Saber_1[.]0[.]40_Installer_x64[.]exe

Resubmissions

14/06/2024, 23:32

240614-3jj53a1bjd 3

Sharing

Copy URL Twitter E-mail

General

Target

Saber_1.0.40_Installer_x64.exe
Size

1.7MB
MD5

90954f0b166296e67eef83f85c73b6d5
SHA1

17b66c44259506073fa7183469c2b0afe485412a
SHA256

d61b97d99a0553151692679f14a96210a19d679d172abd9960bfb6cdf11bd1d4
SHA512

61cc8ee09d234ce8937c475249dc5066629f2e489e653001d32dac6a9383da0598939ce72f50618052a9fffc1a0ceb59c8679203141875c14395c6579fb0e32f
SSDEEP

24576:2XH2+eAXQHmb6hQTNQRBj81zaVG7wKSnqS0WreP:mHXQGbBZyBj0oGR4t0f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Saber_1.0.40_Installer_x64.exe

Files

Saber_1.0.40_Installer_x64.exe
.exe windows:6 windows x64 arch:x64

Password: 1234

d0d0dce376cfc82f6e9f64d5432c62cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\VideoCopilot\Repositories\vcinstaller\bin\Saber\win\x64\Release\vcinstaller.pdb

Imports

kernel32

SizeofResource
GetCurrentProcess
WriteFile
CreateFileW
LockResource
CloseHandle
LoadResource
FindResourceW
IsWow64Process
WriteConsoleW
HeapSize
CreateDirectoryW
GetModuleHandleW
GetModuleFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
MultiByteToWideChar
WideCharToMultiByte
MulDiv
FindNextFileW
FindClose
LoadLibraryW
GetProcAddress
FreeLibrary
GetFileAttributesW
LocalFree
GetLastError
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
HeapAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
RtlUnwind

advapi32

RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW

shell32

ShellExecuteW
SHAppBarMessage
SHGetFolderPathW
SHCreateItemFromParsingName
ShellExecuteExW
DragQueryFileW

shlwapi

SHRegGetValueW

wtsapi32

WTSRegisterSessionNotification

d2d1

ord1

imm32

ImmGetContext
ImmReleaseContext
ImmGetVirtualKey
ImmGetCompositionStringW
ImmAssociateContext
ImmSetCandidateWindow
ImmNotifyIME
ImmIsIME

dwrite

DWriteCreateFactory

user32

GetDesktopWindow
KillTimer
IsZoomed
GetClientRect
SetCapture
TranslateMessage
GetUpdateRect
SetFocus
TrackMouseEvent
ValidateRect
PeekMessageW
GetMonitorInfoW
SetTimer
DispatchMessageW
GetClassInfoW
ShowWindow
RegisterClassExW
GetWindowLongPtrW
WaitMessage
SetWindowTextW
GetSystemMetrics
SendMessageW
CreateWindowExW
FillRect
GetCursorPos
MonitorFromWindow
ReleaseCapture
SetWindowPos
IsWindowVisible
DestroyWindow
GetFocus
GetWindowRect
GetWindow
AdjustWindowRectEx
DefWindowProcW
EndPaint
BeginPaint
AppendMenuA
TrackPopupMenuEx
DestroyMenu
SetMenuItemInfoW
CreatePopupMenu
DestroyCaret
GetKeyboardLayout
CreateCaret
MapVirtualKeyW
OpenClipboard
UpdateWindow
CloseClipboard
EmptyClipboard
InvalidateRect
EnableWindow
GetKeyState
GetDC
ScreenToClient
LoadCursorW
SetCursor
ShowCursor
SetCursorPos
EqualRect
SetClipboardData
ReleaseDC
SetWindowLongPtrW

gdi32

SetWindowExtEx
DeleteObject
CreateSolidBrush
SetMapMode
GetDeviceCaps
SetViewportExtEx
GetObjectW

ole32

RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CoUninitialize
CoCreateInstance
OleInitialize
OleUninitialize
CoInitializeEx
ReleaseStgMedium

Sections

.text
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 322KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 934KB - Virtual size: 934KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: 1234

d0d0dce376cfc82f6e9f64d5432c62cc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

shlwapi

wtsapi32

d2d1

imm32

dwrite

user32

gdi32

ole32

Sections

.text Size: 481KB - Virtual size: 481KB

.rdata Size: 322KB - Virtual size: 322KB

.data Size: 12KB - Virtual size: 20KB

.pdata Size: 20KB - Virtual size: 20KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 934KB - Virtual size: 934KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 481KB - Virtual size: 481KB

.rdata
Size: 322KB - Virtual size: 322KB

.data
Size: 12KB - Virtual size: 20KB

.pdata
Size: 20KB - Virtual size: 20KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 934KB - Virtual size: 934KB

.reloc
Size: 3KB - Virtual size: 3KB