c0c3d75f47c315fc2327638fcb5f90a774f3e5b6e0cbe5ee029ec94f8681ae19N

Sharing

Copy URL Twitter E-mail

General

Target

c0c3d75f47c315fc2327638fcb5f90a774f3e5b6e0cbe5ee029ec94f8681ae19N
Size

103KB
MD5

1a186839ff1c7cc69436a46875f676a0
SHA1

c4b1914b5a2a39bd2a898dc9556f5635e806a6aa
SHA256

c0c3d75f47c315fc2327638fcb5f90a774f3e5b6e0cbe5ee029ec94f8681ae19
SHA512

7d088f97c01f71ec52079c25640ef7997cf41a5016e82886f3ba98d60a35e90e484b0be2b12b12861952d5095c88b1d918bb2135d9758d3d8c320b0d9c30236a
SSDEEP

1536:LCSOGOOOc2U98c3ISE0bqh1pl+7Cw+2533C7gHZyFEHtR0PR/JRlfZd6XJaDT2R:+5G9REk2+dR/HspBfZd6XJX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0c3d75f47c315fc2327638fcb5f90a774f3e5b6e0cbe5ee029ec94f8681ae19N

Files

c0c3d75f47c315fc2327638fcb5f90a774f3e5b6e0cbe5ee029ec94f8681ae19N
.exe windows:6 windows x64 arch:x64

ffc3159c011030a8fa6ae24e4fa60181

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

libsapucum

isspaceU
printfU16

sapnwrfc

RfcSetTraceType
RfcListenAndDispatch
RfcSetIniPath
RfcMoveTo
RfcInit
RfcGetCurrentRow
RfcGetRowCount
RfcSetString
RfcOpenConnection
RfcDeleteCurrentRow
RfcSetTraceDir
RfcCloseConnection
RfcGetTable
RfcDescribeType
RfcInstallServerFunction
RfcRegisterServer
RfcGetString
RfcGetConnectionAttributes
RfcSetInt
RfcGetStructure
RfcSAPUCToUTF8
RfcGetFieldCount
RfcUTF8ToSAPUC
RfcGetFunctionDesc
RfcAppendNewRow

tgenclient

TD_CloseMatcher
TD_Release
TD_MatchCandidateU
TD_FreeBuffer
?size@MatchResults@@QEBAHXZ
??AMatchResults@@QEBAAEAVMatchRecord@@H@Z
TD_MatchU
?getString@MatchRecord@@QEBAXHPEAPEA_W@Z
??1MatchResults@@QEAA@XZ
??0MatchResults@@QEAA@XZ
TD_SetTraceOn
TD_FreeIString
TD_FreeIBuffer
TD_Attach
TD_OpenMatcher
TD_CleanseU
TD_AddToMatchWindowU
TD_SetTraceFile

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetExitCodeThread
GetLastError
CloseHandle
CreateMutexW
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
Sleep
DecodePointer
DeleteCriticalSection
SizeofResource
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetCurrentThreadId
CreateEventW
MultiByteToWideChar
FormatMessageW
SetEvent
GetCurrentThread
RaiseException
LoadLibraryW
ResetEvent
LoadResource
FindResourceW
GetProcAddress
LocalFree
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount

user32

PeekMessageW
PostThreadMessageW
CharNextW
LoadStringW

advapi32

RegisterEventSourceW
ReportEventW
RegQueryValueExW
RegDeleteValueW
StartServiceCtrlDispatcherW
RegOpenKeyExW
OpenThreadToken
InitializeSecurityDescriptor
OpenProcessToken
RegSetValueExW
IsValidSid
RegEnumKeyExW
RegisterServiceCtrlHandlerW
CopySid
RegCreateKeyExW
SetServiceStatus
RegDeleteKeyW
SetSecurityDescriptorOwner
RegQueryInfoKeyW
RegCloseKey
DeregisterEventSource
GetTokenInformation
SetSecurityDescriptorGroup
GetLengthSid

ole32

CoRevokeClassObject
CoTaskMemRealloc
CoInitializeSecurity
CoRegisterClassObject
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr

mfc140u

ord1502
ord1504
ord1503
ord1033
ord296
ord4946
ord4181
ord1034
ord306
ord2350
ord4656
ord3728
ord2346
ord2344

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
wcsstr
__std_terminate
strstr
strchr
__current_exception
__current_exception_context
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_initialize_wide_environment
_set_app_type
_invalid_parameter_noinfo
_seh_filter_exe
_errno
_beginthreadex
_configure_wide_argv
_exit
_c_exit
_cexit
_register_thread_local_exe_atexit_callback
_get_wide_winmain_command_line
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

fseek
__stdio_common_vfprintf
__acrt_iob_func
freopen
__stdio_common_vswprintf
__p__commode
fclose
fopen
fgets
__stdio_common_vsprintf
_set_fmode

api-ms-win-crt-string-l1-1-0

wcsncmp
strncmp
_stricmp
_strupr
wcsncpy_s
isspace
strcmp

api-ms-win-crt-convert-l1-1-0

wcstol
atoi
atol

api-ms-win-crt-environment-l1-1-0

getenv
_putenv

api-ms-win-crt-heap-l1-1-0

_callnewh
_recalloc
_set_new_mode
free
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffc3159c011030a8fa6ae24e4fa60181

Headers

DLL Characteristics

File Characteristics

Imports

libsapucum

sapnwrfc

tgenclient

kernel32

user32

advapi32

ole32

oleaut32

mfc140u

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1024B - Virtual size: 19KB

.pdata Size: 3KB - Virtual size: 2KB

.msvcjmc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 256B

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1024B - Virtual size: 19KB

.pdata
Size: 3KB - Virtual size: 2KB

.msvcjmc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 256B