saintbot | a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969 | Triage

Sharing

General

Target

a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969
Size

29KB
MD5

d2efb0b8b82576016416aacbde6c3873
SHA1

19cac454edb76d7e879598d8c7e8e032f9d006d2
SHA256

a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969
SHA512

e05172a8e7b0988ecfd85833177727262448bc9730dd0b33bae2b311d95336a97399824635f2ef4a6374fe04eb46f3739f4a6cce4a46b0c04df88a915d5b2c94
SSDEEP

768:HOMiz6RkiNkf8DnpdGMXMmCp3gzr9b3j3zIXwrn:smCiE89dGM6pwzFF

Score

10^/10

saintbot

Malware Config

Signatures

SaintBot payload 1 IoCs

Processes:

resource yara_rule

sample family_saintbot
Saintbot family
saintbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969

Files

a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969
.exe windows:6 windows x86 arch:x86

4f301f307c4f2da1d76874497da789e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GlobalAlloc
GlobalFree
LocalFree
WideCharToMultiByte
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
GlobalReAlloc

user32

wsprintfW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ