D:\data\landun\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGBizLauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b.exe
Resource
win10v2004-20240226-en
General
-
Target
a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b
-
Size
805KB
-
MD5
01f914b0b063459c60a9f4f999dd544a
-
SHA1
bfbecf58e280252ea45c14308186933977ce3055
-
SHA256
a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b
-
SHA512
c922fda797ba396d0c3d438bc84c2a4e5c0971da0ad4a7e46dcd1f92221f4d8969211cd1014692d93a4c69dadb7d86ec8a1ae878ce88822e23156a2a88e34a3e
-
SSDEEP
12288:9EAHydNBm+IY1wYPiwMeHlg3p6IBoYlkGc3ZIv:9EAHuNhIaXMeFgZGYu0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b
Files
-
a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b.exe windows:6 windows x86 arch:x86
364f4b8e8e1212793e39e643d675cbb6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FreeLibrary
OpenMutexW
SetLastError
FindNextFileW
FindClose
GetFileAttributesW
SetFileAttributesW
FileTimeToSystemTime
MoveFileExW
CreateDirectoryW
WaitForSingleObject
DeleteFileW
GetFileTime
ReadFile
ExitThread
CreateEventW
CreateThread
LocalFree
GetFileSize
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetVersionExW
LoadLibraryExW
FlushFileBuffers
HeapFree
LocalAlloc
OutputDebugStringW
HeapAlloc
GetProcessHeap
ReleaseMutex
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
SetEvent
CreatePipe
WideCharToMultiByte
IsProcessorFeaturePresent
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
EncodePointer
LCMapStringEx
GetTempPathW
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
ResetEvent
UnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
HeapReAlloc
GetFileType
GetTimeZoneInformation
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
HeapSize
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
SetEndOfFile
WriteConsoleW
GetEnvironmentVariableW
MultiByteToWideChar
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualQuery
GetTickCount
lstrcpyW
GetModuleHandleW
CreateProcessW
GetProcAddress
GetLocalTime
LoadLibraryW
lstrcatW
FormatMessageW
Sleep
GetCurrentThreadId
CreateFileW
SetFilePointer
WriteFile
lstrlenW
GetSystemDirectoryW
GetCurrentProcessId
DeleteCriticalSection
GetCommandLineW
DecodePointer
CloseHandle
GetLastError
InitializeCriticalSectionEx
CreateMutexW
GetModuleFileNameW
TerminateProcess
PeekNamedPipe
GetCurrentProcess
user32
GetClassInfoW
RemovePropW
CreateWindowExW
DefWindowProcW
FindWindowExW
SendMessageTimeoutW
IsWindow
RegisterClassW
GetSystemMetrics
SetRectEmpty
wvsprintfW
LoadIconW
LoadCursorW
GetPropW
PostQuitMessage
KillTimer
ReplyMessage
SetPropW
TranslateMessage
SetTimer
DispatchMessageW
GetMessageW
GetWindowTextW
PostMessageW
wsprintfW
ole32
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoInitialize
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
imm32
ImmDisableIME
psapi
GetProcessMemoryInfo
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
advapi32
CryptAcquireContextW
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
AddAccessAllowedAceEx
GetLengthSid
RegQueryValueExW
RegOpenKeyW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
RegSetValueExW
RegCloseKey
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetTokenInformation
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetCrackUrlA
InternetWriteFile
HttpOpenRequestW
HttpSendRequestExW
HttpEndRequestW
InternetQueryOptionW
HttpOpenRequestA
InternetOpenUrlW
HttpAddRequestHeadersW
InternetReadFile
InternetSetOptionW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
InternetCrackUrlW
HttpQueryInfoW
InternetOpenW
HttpQueryInfoA
InternetConnectA
winhttp
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpQueryOption
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpWriteData
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpReceiveResponse
Sections
.text Size: 458KB - Virtual size: 457KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 13KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 86KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE