

comctl32

version

crypt32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 445KB - Virtual size: 445KB

.data Size: 23KB - Virtual size: 35KB

.idata Size: 15KB - Virtual size: 15KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 210KB - Virtual size: 209KB

.reloc Size: 90KB - Virtual size: 89KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

27:07:ae:18:c2:81:62:55:65:f3:bb:e6
Certificate

5a:ee:14:df:25:0a:8c:7a:e3:17:8c:b7:b6:f0:b9:73:de:78:83:58:52:fa:af:60:f6:84:61:7d:7a:cd:77:01
Signer

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 445KB - Virtual size: 445KB

.data
Size: 23KB - Virtual size: 35KB

.idata
Size: 15KB - Virtual size: 15KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 210KB - Virtual size: 209KB

.reloc
Size: 90KB - Virtual size: 89KB