sdl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sdl.exe
Size

5.3MB
MD5

32d63bd3c6c9fb3c7a0fc9904b71d224
SHA1

bc59172338a1079b41d84d12a6a53667c0a17407
SHA256

95c6b5f19b3b0dcbe4d3fc51d80834b1809252ea4d3a418d06040d8a10501a49
SHA512

2470538f71360f4e4a169e0f7de0d078891b1f36a389e14506b8c613a0b158baff540800549fcafcdba5ecceb7819ccd83e2be3d7e8875716429d3523b516f3c
SSDEEP

49152:2wk8szMeAF0Qxy541tvhBsVrEr4NRUMsU2z02GFeASeQCni1kNfjfmzQftSTL7+t:wwv4RQqSk9bY/7+J8O+Vrw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sdl.exe

Files

sdl.exe
.exe windows:6 windows x64 arch:x64

b78518b204afa45a47ff89d37ad7258e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtCreateFile
RtlLookupFunctionEntry
RtlNtStatusToDosError
NtCancelIoFileEx
RtlCaptureContext
NtDeviceIoControlFile
RtlVirtualUnwind

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

kernel32

SetHandleInformation
SetConsoleMode
PostQueuedCompletionStatus
GetCurrentThreadId
GetModuleHandleA
Sleep
DeleteFileW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetTickCount64
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
QueryPerformanceCounter
ReleaseSRWLockShared
AcquireSRWLockShared
GetSystemTimeAsFileTime
GetCurrentProcessId
InitializeSListHead
SwitchToThread
ReleaseSRWLockExclusive
GetCurrentThread
GetProcAddress
ReleaseMutex
GetCurrentProcess
QueryPerformanceFrequency
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
AcquireSRWLockExclusive
GetConsoleMode
GetFileInformationByHandleEx
GetStdHandle
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
ExitProcess
GetSystemInfo
GetCommandLineW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateThread
WaitForSingleObject
WriteConsoleW
ReadConsoleW
FindClose
FindFirstFileW
CreateDirectoryW
GetLastError
ReOpenFile
HeapReAlloc
CloseHandle
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
SetFilePointerEx
CreateFileW
GetModuleFileNameW
GetTempPathW
FormatMessageW
GetModuleHandleW
IsProcessorFeaturePresent
GetEnvironmentVariableW
GetCurrentDirectoryW
TerminateProcess

ws2_32

shutdown
WSASend
recv
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
bind
getsockopt
WSAIoctl
WSASocketW
setsockopt
getsockname
WSAGetLastError
getpeername
connect
ioctlsocket
socket
closesocket
send

crypt32

CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore

advapi32

RegQueryValueExW
SystemFunction036
RegOpenKeyExW

ole32

CoUninitialize

pdh

PdhCloseQuery
PdhRemoveCounter

vcruntime140

__CxxFrameHandler3
memset
__current_exception_context
__current_exception
memcmp
__C_specific_handler
memcpy
memmove

api-ms-win-crt-math-l1-1-0

floor
atan
exp2
powf
tan
cosf
sin
cos
exp
round
fmod
log
sqrt
expf
log10f
__setusermatherr
ceil
pow
log10
floorf
roundf

api-ms-win-crt-string-l1-1-0

strlen
tolower

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf
__acrt_iob_func
fflush
__stdio_common_vfprintf
__p__commode

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

exit
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_initterm_e
_exit
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initialize_onexit_table
__p___argc
__p___argv
_cexit
_register_onexit_function
_crt_atexit
terminate
_c_exit
_initialize_narrow_environment

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 732KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b78518b204afa45a47ff89d37ad7258e

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

bcrypt

kernel32

ws2_32

crypt32

advapi32

ole32

pdh

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 1024B - Virtual size: 732KB

.pdata Size: 140KB - Virtual size: 140KB

.reloc Size: 52KB - Virtual size: 52KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 1024B - Virtual size: 732KB

.pdata
Size: 140KB - Virtual size: 140KB

.reloc
Size: 52KB - Virtual size: 52KB