sps[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

sps.exe
Size

1.0MB
MD5

fa97143d1161622cfae895029d5e7d67
SHA1

445cd2504b46a1e13b41ae5db09e6e59e7287cfe
SHA256

ccdf14e24d6e9c8d544f68207affd30d96b20160665b2daaf1ce576c54f8802e
SHA512

89d222722c679fc2141c6c09d0ac9b117e4d94e31d5863adc9e8333aadcc1597480e023863e909deacd98d42b72fe33a34bfcfda3ef6942d631e6aa72104fbd5
SSDEEP

24576:EpMTXY+t3q8cVvV8cgvy4hDS1Qkm6HBTSjM5AeYSVnreSd/dWQz:mMTIkqZTsq41SuWMI5pYgqSd1WQz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sps.exe

Files

sps.exe
.exe windows:6 windows x86 arch:x86

ecd01f143f7888af5368a64dd36263ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins_Build_Workspaces\workspace\CSI7WindowsProjects\cmake\apps\stub\RelWithDebInfo\stub.pdb

Imports

kernel32

Sleep
GetModuleFileNameW
CreateFileW
GetLastError
InterlockedDecrement
CloseHandle
GetCommandLineW
LocalFree
InterlockedIncrement
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetCurrentDirectoryW
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleW
ReadConsoleW
GetTimeZoneInformation
SetStdHandle
GetStringTypeW
LCMapStringEx
CompareStringEx
LoadLibraryW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
DeleteCriticalSection
GetCurrentThreadId
GetCurrentProcessId
CreateEventW
GetCurrentProcess
GetModuleHandleW
OpenProcess
GetProcAddress
GetModuleHandleExW
ExpandEnvironmentStringsW
FindClose
SetEndOfFile
MoveFileExW
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
WideCharToMultiByte
FormatMessageW
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
FileTimeToLocalFileTime
FindFirstFileExW
GetDriveTypeW
FileTimeToSystemTime
RtlUnwind
ExitProcess
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetConsoleCP
GetConsoleMode
LoadLibraryExW
OutputDebugStringW
FindResourceExW

user32

EnumWindows
GetWindowTextW
GetWindowThreadProcessId
SetForegroundWindow
GetForegroundWindow
SystemParametersInfoW
ShowWindowAsync

shell32

CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CLSIDFromProgID

oleaut32

VarI4FromStr
SysFreeString
SysAllocString
VariantInit
VariantClear
VariantCopy

psapi

GetModuleBaseNameW
EnumProcessModules

advapi32

CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptAcquireContextW

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ecd01f143f7888af5368a64dd36263ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

oleaut32

psapi

advapi32

Sections

.text Size: 170KB - Virtual size: 170KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 170KB - Virtual size: 170KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 21KB