sapsan[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sapsan.exe
Size 2.0MB
Sample240610-ckqq5abb28
SHA256 1e7223bc42e7aa07035b6deb1c3cedd2cba26b522227548061b5723bf744ae3c
MD5 53099afa75043ea832b64db81231caff
SHA1 86a1e59a058e26fec0765571291e98d17dafca12
SHA512 45fda7812770b1748c8163cc3bd77f96e37390874f734b2a0757457252b3c64bd600fa562f472aaa512f6923fecbd0effc4ddaf670697304e7d7020bf16e6495
SSDEEP 24576:7wXn4671GiW2nM/2hXNzpwxIiN23hRKYrDobbd0sCGHjc3Z8FdgPFGA0:7wXn37hNVwxIR3GHg3ZbPy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sapsan.exe

File Explorer

sapsan.exe

.exe 2.0MB

sapsan.exe

IMPHASH 962c85077451500f48e28c629171faa0
SHA256 1e7223bc42e7aa07035b6deb1c3cedd2cba26b522227548061b5723bf744ae3c
MD5 53099afa75043ea832b64db81231caff
SHA1 86a1e59a058e26fec0765571291e98d17dafca12
SHA512 45fda7812770b1748c8163cc3bd77f96e37390874f734b2a0757457252b3c64bd600fa562f472aaa512f6923fecbd0effc4ddaf670697304e7d7020bf16e6495
SSDEEP 24576:7wXn4671GiW2nM/2hXNzpwxIiN23hRKYrDobbd0sCGHjc3Z8FdgPFGA0:7wXn37hNVwxIR3GHg3ZbPy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1626376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc CloseHandle GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleHandleExW TerminateProcess WriteConsoleW HeapCreate LoadLibraryA GetProcAddress GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess

user32

ToUnicodeEx SetWindowPlacement IsDlgButtonChecked GetDialogBaseUnits GetClipboardData CharToOemW CharNextW GetFocus GetKeyNameTextW GetCapture KillTimer AppendMenuW GetMenuInfo SetMenuInfo DrawIcon GetWindowDC ExcludeUpdateRgn InvalidateRect EnumDisplayDevicesW ChangeDisplaySettingsExW CopyIcon PrivateExtractIconsW GetParent GetDesktopWindow GetClassLongW CopyRect HideCaret DestroyCaret EnumPropsW

winspool.drv

EnumJobsW GetPrinterW GetPrinterDataW GetPrinterDataExW EnumPrinterDataW EnumPrinterDataExW GetJobW SetPrinterDataExW GetFormW EnumFormsW ConfigurePortW SetPortW ResetPrinterW SetJobW SetPrinterDataW

version

GetFileVersionInfoW VerQueryValueW

comctl32

ord412 ord15 ord13 PropertySheetW ord413

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

241KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

207KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sapsan.exe

kernel32

user32

winspool.drv

version

comctl32

generic