level | Triage

Resubmissions

28-09-2024 07:53

240928-jq4cqsvcmm 10

28-09-2024 07:50

240928-jpeyravbmp 3

28-09-2024 07:38

240928-jggglstfpm 3

Sharing

Copy URL

Twitter E-mail

General

Target

level
Size

789KB
MD5

4b393812c9241e1c77eef7c09ce1e1d9
SHA1

6139ef7bb6c9b0b48bedd755917e7944483e54c4
SHA256

9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4
SHA512

a55206bf2df1ee322bbede2dd738fb67f2672398cc4289c5a5a63c76105dabf9633c9126d72a65110ff8a1cda7210371ead704d8027c7bd13ebc5078811ea508
SSDEEP

6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//P:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
level

Files

level
.dll .ps1 windows:6 windows x64 arch:x64 polyglot

70035c2f670535a761d9eee3735e0d53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

X:\bt\686296\repo\out\retail-amd64\StorageClientLib\StorageClientLib.pdb

Imports

ws2_32

WSACleanup
WSAStartup
GetAddrInfoW
FreeAddrInfoW
WSAAddressToStringW
WSAGetLastError
gethostname

winhttp

WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpOpen
WinHttpSendRequest
WinHttpSetOption
WinHttpConnect
WinHttpSetStatusCallback
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryOption

advapi32

CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptSetHashParam
EventActivityIdControl

dbghelp

MiniDumpWriteDump

kernel32

InitializeCriticalSection
GetCurrentProcessId
GetCurrentThreadId
GetCurrentDirectoryW
CreateFileW
SetUnhandledExceptionFilter
CreateThreadpool
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
LeaveCriticalSection
GetCurrentProcess
CreateThread
SubmitThreadpoolWork
GetProcessHeap
HeapFree
HeapAlloc
CreateThreadpoolWork
CloseThreadpoolWork
GetSystemTime
MultiByteToWideChar
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleW
FormatMessageW
LocalFree
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
TerminateProcess
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
SetEvent
GetLastError
ResetEvent
CreateEventW
WaitForMultipleObjects
CloseHandle
WaitForSingleObject
GetTickCount64
Sleep
SystemTimeToFileTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FileTimeToSystemTime
RtlCaptureContext

rpcrt4

UuidCreate
RpcStringFreeW
UuidFromStringW
UuidToStringW

shlwapi

UrlEscapeW
ord215

msvcrt

_wfopen_s
sprintf_s
free
memchr
localeconv
fwrite
ldiv
strcspn
fclose
_wcsicmp
wcschr
wcstoul
_wtoi
wcsstr
_vsnwprintf
wcsncmp
wprintf
_purecall
swprintf_s
towlower
wcsncpy_s
_vscwprintf
swscanf
iswupper
_wcsnicmp
malloc
atoi
vswprintf_s
vsprintf_s
_vsnprintf
mbstowcs_s
wcstombs
realloc
_i64tow_s
_vscprintf
strncpy_s
_wcstoui64
memcpy_s
strstr
_wtof
_itow
_ui64tow
_wtol
_i64tow
strnlen
_stricmp
_ui64toa_s
_CxxThrowException
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
___mb_cur_max_func
_errno
___lc_handle_func
___lc_codepage_func
setlocale
__uncaught_exception
__crtLCMapStringW
__pctype_func
__mb_cur_max
memcpy
__crtGetStringTypeW
abort
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_wtoi64
??0exception@@QEAA@AEBV0@@Z
memmove_s
__RTDynamicCast
ceilf
memcmp
memset

Exports

Exports

qddBlobRow
qddRow
qonvertDateTimeStrToFileTime
qonvertFileTimeToDateTimeStr
qreateIBitMap
qreateIBlobContainerMgr
qreateIBlobMgr
qreateIBlobQueryMgr
qreateIBlobWriteMgr
qreateIBlockListEncoder
qreateIDualWidthBitMap
qreateIEventHubMgr
qecodeBase64Str
qeserializeReuseDllExpose
qisposeBlobDownloadInstance
qisposeBlobQueryInstance
qisposeBlobWriteInstance
qisposeRow
qisposeString
qisposeStringArrayUnicode
qisposeTableQueryInstance
qisposeTableWriteInstance
qownloadBlobInContainer
qownloadBlobInContainerWithSetting
qownloadSingleBlob
qnableUnhandledExceptionHandler
qncodeBase64Str
qinalize
qinalizeBlobWrite
qetBlobNames
qetBlobWritePerf
qetCompressBlobWriteStats
qetCompressTableWriteStats
qetOneDeserializedRowDllExpose
qetPerfForCompressTableQuery
qetPrefixesForListBlobs
qetRow
qetTableQueryPerf
qetTableWritePerf
qetXBlobQueryPerf
qava_MdsStorageClient_CompressedBlobQueryInit
qava_MdsStorageClient_DisposeCompressedBlobQueryInstance
qava_MdsStorageClient_DisposeRowInstance
qava_MdsStorageClient_GetOneColumnContent
qava_MdsStorageClient_GetOneRowFromCompressedBlob
qava_MdsStorageClient_GetRowException
qava_MdsStorageClient_GetRowSchema
qava_MdsStorageClient_ListBlobs
qava_MdsStorageClient_SetCompressedBlobQueryParameters
qewUuidWstr
qarseBlockId
queryBlob
queryTable
qCLCreateITableQueryMgr
qCLCreateITableWriteMgr
qerializeOneRowDllExpose
qerializeSchemaDllExpose
qetActivityIdString
qetBlobWriteTimeOut
qetDefaultMaxConnectionsAndOutStandingRequestsForWrite
qetLogConnectionStatusCallback
qetLogWinHttpErrorCallback
qetLogXBlobRequestPerfCallback
qetLogXtableBatchPerfCallback
qetLogXtableGetPerfCallback
qetParametersForStorageClientLib
qetParametersForTableWrite
qetSCLWriteCallback
qetTableWriteDebugInfo
qetWinHttpOptions
qetWriteLogCallback
qetupDownloadForOneContainer
qaitForBlobWrite
qaitForWrite
qriteBlobInit
qriteLog
scab

Sections

.text
Size: 696KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

70035c2f670535a761d9eee3735e0d53

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

winhttp

advapi32

dbghelp

kernel32

rpcrt4

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 696KB - Virtual size: 696KB

.data Size: 5KB - Virtual size: 8KB

.pdata Size: 19KB - Virtual size: 19KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 20KB - Virtual size: 18KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 696KB - Virtual size: 696KB

.data
Size: 5KB - Virtual size: 8KB

.pdata
Size: 19KB - Virtual size: 19KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 20KB - Virtual size: 18KB

.reloc
Size: 5KB - Virtual size: 4KB