GitLab Backup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GitLab Backup.exe
Size

9.1MB
MD5

1153c2c1a072315747bca7b8601f71a0
SHA1

8663f8befeee3dd06411da5f5180b2ed1d7fd9e7
SHA256

cf072fb7d411c86d905f71360d98dd93d336d0883dbb17a575149e930baada3b
SHA512

c6393be1b74c11cc6d5431690e92a29ae3ffc083c715f1312ae7bdea275e2c0ddc008ae32834a81281ff0ae66b6909832a037a2849df9a2c1e1b583ea4f0a917
SSDEEP

196608:Yw+X4pKJO3mWPXdH7viUZkJ/Snqt1Qxgd3B24qL0lEq:k4poOfX5s1tSWd3MTLIEq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GitLab Backup.exe

Files

GitLab Backup.exe
.exe windows:6 windows x64 arch:x64

9ae79982a7820d3bc11e98616a530fb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

SHGetFolderPathW
SHFileOperationW

kernel32

EnterCriticalSection
WriteConsoleW
GetCommandLineW
SetEnvironmentVariableW
CreateDirectoryW
CreateFileW
GetFileAttributesW
WriteFile
GetTempPathW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
FormatMessageA
FindResourceA
WideCharToMultiByte
SetConsoleCtrlHandler
GenerateConsoleCtrlEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
HeapReAlloc
RtlUnwindEx
SetLastError
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetStdHandle
HeapAlloc
HeapFree
MultiByteToWideChar
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ae79982a7820d3bc11e98616a530fb3

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

Sections

.text Size: 132KB - Virtual size: 131KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 3KB - Virtual size: 83KB

.pdata Size: 6KB - Virtual size: 6KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 8.9MB - Virtual size: 8.9MB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 132KB - Virtual size: 131KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 3KB - Virtual size: 83KB

.pdata
Size: 6KB - Virtual size: 6KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 8.9MB - Virtual size: 8.9MB

.reloc
Size: 2KB - Virtual size: 1KB