15b2fa0131427a7fbffe42ce83f36357661772faa0381e6ab8ef21a81c6380aa.zip
- SHA256 15b2fa0131427a7fbffe42ce83f36357661772faa0381e6ab8ef21a81c6380aa
Overview
overview
10Static
static
10IMHttpComm.dll
windows7-x64
3IMHttpComm.dll
windows10-2004-x64
3ImLookExU.dll
windows7-x64
1ImLookExU.dll
windows10-2004-x64
1ImLookU.dll
windows7-x64
3ImLookU.dll
windows10-2004-x64
3ImNtUtilU.dll
windows7-x64
3ImNtUtilU.dll
windows10-2004-x64
3ImPackr.exe
windows7-x64
10ImPackr.exe
windows10-2004-x64
10ImUtilsU.dll
windows7-x64
3ImUtilsU.dll
windows10-2004-x64
3ImWrappU.dll
windows7-x64
1ImWrappU.dll
windows10-2004-x64
1SftTree_IX86_U_60.dll
windows7-x64
1SftTree_IX86_U_60.dll
windows10-2004-x64
1mfc80u.dll
windows7-x64
1mfc80u.dll
windows10-2004-x64
1msvcp80.dll
windows7-x64
1msvcp80.dll
windows10-2004-x64
1msvcr80.dll
windows7-x64
1msvcr80.dll
windows10-2004-x64
1wlessfp1.dll
windows7-x64
3wlessfp1.dll
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
IMHttpComm.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
IMHttpComm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
ImLookExU.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
ImLookExU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
ImLookU.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
ImLookU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ImNtUtilU.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
ImNtUtilU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
ImPackr.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
ImPackr.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
ImUtilsU.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
ImUtilsU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
ImWrappU.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
ImWrappU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
SftTree_IX86_U_60.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
SftTree_IX86_U_60.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
mfc80u.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
mfc80u.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
msvcp80.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
msvcp80.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
msvcr80.dll
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
msvcr80.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
wlessfp1.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
wlessfp1.dll
Resource
win10v2004-20240611-en
| resource | yara_rule |
|---|---|
| static1/unpack001/ImUtilsU.dll | INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/mfc80u.dll |
| unpack001/msvcp80.dll |
| unpack001/msvcr80.dll |
Jul 21, 2013
count=2, id=126, version=50327,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=4, id=110, productName=VS2005 build 50727, version=50727,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=1, productName=Unmarked objects,
count=6, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50327,
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=14, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=838, id=1, productName=Unmarked objects,
count=27, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50327,
count=5, id=125, productName=VS2005 build 50727, version=50727,
count=15, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=1104, id=1, productName=Unmarked objects,
count=84, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=1, id=126, version=50327,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=19, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=1, id=126, version=50327,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=22, id=109, productName=VS2005 build 50727, version=50727,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=409, id=1, productName=Unmarked objects,
count=13, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Jul 21, 2013
count=3, id=126, version=50327,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=125, productName=VS2005 build 50727, version=50727,
count=37, id=114, version=50727,
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=89, productName=Unmarked objects (old),
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=1178, id=1, productName=Unmarked objects,
count=112, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50327,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=14, id=109, productName=VS2005 build 50727, version=50727,
count=179, id=1, productName=Unmarked objects,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=41, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=2, id=11, version=8798,
count=23, id=14, version=7299,
count=1, id=95, version=2190,
count=2, id=93, version=2179,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=424, id=1, productName=Unmarked objects,
count=21, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=14, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=124, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=35, version=8350,
count=16, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=8, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=852, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50327,
count=10, id=110, productName=VS2005 build 50727, version=50727,
count=32, id=109, productName=VS2005 build 50727, version=50727,
count=11, id=125, productName=VS2005 build 50727, version=50727,
count=221, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=134, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50327,
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=39, id=110, productName=VS2005 build 50727, version=50727,
count=68, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=162, id=1, productName=Unmarked objects,
count=184, id=110, productName=VS2005 build 50727, version=50727,
count=83, id=125, productName=VS2005 build 50727, version=50727,
count=487, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jul 21, 2013
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50327,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=109, productName=VS2005 build 50727, version=50727,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=103, id=1, productName=Unmarked objects,
count=14, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,