sqlquerytool.zip
- SHA256 d1ba9938e087f32c1aca43a06a6d595590638ae377324e5bde472fda70cf3207
Behavioral task
behavioral1
Sample
sqlquerytool-3.9.2.8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target sqlquerytool.zip
- Size 19.2MB
- Sample260930-fxl59avybz
- SHA256 d1ba9938e087f32c1aca43a06a6d595590638ae377324e5bde472fda70cf3207
- MD5 4ce78ba2f3b8368c32c71ce4f3153488
- SHA1 b6dfb613f76d588914b5ebbcaecaf9a7fff01392
- SHA512 febc2baac9190454e606df89f0e2df06ea3bc11ed7cfa3779d6f01532b8f2dbdd663b96fb70bd095e811c328d8af070ff24fa5eddd7e0ba9290eb5e29e8b2430
- SSDEEP 393216:mtEs3CNqSTaENy2HzR808Eodl0YpG0zpyFHRX:mMTaENyWRD3k1Ryz
- TLSH T16B17333FB269613EC56E477644B392509C3BBA25A91ECC2F07F4091CCF369B01E3AA55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/sqlquerytool-3.9.2.8.exe innosetup
File Explorer
-
sqlquerytool.zip.zip 19.2MB
-
sqlquerytool-3.9.2.8.exe.exe 19.2MB
sqlquerytool-3.9.2.8.exe
- IMPHASH 5a594319a0d69dbc452e748bcf05892e
- SHA256 7061ab6beae1bb2f54754797a08adaa98e98b29c435c4a7cbbb48b45e1b75633
- MD5 0a9b1141d8f733a931cb3bccc9c8a5ca
- SHA1 dbae61b6c6026dea37ea0910defee85f80123458
- SHA512 b1344f7842f96a8aa1f8eec72532768628aeedd605f91fc5ac5a6feef116116a3136fdbaaa4d9a3891fa9f3bc9e399e8dd2229df3b78d28f075815bbab142e31
- SSDEEP 393216:CtEs3CNqSTaENy2HzR808Eodl0YpG0zpyFHRn:CMTaENyWRD3k1Ryj
- TLSH T16817333FB269613EC56E477644B392509C3BBA25A91ECC2F07F4091CCF369B01E3AA55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
9d:e1:ea:df:48:66:70:b0:41:a4:1a:49:bc:85:04:73:7b:8b:f5:fc:1c:ac:11:f7:d1:64:6b:16:ec:d3:46:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Active Database Software,O=Active Database Software,POSTALCODE=454001,STREET=d. 5 ofis 196\, ul. 250-Letiya Chelyabinska,L=Chelyabinsk,ST=Chelyabinskaya oblast,C=RU
Chains
Nov 19, 2021
CN=Active Database Software,O=Active Database Software,POSTALCODE=454001,STREET=d. 5 ofis 196\, ul. 250-Letiya Chelyabinska,L=Chelyabinsk,ST=Chelyabinskaya oblast,C=RU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Active Database Software,O=Active Database Software,POSTALCODE=454001,STREET=d. 5 ofis 196\, ul. 250-Letiya Chelyabinska,L=Chelyabinsk,ST=Chelyabinskaya oblast,C=RU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Active Database Software,O=Active Database Software,POSTALCODE=454001,STREET=d. 5 ofis 196\, ul. 250-Letiya Chelyabinska,L=Chelyabinsk,ST=Chelyabinskaya oblast,C=RU
Serial Number
4c:50:5a:28:cd:a5:5d:9a:0e:43:bb:7c:75:f1:a8:21
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 2, 2020 - Oct 2, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
745196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
718KB
Virtual Size
717KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ