db_usa[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
db_usa.exe
Size 1.0MB
Sample260816-bgs7eaae78
SHA256 262d3cba2c08e2339ccd7f12967a173b427b82b4dd7bf8dce0dd453a5d4d8ae6
MD5 bd2810dbd84949e4fa9e69225e0f62fa
SHA1 4df0bada5c0ffd836d4435516023fa6e18946de5
SHA512 a060e4d9d0444e4a60912fc81a532542d56531fd4d85fd6f806c82af4812cfd4300ed0fdcb7d67a2a327c85b2c9490a41586250c8a5df4ae7d47f57c331430bd
SSDEEP 24576:SJTyKfZqMXoQ6dD5DfLlkvqUnUA6TeWvp2nPTg0rd57:S0KfZSlfqvzUA6zvSTPrdB
TLSH
T107359EC1E68181F9D9E1547040BBBBAACD346B6913285DD397B02FB15960FF1AD3838E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db_usa.exe

File Explorer

db_usa.exe

.exe 1.0MB

db_usa.exe

IMPHASH c05790a818f493025beab559a3de7a15
SHA256 262d3cba2c08e2339ccd7f12967a173b427b82b4dd7bf8dce0dd453a5d4d8ae6
MD5 bd2810dbd84949e4fa9e69225e0f62fa
SHA1 4df0bada5c0ffd836d4435516023fa6e18946de5
SHA512 a060e4d9d0444e4a60912fc81a532542d56531fd4d85fd6f806c82af4812cfd4300ed0fdcb7d67a2a327c85b2c9490a41586250c8a5df4ae7d47f57c331430bd
SSDEEP 24576:SJTyKfZqMXoQ6dD5DfLlkvqUnUA6TeWvp2nPTg0rd57:S0KfZSlfqvzUA6zvSTPrdB
TLSH
T107359EC1E68181F9D9E1547040BBBBAACD346B6913285DD397B02FB15960FF1AD3838E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

782558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize DeleteFileA HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar EnterCriticalSection DeleteCriticalSection lstrlenA WideCharToMultiByte GetSystemInfo CreateMutexA IsDebuggerPresent GetVersionExA GetExitCodeThread ReleaseMutex ResumeThread GetVersion GetThreadPriority GetModuleHandleA VirtualAlloc CreateSemaphoreA DuplicateHandle VirtualFree ReleaseSemaphore LoadLibraryA MulDiv CreateFileW SetEndOfFile SetEnvironmentVariableA CompareStringW WriteConsoleW GetLastError GetStringTypeW FlushFileBuffers Sleep InterlockedExchange FreeLibrary SetStdHandle LCMapStringW GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetConsoleMode GetConsoleCP WriteFile IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent GetCurrentThread InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc GetTimeZoneInformation GetFileType GetStdHandle SetThreadAffinityMask WaitForMultipleObjects CreateEventA GetVolumeInformationA GetDriveTypeA GetTickCount GetModuleFileNameA SetThreadPriority TerminateThread HeapSize ResetEvent SetEvent WaitForSingleObject CloseHandle FindNextFileA FindClose GetFullPathNameA GetLongPathNameA FindFirstFileA SetHandleCount GetCurrentProcess TerminateProcess EncodePointer SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount HeapCreate RaiseException RtlUnwind DecodePointer ExitProcess GetModuleHandleW GetProcAddress ReadFile SetFilePointer CreateFileA LoadLibraryW HeapReAlloc GetStartupInfoW HeapSetInformation GetCommandLineA CreateThread GetCurrentThreadId ExitThread GetSystemTimeAsFileTime

user32

PostMessageA SendMessageA wsprintfA GetDlgItem MessageBoxA PostThreadMessageA SetActiveWindow GetWindowRect GetCursorPos SetCursorPos DialogBoxParamA GetQueueStatus MsgWaitForMultipleObjects RegisterWindowMessageA GetClientRect EnumDisplaySettingsA GetForegroundWindow GetSystemMetrics LoadStringA DestroyWindow RegisterClassExA SetForegroundWindow LoadIconA SetRect SetWindowLongA CreateWindowExA GetDesktopWindow AdjustWindowRect FindWindowA GetDC ReleaseDC GetMessageA GetClassNameA EnumWindows TranslateAcceleratorA EndPaint LoadCursorA SetCursor SetFocus BeginPaint TranslateMessage ShowCursor GetWindowTextA PeekMessageA EndDialog DefWindowProcA GetSysColor SetWindowPos ShowWindow DispatchMessageA SetWindowTextA UpdateWindow EnableWindow

gdi32

BitBlt DeleteDC CreateDIBSection CreateCompatibleDC SetTextColor SetBkColor Rectangle GetStockObject CreateFontIndirectA DeleteObject SelectObject GetGlyphOutlineA GetTextMetricsA GetDeviceCaps

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoTaskMemAlloc CoFreeUnusedLibraries CoTaskMemFree CoInitialize CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeKillEvent timeGetTime timeSetEvent

ddraw

DirectDrawCreate

dsound

ord11

d3d9

Direct3DCreate9

d3dx9_42

D3DXMatrixMultiply D3DXMatrixScaling D3DXQuaternionMultiply D3DXMatrixInverse D3DXCreateTexture D3DXMatrixPerspectiveFovRH D3DXMatrixTranslation D3DXMatrixRotationQuaternion D3DXQuaternionRotationAxis

imagehlp

MakeSureDirectoryPathExists

generic

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=7, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=152, version=20115,

count=52, id=158, productName=VS2010 build 30319, version=30319,

count=159, id=170, productName=VS2010 build 30319, version=30319,

count=1, id=29, version=9178,

count=6, id=25, version=9210,

count=49, id=171, productName=VS2010 build 30319, version=30319,

count=22, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=234, id=1, productName=Unmarked objects,

count=97, id=175, version=30319,

count=1, id=154, productName=VS2010 build 30319, version=30319,

count=1, id=157, productName=VS2010 build 30319, version=30319,