SqlDumper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
563173db3ff0d1ed1061b2cc3945c1ef4624956cc7defafd76f69aa89866cb32.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
563173db3ff0d1ed1061b2cc3945c1ef4624956cc7defafd76f69aa89866cb32.exe
Resource
win10v2004-20240802-en
General
-
Target
fa45af19228175bd9769af77acea6d18.zip
-
Size
1.0MB
-
MD5
52b17f76b81d221c124432b24ab7f211
-
SHA1
8ee07f631e48a35617627a63f434afcc4e2edf09
-
SHA256
c529c1996dd995c06ce2d2a82a23dfa59ef472adba92bf555514e9a8bfeab8fc
-
SHA512
ad4bddf40b163340a4f7b6338d8121a3a160472d77bd001db4746c31b58fe5c9187d80fe086fb692368cfe94320a00bc9d4e5636c970ab5127c55da5197c8c01
-
SSDEEP
24576:qgCdWBLBsM2sEmqvmfbeq5Ua4BHtGYclooart65IDtoIjei1vv0ZSwl:1KWhawRfKqua4BNG1arM5IZ1eUv0Zpl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/563173db3ff0d1ed1061b2cc3945c1ef4624956cc7defafd76f69aa89866cb32
Files
-
fa45af19228175bd9769af77acea6d18.zip.zip
Password: infected
-
563173db3ff0d1ed1061b2cc3945c1ef4624956cc7defafd76f69aa89866cb32.exe windows:5 windows x86 arch:x86
Password: infected
81c720f8641914edcd344a3a79369611
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
dbghelp
MiniDumpWriteDump
ImageNtHeader
psapi
GetModuleFileNameExW
GetModuleBaseNameA
GetModuleInformation
EnumProcessModules
rpcrt4
UuidCreate
UuidToStringW
UuidFromStringW
RpcStringFreeW
iphlpapi
GetExtendedTcpTable
ws2_32
ntohs
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
OpenProcess
Thread32First
VirtualFreeEx
InitializeCriticalSectionAndSpinCount
Sleep
ReadProcessMemory
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetFileAttributesW
Thread32Next
ReadFile
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLastError
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualAllocEx
FindClose
OpenThread
SetConsoleCtrlHandler
GetExitCodeThread
CreateEventW
GetSystemInfo
WriteFile
CreateToolhelp32Snapshot
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcessId
DebugBreak
WriteProcessMemory
SuspendThread
ResumeThread
CreateThread
VirtualFree
GetModuleHandleW
SleepEx
SetEvent
GetComputerNameW
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
VirtualQuery
SetFilePointer
FindFirstFileW
FindNextFileW
GetFileSize
ExitProcess
ExpandEnvironmentStringsW
SetLastError
GetPrivateProfileStringW
lstrlenW
CompareStringW
GetProcessHeap
SetEnvironmentVariableW
HeapReAlloc
GetEnvironmentVariableW
CreateRemoteThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
DecodePointer
EncodePointer
RaiseException
InterlockedExchange
LocalAlloc
LoadLibraryExA
advapi32
RegOpenKeyW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
QueryServiceStatusEx
SetServiceStatus
StartServiceW
LookupPrivilegeValueW
RegQueryValueExW
RegisterServiceCtrlHandlerExW
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
OpenProcessToken
CloseServiceHandle
msvcr100
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
exit
_wstrtime_s
_time64
wcsncmp
swscanf_s
??3@YAXPAX@Z
_vsnwprintf
wcsrchr
_wmakepath_s
memset
_wremove
_errno
_wsplitpath_s
wcsnlen
qsort
_wtoi
wcstoul
_gmtime64_s
_wcsicmp
wcschr
_wstrdate_s
_swscanf_s_l
__CxxFrameHandler3
memcpy
_stricmp
wprintf
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ