odd_wip[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

odd_wip.exe
Size

3.8MB
MD5

1d1640ddbb872278e674b66eb38b1285
SHA1

09c49e479fe1482f7409c47036a234893db186f8
SHA256

5e21106693518fab185d01779f53ca859bc1ebae33dc96d94e6571507f5557f8
SHA512

95b9f7ce3e1a23e1d03a4e2c178d20c0229226ea978f3db3fa23efcf4bb2cf3a86398df4d2f445e13c07db47a6e40a7564d4bf45ea75f59fa154f9cb9dea92fa
SSDEEP

98304:ZBJjq7HKVN6IobjbP98wR1DmN1IA5JzlF9v2boqusXxYcn81fFtHcdd5KPCov1ZE:ZBJCKVN6IobjbP51DFGrQhYcn81fFtHt

Score

N/A

Malware Config

Signatures

Files

odd_wip.exe
.exe windows x86

1b7caa3439b8d3ba163aae22d2217a0a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

cvirte

AddCVITimeIntervals
AddCtrlToSplitter
AddGraphAnnotation
AddPanelToSplitter
AddToCVIAbsoluteTime
AddToFilePopupDirHistory
AddTreeImage
AdviseDDEDataReady
AllocBitmapDataEx_WithAlloc
AllocBitmapData_WithAlloc
AllocImageBits_WithAlloc
ApplyRTSystemImage
AreTreeItemsRelated
ArrayToFile
BeingDebuggedByCVI
Breakpoint
BroadcastDDEDataReady
CVIAbsoluteTimeFromLocalCalendar
CVIAbsoluteTimeFromTimeUnit
CVIAbsoluteTimeToLocalCalendar
CVIAbsoluteTimeToTimeUnit
CVIAssert
CVIDynamicMemoryInfo
CVILowLevelSupportDriverLoaded
CVIProfGetCurrentThreadProfiling
CVIProfSetCurrentThreadProfiling
CVIRTDllAbnormalExit
CVITimeIntervalFromSeconds
CVITimeIntervalFromTimeUnit
CVITimeIntervalToFractionalUnitTime
CVITimeIntervalToSeconds
CVITimeIntervalToTimeUnit
CVIUSTEdiscardtimer
CVIUSTEgetpriority
CVIUSTEinitialize
CVIUSTElocaltime
CVIUSTEnewtimer
CVIUSTEresolution
CVIUSTEsetpriority
CVIUSTEsettimer
CVI_Beep
CVI_CloseFile
CVI_CopyFile
CVI_DeleteFile
CVI_GetFileSize
CVI_GetFileTime
CVI_GetSystemTime
CVI_OpenFile
CVI_ReadFile
CVI_SetCommitMode
CVI_SetFileTime
CVI_SetSystemTime
CVI_WriteFile
CVI__getmbcp
CVI__ismbblead
CVI__mbsbtype
CVI__mbscat
CVI__mbschr
CVI__mbscmp
CVI__mbscpy
CVI__mbscspn
CVI__mbsdec
CVI__mbsicmp
CVI__mbsinc
CVI__mbslen
CVI__mbsnbcat
CVI__mbsnbcmp
CVI__mbsnbcpy
CVI__mbsnbicmp
CVI__mbspbrk
CVI__mbsrchr
CVI__mbsspn
CVI__mbsstr
CVI__mbstok
CVI__putenv
CVI_atoi64
CVI_atoll
CVI_inp
CVI_inpd
CVI_inpw
CVI_llabs
CVI_lldiv
CVI_outp
CVI_outpd
CVI_outpw
CVI_strtoimax
CVI_strtol64
CVI_strtoll
CVI_strtoul64
CVI_strtoull
CVI_strtoumax
CanvasClear
CanvasDefaultPen
CanvasDimRect
CanvasDrawArc
CanvasDrawBitmap
CanvasDrawLine
CanvasDrawLineTo
CanvasDrawOval
CanvasDrawPoint
CanvasDrawPoly
CanvasDrawRect
CanvasDrawRoundedRect
CanvasDrawText
CanvasDrawTextAtPoint
CanvasEndBatchDraw
CanvasGetClipRect
CanvasGetPenPosition
CanvasGetPixel
CanvasGetPixels
CanvasInvertRect
CanvasScroll
CanvasSetClipRect
CanvasSetPenPosition
CanvasStartBatchDraw
CanvasUpdate
CheckForDuplicateAppInstance
CheckListItem
ClearAxisItems
ClearCtrlArray
ClearDigitalGraph
ClearFilePopupDirHistory
ClearLegend
ClearListCtrl
ClearStatusBar
ClearStatusBarCellList
ClearStripChart
ClientDDEExecute
ClientDDERead
ClientDDEWrite
ClientTCPRead
ClientTCPWrite
ClipboardGetBitmap
ClipboardGetTableVals
ClipboardGetText_WithAlloc
ClipboardPutBitmap
ClipboardPutTableVals
ClipboardPutText
CloseCVIRTDll
CloseCom
CloseWinsock
Cls
CmtDiscardLock
CmtDiscardTSQ
CmtDiscardTSV
CmtDiscardThreadLocalVar
CmtDiscardThreadPool
CmtExitThreadPoolThread
CmtFlushTSQ
CmtGetCurrentThreadID
CmtGetCurrentThreadPriority
CmtGetErrorMessage
CmtGetLock
CmtGetLockAttribute
CmtGetLockEx
CmtGetMainThreadID
CmtGetNumProcessors
CmtGetTSQAttribute
CmtGetTSQAttributeEx
CmtGetTSQReadPtr
CmtGetTSQWritePtr
CmtGetTSVPtr
CmtGetThreadLocalVar
CmtGetThreadPoolAttribute
CmtGetThreadPoolFunctionAttribute
CmtInstallTSQCallback
CmtInstallThreadPoolCallback
CmtNewLock
CmtNewTSQ
CmtNewTSV
CmtNewThreadLocalVar
CmtNewThreadPool
CmtPreAllocThreadPoolThreads
CmtReadTSQData
CmtReleaseLock
CmtReleaseTSQReadPtr
CmtReleaseTSQWritePtr
CmtReleaseTSVPtr
CmtReleaseThreadPoolFunctionID
CmtScheduleThreadPoolFunction
CmtScheduleThreadPoolFunctionAdv
CmtSetCurrentThreadPriority
CmtSetTSQAttribute
CmtSetTSV
CmtSetThreadPoolAttribute
CmtTerminateThreadPoolThread
CmtTryToGetLock
CmtUninstallTSQCallback
CmtUninstallThreadPoolCallback
CmtWaitForThreadPoolFunctionCompletion
CmtWaitForThreadPoolFunctionCompletionEx
CmtWriteTSQData
ColorRGBSelectPopup
ComBreak
ComFromFile
ComRd
ComRdByte
ComRdTerm
ComSetEscape
ComToFile
ComWrt
ComWrtByte
CommitChangesToRTSystem
CompareBytes
CompareCVIAbsoluteTimes
CompareCVIAbsoluteTimesWithTolerance
CompareCVITimeIntervals
CompareCVITimeIntervalsWithTolerance
CompareStrings
ConfigurePrinter
ConfigureProcessorPool
ConfirmPopup
ConnectToDDEServer
ConnectToTCPServer
ConnectToTCPServerEx
ConvertUICoordinates
CopyBytes
CopyString
CopyTabPage
CopyTreeItem
CreateMetaFont
CreateMetaFontEx
CreateMetaFontWithCharacterSet
CreateRTSystemImage
CreateUDPChannel
CreateUDPChannelConfig
CurrThreadId
DOSColorToRGB
DOSCompatWindow
DSBindCtrl
DSBindPlot
DSBindTableCellRange
DSGetBoundPlotID
DSUnbind
DateStr
DebugPrintf
DecrementCVIAbsoluteTime
DecrementCVITimeInterval
DefaultCtrl
DefaultPanel
Delay
DeleteAxisItem
DeleteCtrlArrayItem
DeleteDir
DeleteGraphAnnotation
DeleteGraphPlot
DeleteImage
DeleteListItem
DeleteStatusBarCellListItem
DeleteTabPage
DeleteTableCellRangeRingItems
DeleteTableCellRingItems
DeleteTableColumns
DeleteTableRows
DeleteTextBoxLine
DeleteTextBoxLines
DeleteTreeCellRingItems
DeleteTreeColumn
DirSelectPopup
DirSelectPopupEx
DisableBreakOnLibraryErrors
DisableInterrupts
DisableLoadExternalModuleUndefSymPrompt
DisableTaskSwitching
DiscardAllUserInterfaceObjects
DiscardBitmap
DiscardCtrl
DiscardCtrlArray
DiscardCtrlMenuItem
DiscardMenu
DiscardMenuBar
DiscardMenuItem
DiscardNumericColorRamp
DiscardPanel
DiscardStatusBar
DiscardStatusBarCell
DiscardSubMenu
DisconnectFromDDEServer
DisconnectFromTCPServer
DisconnectTCPClient
DisplayImageFile
DisplayPCXFile
DisplayPanel
DisposeAllUDPChannels
DisposeRTSystemInfo
DisposeUDPChannel
DivideCVITimeInterval
DuplicateBitmap
DuplicateCtrl
DuplicatePanel
DuplicatePanelTree
EmptyMenu
EmptyMenuBar
EnableBreakOnLibraryErrors
EnableEventQueuing
EnableEventQueuingForPanel
EnableInterrupts
EnablePrivateEventsForPanel
EnableTaskSwitching
EnterAsyncCallback
ErrorPrintf
ExecutableHasTerminated
ExitAsyncCallback
FakeKeystroke
FileSelectPopup
FileSelectPopupEx
FileToArray
FillBytes
FillTableCellRange
FindAllRTSystemsOnSubnet
FindPattern
FlushInQ
FlushOutQ
Fmt
FmtFile
FmtOut
FontSelectPopup
FontSelectPopupEx
FormatDateTimeString
FormatRTSystem
FreeRTUtilMemory
FreeTableValStrings
GenericMessagePopup
Get387CW
Get3dBorderColors
GetActiveCtrl
GetActiveGraphCursor
GetActiveLegendItem
GetActivePanel
GetActiveStatusBar
GetActiveTabPage
GetActiveTableCell
GetActiveTreeCell
GetActiveTreeItem
GetActiveXCtrlFromObjHandle
GetAllTCPHostAddresses
GetAnnotationAttribute
GetAnnotationIndexFromCaption
GetAxisItem
GetAxisItemLabelLength
GetAxisRange
GetAxisScalingMode
GetAxisTimeFormat
GetBitmapData
GetBitmapDataEx
GetBitmapFromFile
GetBitmapFromFileEx
GetBitmapFromHIcon
GetBitmapInfo
GetBitmapInfoEx
GetBreakOnFirstChanceExceptions
GetBreakOnLibraryErrors
GetBreakOnProtectionErrors
GetCVILogOutputFormat
GetCVILogReportingLevels
GetCVILogTimingHandle
GetCVIVersion
GetCVIVersionYear
GetCVIWindowHandle
GetCVIWindowHandleForCurrThread
GetCheckedItemAreaWidth
GetComConnectionState
GetComLineStatus
GetComStat
GetCtrlArrayBoundingRect
GetCtrlArrayFromResourceID
GetCtrlArrayIndex
GetCtrlArrayItem
GetCtrlArrayPanel
GetCtrlAttribute
GetCtrlBitmap
GetCtrlBoundingRect
GetCtrlDisplayBitmap
GetCtrlIndex
GetCtrlMenuAttribute
GetCtrlVal
GetCtrlValString
GetCurrentCVIAbsoluteTime
GetCurrentDateTime
GetCurrentPlatform
GetCursorAttribute
GetDDEErrorString
GetDateTimeElements
GetDir
GetDrive
GetEnableResourceTracking
GetExportedNamesFromBinaryFile
GetExternalModuleAddr
GetExternalModuleAddrEx
GetFileAttrs
GetFileDate
GetFileInfo
GetFilePopupDirHistory_WithAlloc
GetFirstFile
GetFmtErrNdx
GetFmtIOError
GetFmtIOErrorString
GetFontTypefaceName
GetFontTypefaceNameLength
GetFullPathFromProject
GetGlobalMouseState
GetGraphCoordsFromPoint
GetGraphCursor
GetGraphCursorIndex
GetHostTCPSocketHandle
GetImageBits
GetImageInfo
GetInQLen
GetIndexFromPoint
GetIndexFromValue
GetInstalledFileVersion
GetInstalledFilenames
GetInterruptState
GetKey
GetKeyPressEventCharacter
GetKeyPressEventModifiers
GetKeyPressEventVirtualKey
GetLabelFromIndex
GetLabelLengthFromIndex
GetLedState
GetLegendItemFromPoint
GetListItemImage
GetMainCallback
GetMenuBarAttribute
GetMenuId
GetMenuIdByString
GetMenuItemId
GetMenuItemIdByString
GetModuleDir
GetMonitorAttribute
GetMonitorFromPanel
GetMonitorFromPoint
GetMonitorFromRect
GetMouseCursor
GetNextFile
GetNumAxisItems
GetNumCheckedItems
GetNumCtrlArrayItems
GetNumImagesInFile
GetNumLegendItems
GetNumListItems
GetNumMenuItems
GetNumTabPages
GetNumTableCellRingItems
GetNumTableColumns
GetNumTableRows
GetNumTextBoxLines
GetNumTreeCellRingItems
GetNumTreeColumns
GetNumTreeItems
GetNumericColorRamp
GetObjHandleFromActiveXCtrl
GetOutQLen
GetOwnerOfMenuObject
GetPanelAttribute
GetPanelDisplayBitmap
GetPanelEventRect
GetPanelHandleFromTabPage
GetPanelMenuBar
GetPersistentVariable
GetPlotAttribute
GetPrintAttribute
GetProjectDir
GetRS232ErrorString
GetRTFileAPIErrorString
GetRTModuleAddr
GetRTSystemInfo
GetRTUtilErrorString
GetRealFontTypefaceName
GetRealFontTypefaceNameLength
GetRelativeMouseState
GetRingItemAttribute
GetScaledCtrlDisplayBitmap
GetScaledPanelDisplayBitmap
GetScalingFactorsForPrintJob
GetScreenSize
GetSharedMenuBarEventPanel
GetSleepPolicy
GetStatusBarAndCellIndexFromCtrl
GetStatusBarAttribute
GetStatusBarCellAttribute
GetStatusBarCellBitmap
GetStatusBarCellListIndex
GetStatusBarCellNumListItems
GetStatusBarCellVal
GetStdioPort
GetStdioWindowOptions
GetStdioWindowPosition
GetStdioWindowSize
GetStdioWindowVisibility
GetSubMenuId
GetSwitchState
GetSystemAttribute
GetSystemComHandle
GetSystemDate
GetSystemPopupsAttribute
GetTCPErrorString
GetTCPHostAddr
GetTCPHostConnectionAddr
GetTCPHostName

ateapi

AteBoardGetArmSn
AteBoardGetArmVer
AteBoardGetC51Sn
AteBoardGetC51Ver
AteIicRandomRead
AteSffGetFlt
AteSffGetIrx
AteSffGetItx
AteSffGetLos
AteSffGetTsd
AteSffGetV33
AteSffPowerOff
AteSffPowerOn
AteSffSetBen
AteSffSetVout
AteSfpGetIrx
AteSfpGetItx
AteSfpGetLos
AteSfpGetV33
AteSfpPowerOff
AteSfpPowerOn
AteSfpSetDis
AteSfpSetRst
AteSfpSetVout
AteShortINLSet
AteShortSELSet

ch341a_dll

GetF320SerialNumber
I2C_BYTEs_READ_DLL
I2C_HOST_INITIALIZATION_DLL_TSUHAN
I2C_SLAVE_SEARCH_DLL
SetF320I2CRate_DLL

cvidll

USB_CP2112_SetGpioLatch
USB_Config
USB_GetNumDevices
USB_GetSerialString
USB_Get_DeviceInfo
USB_IIC_4BytesWrite
USB_IIC_ByteWrite
USB_IIC_BytesRead
USB_IIC_BytesWrite
USB_IIC_SearchSlave
USB_Set_IICChannel
USB_Set_IIC_Channel
USB_Set_UsbGlobals
MyDLLCheckSN
MyDLLGetEVBSN
MyDLLGetSystemDate
MyDLLGetUSBSN
MyDLL_DB_Init
MyDLL_GetDateTime
MyDLL_License_Check
MyDLL_TRIM
ProcessFrameData
SFF8436_Select_Page
SFF8472GetModuleSN
SFF8472SelA2Page
SFF8472SelPage
SFF8472SetModulePassword
USB_CP2112_SetGpioConfig

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetLastError
GetModuleFileNameA
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
ReleaseMutex
SetLastError
TlsGetValue
WaitForSingleObject
DebugBreak
GetComputerNameA
GetCurrentThreadId
GetDiskFreeSpaceA
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleW
GetSystemDirectoryA
GetUserDefaultLCID
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
InterlockedExchange
IsDebuggerPresent
LoadLibraryW
OutputDebugStringA
Sleep
ExitProcess
OpenMutexA
LocalAlloc
LocalFree
lstrlenA
GetCurrentProcess
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter

tcl86

Tcl_CreateInterp
Tcl_DeleteInterp
Tcl_Eval
Tcl_EvalFile
Tcl_FindExecutable
Tcl_Init
Tcl_InterpDeleted

user32

wsprintfA
CallWindowProcA
CreatePopupMenu
DefWindowProcA
DestroyIcon
DestroyMenu
GetCursorPos
GetDC
GetIconInfo
GetKeyboardType
GetMenuDefaultItem
GetMenuItemCount
GetMenuItemInfoA
GetSysColor
GetWindowLongA
InsertMenuItemA
LoadImageA
PostMessageA
SetForegroundWindow
SetMenuDefaultItem
SetMenuItemInfoA
SetWindowLongA
SystemParametersInfoA
TrackPopupMenu

advapi32

GetUserNameA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA

gdi32

DeleteDC
DeleteObject
GetDIBits

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 425KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.db_fram
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.db_info
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.db_abbv
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.db_line
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.db_pnam
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.db_ptyp
Size: 1024B - Virtual size: 651B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.db_ref
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

_data
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_text
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b7caa3439b8d3ba163aae22d2217a0a

Headers

DLL Characteristics

File Characteristics

Imports

cvirte

ateapi

ch341a_dll

cvidll

kernel32

tcl86

user32

advapi32

gdi32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.data Size: 425KB - Virtual size: 425KB

.db_fram Size: 15KB - Virtual size: 15KB

.db_info Size: 257KB - Virtual size: 256KB

.db_abbv Size: 5KB - Virtual size: 5KB

.db_line Size: 133KB - Virtual size: 132KB

.db_pnam Size: 27KB - Virtual size: 27KB

.db_ptyp Size: 1024B - Virtual size: 651B

.db_ref Size: 5KB - Virtual size: 4KB

.rdata Size: 5KB - Virtual size: 4KB

.bss Size: - Virtual size: 2.1MB

.idata Size: 57KB - Virtual size: 56KB

.debug Size: 76KB - Virtual size: 75KB

_data Size: 512B - Virtual size: 10B

_text Size: 512B - Virtual size: 444B

.rsrc Size: 300KB - Virtual size: 299KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 425KB - Virtual size: 425KB

.db_fram
Size: 15KB - Virtual size: 15KB

.db_info
Size: 257KB - Virtual size: 256KB

.db_abbv
Size: 5KB - Virtual size: 5KB

.db_line
Size: 133KB - Virtual size: 132KB

.db_pnam
Size: 27KB - Virtual size: 27KB

.db_ptyp
Size: 1024B - Virtual size: 651B

.db_ref
Size: 5KB - Virtual size: 4KB

.rdata
Size: 5KB - Virtual size: 4KB

.bss
Size: - Virtual size: 2.1MB

.idata
Size: 57KB - Virtual size: 56KB

.debug
Size: 76KB - Virtual size: 75KB

_data
Size: 512B - Virtual size: 10B

_text
Size: 512B - Virtual size: 444B

.rsrc
Size: 300KB - Virtual size: 299KB