c83bbe205b6d879a2b69ee7b9eb7393e7cad19e642de34293dbabdbb397a26d9

Sharing

Copy URL Twitter E-mail

General

Target

c83bbe205b6d879a2b69ee7b9eb7393e7cad19e642de34293dbabdbb397a26d9
Size

85KB
MD5

3105f048e9a40266429352b8eccb28eb
SHA1

d0ba51521449d6f27e429a6dede088225c2a3737
SHA256

c83bbe205b6d879a2b69ee7b9eb7393e7cad19e642de34293dbabdbb397a26d9
SHA512

6551e6f448ca52cb86df391756d88c284328e7350f7d58e05284f6299e5daf703f9508a5b850e0d6d50d2b7201afce9bac66145de0aec5cbe37fcf15fc3d81be
SSDEEP

1536:zpt0KbvYAj6gWEOvVe6o8YlL8w4QYoJiNY6msWfcd7/4LLLXEwtxuHQ:zXxPWEOvkx8YMVvW6Z7QLXXtxuHQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c83bbe205b6d879a2b69ee7b9eb7393e7cad19e642de34293dbabdbb397a26d9

Files

c83bbe205b6d879a2b69ee7b9eb7393e7cad19e642de34293dbabdbb397a26d9
.dll windows:6 windows x86 arch:x86

fd4a042eea359ac2d411b4b7d63897c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\ZMAIL\C++ TEST\ConsoleApplication1\Release\zmSqlite3.pdb

Imports

sqlite3

sqlite3_prepare
sqlite3_column_int
sqlite3_step
sqlite3_column_name
sqlite3_errcode
sqlite3_exec
sqlite3_close
sqlite3_busy_timeout
sqlite3_column_count
sqlite3_changes
sqlite3_column_text
sqlite3_open

kernel32

CreateFileW
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
GetLastError
GetModuleFileNameW
InterlockedFlushSList
SetLastError
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType

advapi32

SystemFunction036

Exports

Exports

??0SQLiteStatement@@AAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAUsqlite3@@@Z
??0SQLiteWrapper@@QAE@XZ
?Close@SQLiteWrapper@@QAE_NXZ
?ColumnCount@SQLiteStatement@@QAEHXZ
?ColumnName@SQLiteStatement@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?DirectStatement@SQLiteWrapper@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?NextRow@SQLiteStatement@@QAE_NAAH@Z
?Open@SQLiteWrapper@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RowChanged@SQLiteWrapper@@QAEHXZ
?Statement@SQLiteWrapper@@QAEPAVSQLiteStatement@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Statement@SQLiteWrapper@@QAEPAVSQLiteStatement@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z
?ValueInt@SQLiteStatement@@QAEHH@Z
?ValueString@SQLiteStatement@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd4a042eea359ac2d411b4b7d63897c8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sqlite3

kernel32

advapi32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 276B

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 50KB - Virtual size: 49KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 276B

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 4KB - Virtual size: 4KB