Sapphire[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Sapphire.exe
Size

104.8MB
MD5

e848b1fd927b08df17ad094d9e729050
SHA1

894be2baee08c6d87f190ed4645073b0ac8844ee
SHA256

bceb540d7d3576b82aee285b39ac78424f7ece77af743ac83aacb1aa9021afdb
SHA512

a901d989cd5689f0cefe8d89adc62bd6c4fb17e7ff96872808f883d9b14180c3e4971c9779c53fb20faecbc794db62406f28c298e902d901be6e407651fbbb75
SSDEEP

3145728:Q4vWnKO6BWxRbPYDRVIOpMNwLjGuZezztf:NvWnU6hPYVqILjGm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sapphire.exe

Files

Sapphire.exe
.exe windows:6 windows x64 arch:x64

8ed04cdf5016ba23a6d8d1d97f62bc7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

SHFileOperationW

kernel32

SetLastError

Sections

.text
Size: - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sapphir
Size: - Virtual size: 90.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sapphir
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sapphir
Size: 104.8MB - Virtual size: 104.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ