0008d6973fec06b320e38a28f6a27b6a4c8c89482c7245cb237e2f27479ef41eN

Sharing

Copy URL Twitter E-mail

General

Target

0008d6973fec06b320e38a28f6a27b6a4c8c89482c7245cb237e2f27479ef41eN
Size

103KB
MD5

b6a90052923ac895354a077621282e20
SHA1

2d7a1e021829106c080f2a730628388feb9ba6db
SHA256

0008d6973fec06b320e38a28f6a27b6a4c8c89482c7245cb237e2f27479ef41e
SHA512

ee09e0943f7f39922afe4233f3ac36ade40bb74b9a1c49d7430bfc1c626124eeb6151ecd1fb0acc7abbcc93fe4c93673d43aaf16a13df3516d0df8f35768cad0
SSDEEP

1536:GCSOGOOOc2U98c3ISE0bqh1pl+7Cw+2533C7gHZyFEHtR0PR4JRlfZd6XJaDT2R:L5G9REk2+dR/HsSBfZd6XJX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0008d6973fec06b320e38a28f6a27b6a4c8c89482c7245cb237e2f27479ef41eN

Files

0008d6973fec06b320e38a28f6a27b6a4c8c89482c7245cb237e2f27479ef41eN
.exe windows:6 windows x64 arch:x64

ffc3159c011030a8fa6ae24e4fa60181

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

libsapucum

isspaceU
printfU16

sapnwrfc

RfcSetTraceType
RfcListenAndDispatch
RfcSetIniPath
RfcMoveTo
RfcInit
RfcGetCurrentRow
RfcGetRowCount
RfcSetString
RfcOpenConnection
RfcDeleteCurrentRow
RfcSetTraceDir
RfcCloseConnection
RfcGetTable
RfcDescribeType
RfcInstallServerFunction
RfcRegisterServer
RfcGetString
RfcGetConnectionAttributes
RfcSetInt
RfcGetStructure
RfcSAPUCToUTF8
RfcGetFieldCount
RfcUTF8ToSAPUC
RfcGetFunctionDesc
RfcAppendNewRow

tgenclient

TD_CloseMatcher
TD_Release
TD_MatchCandidateU
TD_FreeBuffer
?size@MatchResults@@QEBAHXZ
??AMatchResults@@QEBAAEAVMatchRecord@@H@Z
TD_MatchU
?getString@MatchRecord@@QEBAXHPEAPEA_W@Z
??1MatchResults@@QEAA@XZ
??0MatchResults@@QEAA@XZ
TD_SetTraceOn
TD_FreeIString
TD_FreeIBuffer
TD_Attach
TD_OpenMatcher
TD_CleanseU
TD_AddToMatchWindowU
TD_SetTraceFile

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetExitCodeThread
GetLastError
CloseHandle
CreateMutexW
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
Sleep
DecodePointer
DeleteCriticalSection
SizeofResource
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetCurrentThreadId
CreateEventW
MultiByteToWideChar
FormatMessageW
SetEvent
GetCurrentThread
RaiseException
LoadLibraryW
ResetEvent
LoadResource
FindResourceW
GetProcAddress
LocalFree
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount

user32

PeekMessageW
PostThreadMessageW
CharNextW
LoadStringW

advapi32

RegisterEventSourceW
ReportEventW
RegQueryValueExW
RegDeleteValueW
StartServiceCtrlDispatcherW
RegOpenKeyExW
OpenThreadToken
InitializeSecurityDescriptor
OpenProcessToken
RegSetValueExW
IsValidSid
RegEnumKeyExW
RegisterServiceCtrlHandlerW
CopySid
RegCreateKeyExW
SetServiceStatus
RegDeleteKeyW
SetSecurityDescriptorOwner
RegQueryInfoKeyW
RegCloseKey
DeregisterEventSource
GetTokenInformation
SetSecurityDescriptorGroup
GetLengthSid

ole32

CoRevokeClassObject
CoTaskMemRealloc
CoInitializeSecurity
CoRegisterClassObject
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr

mfc140u

ord1502
ord1504
ord1503
ord1033
ord296
ord4946
ord4181
ord1034
ord306
ord2350
ord4656
ord3728
ord2346
ord2344

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
wcsstr
__std_terminate
strstr
strchr
__current_exception
__current_exception_context
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_initialize_wide_environment
_set_app_type
_invalid_parameter_noinfo
_seh_filter_exe
_errno
_beginthreadex
_configure_wide_argv
_exit
_c_exit
_cexit
_register_thread_local_exe_atexit_callback
_get_wide_winmain_command_line
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

fseek
__stdio_common_vfprintf
__acrt_iob_func
freopen
__stdio_common_vswprintf
__p__commode
fclose
fopen
fgets
__stdio_common_vsprintf
_set_fmode

api-ms-win-crt-string-l1-1-0

wcsncmp
strncmp
_stricmp
_strupr
wcsncpy_s
isspace
strcmp

api-ms-win-crt-convert-l1-1-0

wcstol
atoi
atol

api-ms-win-crt-environment-l1-1-0

getenv
_putenv

api-ms-win-crt-heap-l1-1-0

_callnewh
_recalloc
_set_new_mode
free
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffc3159c011030a8fa6ae24e4fa60181

Headers

DLL Characteristics

File Characteristics

Imports

libsapucum

sapnwrfc

tgenclient

kernel32

user32

advapi32

ole32

oleaut32

mfc140u

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1024B - Virtual size: 19KB

.pdata Size: 3KB - Virtual size: 2KB

.msvcjmc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 256B

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1024B - Virtual size: 19KB

.pdata
Size: 3KB - Virtual size: 2KB

.msvcjmc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 256B