Static task
static1
Behavioral task
behavioral1
Sample
Saqxz Permanent.exe
Resource
win10v2004-20240802-en
General
-
Target
Saqxz Permanent.exe
-
Size
14.9MB
-
MD5
cecf88d73f7c9daffaa3bade0e3445b8
-
SHA1
0d0a296deaef22b2eb6743d7d2c18e25c74ad417
-
SHA256
6acbb68770992c7ee16e4e3231a8cf661d995bfd493dfbab546cd2e0d8d7726f
-
SHA512
8e45b1ba7ee853c82c3477ad01b3d1df29b9debf386518123a1495b0ffb79b711c156b8230817ca072c2d2738ce61f14c5296e4e35550d18e76cb8e60d5d096e
-
SSDEEP
393216:bl1BarphzEiYZFytT44Dlcr8fpLV1uZviPDYNWHXM+:510phzVz44SkuWDuW3M+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Saqxz Permanent.exe
Files
-
Saqxz Permanent.exe.exe windows:6 windows x64 arch:x64
a0fb0580ea3f209ab13aabd2ce93e798
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
WakeAllConditionVariable
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetClipboardData
advapi32
AddAccessAllowedAce
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VariantClear
msvcp140
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathFindFileNameW
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertOpenStore
ws2_32
WSASetLastError
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
powf
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.|IZ Size: - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.~[u Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gc3 Size: 14.9MB - Virtual size: 14.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ