gbak[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gbak.exe
Size 349KB
Sample260729-pp3mpsgl4x
SHA256 04c9cfca00663ccdcf735db257e3086cee2e4b525f7ab04f68e068ee8cc0c6fe
MD5 c01cd186ab6243a4fe3e746982557919
SHA1 64c4f0c30ad7037d9f9f7921121d4bf335ff6e65
SHA512 48b10888115120b4fe3f38cc8e542deece85845f17b4f36debe30c0848bd337e06599e72e61d79353254b7f919cc2805a24cf3e7c3a86fc1e179afb15f6c5ec5
SSDEEP 6144:AFoi3kURT3vFcCbiFzhACRVkilSsuc3OZaeiPe:AFV3h3tRbiFuhIPe
TLSH
T11A745D12FA919EBCC063E138D8A3572AD27138684B356BDB47D096171F13AECD67C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gbak.exe

File Explorer

gbak.exe

.exe 349KB

gbak.exe

IMPHASH 581e3a8f036658ee101d4562e85511fd
SHA256 04c9cfca00663ccdcf735db257e3086cee2e4b525f7ab04f68e068ee8cc0c6fe
MD5 c01cd186ab6243a4fe3e746982557919
SHA1 64c4f0c30ad7037d9f9f7921121d4bf335ff6e65
SHA512 48b10888115120b4fe3f38cc8e542deece85845f17b4f36debe30c0848bd337e06599e72e61d79353254b7f919cc2805a24cf3e7c3a86fc1e179afb15f6c5ec5
SSDEEP 6144:AFoi3kURT3vFcCbiFzhACRVkilSsuc3OZaeiPe:AFV3h3tRbiFuhIPe
TLSH
T11A745D12FA919EBCC063E138D8A3572AD27138684B356BDB47D096171F13AECD67C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

255648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\fb25\svn_prod\R2_5_2\firebird2\temp\x64\Release\gbak\gbak.pdb

ws2_32

ntohl htonl

kernel32

CloseHandle DeleteFileA SetTapePosition SetFilePointer FlushFileBuffers GetTapeParameters CreateFileA GetStdHandle ReadFile GetLastError TlsGetValue TlsSetValue TlsFree TlsAlloc EnterCriticalSection LeaveCriticalSection OpenThread WriteFile VirtualAlloc GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess Sleep FindNextFileA FindFirstFileA FindClose GetVersion LoadLibraryA GetProcAddress GetCurrentProcess GetModuleFileNameA lstrcmpA lstrlenA QueryPerformanceFrequency QueryPerformanceCounter GetConsoleMode SetConsoleMode LocalFree LocalAlloc FreeLibrary GetEnvironmentVariableA SleepEx GetCurrentThreadId VirtualFree DeleteCriticalSection InitializeCriticalSection GetSystemInfo

fbclient

ord134 ord162 ord169 ord165 ord122 ord280 ord140 ord259 ord176 ord166 ord116 ord168 ord156 ord83 ord158 ord1 fb_shutdown_callback fb_shutdown ord37 ord225 ord228 ord153 ord227 ord173 ord103 ord128 ord186 ord120 ord138 ord174 ord229 ord115 ord160 ord42 ord44 ord51 ord250 ord144 ord145 ord118 ord119 ord113 ord139 ord152 ord108 fb_interpret ord114 ord226

msvcr80

_ctime64 _time64 _CxxThrowException isalpha isdigit memcmp fflush __iob_func vfprintf __CxxFrameHandler3 fclose fopen _errno strstr fgets fprintf sprintf atoi strncmp printf strncpy _snprintf ??0exception@std@@QEAA@AEBQEBDH@Z ?what@exception@std@@UEBAPEBDXZ ??1exception@std@@UEAA@XZ ??0exception@std@@QEAA@AEBV01@@Z _vsnprintf abort memmove toupper getc isprint strchr _write _get_osfhandle ferror fwrite _access __C_specific_handler _unlock _encode_pointer __dllonexit _lock _onexit _decode_pointer _amsg_exit __getmainargs _XcptFilter _exit _cexit exit __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crt_debugger_hook memset _purecall _strnicmp _isatty _fileno memcpy _getcwd

user32

CharLowerBuffA CharUpperBuffA

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA