cfffc6904b007522f6fb83eec19263b73b85e28a005280959aabccb826326465N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

cfffc6904b007522f6fb83eec19263b73b85e28a005280959aabccb826326465N.exe
Size

2.2MB
MD5

f84ec31e56bc94a3af0f0925fde27140
SHA1

c713d1e9aa6981572db1b7c4e47f27a05880e69b
SHA256

cfffc6904b007522f6fb83eec19263b73b85e28a005280959aabccb826326465
SHA512

754cbbad94c14387e0bab606e647012e0d6bdb2e2995aaf1dbe2e4f80290954c2a78b1d894e0960aa73c1871eb4c16684fd60fc11c9f5badf0dab3f7d5676809
SSDEEP

24576:ZJjVE2fh4Co0te+4MGwAvcrCVcPM9W4OnkSCIpUlZXUbOpz:ZVVEaSoecXpUlZX3pz

Score

1^/10

Malware Config

Signatures

Files

cfffc6904b007522f6fb83eec19263b73b85e28a005280959aabccb826326465N.exe
.exe windows:6 windows x86 arch:x86

87a1737d67771d0d234933cc06aa1b1a

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:e9:01:2d:64:4c:98:da:73:52:88:03:2e:16:45:3d:35:80:b6:2c:c4:00:6a:fe:11:ae:c3:c1:30:25:58:f4
Signer

Actual PE Digest

11:e9:01:2d:64:4c:98:da:73:52:88:03:2e:16:45:3d:35:80:b6:2c:c4:00:6a:fe:11:ae:c3:c1:30:25:58:f4

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dbs\sh\5uj5\1004_232612\cmd\6\obj\x86retail\sql\ntdbms\storeng\util\sqldumper\src\sqldumper.vcxproj\SqlDumper.pdb

Imports

dbghelp

MiniDumpWriteDump
SymSrvGetFileIndexInfoW
ImageNtHeader

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate
UuidFromStringW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wer

WerReportCloseHandle
WerReportAddFile
WerReportSetParameter
WerReportSubmit
WerReportCreate

shlwapi

PathFindExtensionW
PathFileExistsW
PathRemoveFileSpecW
StrCmpIW
PathFindFileNameW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchRemoveExtension
PathCchCombine
PathCchRemoveBackslash
PathCchAppend

dbgeng

DebugCreate

kernel32

MultiByteToWideChar
GetModuleHandleExW
GetProcAddress
FreeLibrary
CreateDirectoryW
ReadFile
SetConsoleCtrlHandler
FindFirstFileW
GetFileSizeEx
WriteProcessMemory
EnterCriticalSection
VirtualFree
GetCommandLineW
FindNextFileW
GetCurrentProcess
WriteFile
ExpandEnvironmentStringsW
VirtualAlloc
GetFinalPathNameByHandleW
GetModuleFileNameW
K32GetModuleFileNameExW
InitializeCriticalSectionAndSpinCount
Thread32Next
LeaveCriticalSection
SetFilePointer
CreateMutexW
Thread32First
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
GetExitCodeThread
Sleep
DeleteCriticalSection
SetEvent
DeleteFileW
CloseHandle
K32GetModuleBaseNameA
GetSystemInfo
K32GetModuleInformation
CreateThread
VirtualAllocEx
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
SleepEx
CreateRemoteThread
QueryFullProcessImageNameW
GetSystemTimeAsFileTime
K32EnumProcessModules
VirtualFreeEx
K32GetMappedFileNameW
DebugBreak
GetTickCount
MoveFileW
VirtualQuery
OpenThread
LoadLibraryExW
FlushFileBuffers
GetExitCodeProcess
HeapAlloc
HeapFree
GetLastError
InitializeCriticalSectionEx
LoadLibraryExA
FormatMessageW
CompareStringW
lstrlenW
SetEnvironmentVariableW
GetEnvironmentVariableW
HeapReAlloc
VirtualProtect
InitializeSListHead
RaiseException
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
SetLastError
GetPrivateProfileStringW
IsDebuggerPresent
OutputDebugStringW

advapi32

RegisterServiceCtrlHandlerExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
EventWriteTransfer
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
OpenProcessToken
StartServiceW
RegOpenKeyExW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceStatusEx
RegQueryValueExW
EventRegister
EventUnregister
EventWriteString

ole32

CoUninitialize
StringFromGUID2
CoCreateInstance
CoInitializeEx

oleaut32

SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
VarCmp
VariantCopy
VariantInit

vcruntime140

memset
_except_handler4_common
wcschr
__current_exception
_CxxThrowException
__std_exception_destroy
__std_exception_copy
wcsrchr
wcsstr
__CxxFrameHandler3
__current_exception_context
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__acrt_iob_func
__stdio_common_vswscanf
__stdio_common_vfwprintf
__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc

api-ms-win-crt-runtime-l1-1-0

__p___wargv
_cexit
_controlfp_s
__p___argc
terminate
_crt_atexit
_exit
_c_exit
_initterm_e
_initialize_onexit_table
_errno
_register_onexit_function
_initterm
_seh_filter_exe
_get_initial_wide_environment
_resetstkoflw
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_register_thread_local_exe_atexit_callback
exit

api-ms-win-crt-time-l1-1-0

_wstrtime_s
_gmtime64_s
_time64
_wstrdate_s

api-ms-win-crt-string-l1-1-0

_wcsnicmp
_wcsicmp
wcsncmp
_stricmp

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_wremove
_wmakepath_s

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul
mbstowcs_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87a1737d67771d0d234933cc06aa1b1a

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:ccCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

11:e9:01:2d:64:4c:98:da:73:52:88:03:2e:16:45:3d:35:80:b6:2c:c4:00:6a:fe:11:ae:c3:c1:30:25:58:f4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dbghelp

rpcrt4

iphlpapi

ws2_32

version

wer

shlwapi

api-ms-win-core-path-l1-1-0

dbgeng

kernel32

advapi32

ole32

oleaut32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 88KB - Virtual size: 85KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 24KB - Virtual size: 208KB

.didat Size: 4KB - Virtual size: 20B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 6KB

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

11:e9:01:2d:64:4c:98:da:73:52:88:03:2e:16:45:3d:35:80:b6:2c:c4:00:6a:fe:11:ae:c3:c1:30:25:58:f4
Signer

.text
Size: 88KB - Virtual size: 85KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 24KB - Virtual size: 208KB

.didat
Size: 4KB - Virtual size: 20B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB