f5cf90419730ca43ffb74cbe9c6d67512b47a829b04cf0962e9e0e8a57ffa1d6

Sharing

Copy URL Twitter E-mail

General

Target

f5cf90419730ca43ffb74cbe9c6d67512b47a829b04cf0962e9e0e8a57ffa1d6
Size

74KB
MD5

8257596828597c9c2643eca00d4e1725
SHA1

f5c24cc89eddd56ca58c2673683e78dc2bab691c
SHA256

f5cf90419730ca43ffb74cbe9c6d67512b47a829b04cf0962e9e0e8a57ffa1d6
SHA512

c9a7ec86f5187b2319752b90a39c26905849b29db57fbeed307350cb45e010279780271597a4ae6dabd4202acab58fc68268c37bd7c97ff7df604512fbbd617b
SSDEEP

768:opIPZ0eMzy60hCoewoBQjMNBAvADAWZXLeEMe5msdQwXONnouYlFr9g7zEpqgQM+:CIPJg0h5ir7Ce5msdQ4N4h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5cf90419730ca43ffb74cbe9c6d67512b47a829b04cf0962e9e0e8a57ffa1d6

Files

f5cf90419730ca43ffb74cbe9c6d67512b47a829b04cf0962e9e0e8a57ffa1d6
.exe windows:5 windows x86 arch:x86

1f42f9d4e85946f259b1f6deee2be189

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\sources\sergey\17.2\sqlbin\opentinv.pdb

Imports

sql

IsamAlloc
IsamStrncmpA
HebrewFilter
TabulaMessageBox
IsamStrchr
IsamStrcat
IsamGetenv
SSExit
sql_tmpfile
IsamFree
sql_code_date
sql_prep
sql_message
IsamAtoi
sql_set_exception_handler
IsamTmpPath
IsamKillMsg
sql_signal_remove_tmpfiles
IsamSigMark
IsamSigInterrupt
IsamModuleCheckOK
TextAlloc
TextFree
bcopy
IsamIsdigit
bzero
IsamStrlen
IsamStrcpy

user32

GetSystemMetrics
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
CreateWindowExW

msvcr120

_exit
__argc
_except_handler4_common
_controlfp_s
_invoke_watson
_onexit
__dllonexit
__iob_func
_vswprintf_c_l
swscanf
fclose
fgets
fputc
fputs
fread
fscanf
fseek
fwrite
getc
rewind
ungetc
vfprintf
fgetwc
fputwc
ungetwc
fgetws
fputws
vfwprintf
fwscanf
_wfopen
_wfreopen
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
__wargv
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt

kernel32

IsDebuggerPresent
GetSystemDefaultLCID
DecodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetVersion
EncodePointer
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetLastError
GetFileAttributesW

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 998B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f42f9d4e85946f259b1f6deee2be189

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sql

user32

msvcr120

kernel32

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 26KB - Virtual size: 152KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 998B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 26KB - Virtual size: 152KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 998B

.reloc
Size: 2KB - Virtual size: 2KB