e1b696026cfc581927223878ba84a848a106139a8c3479410099e128accedbb2

Sharing

Copy URL Twitter E-mail

General

Target

e1b696026cfc581927223878ba84a848a106139a8c3479410099e128accedbb2
Size

769KB
MD5

6617597fd8c65f4067f33fb070d26575
SHA1

9dd2e6478f5f1fcab8e1c9c298ec1e6ac10fb63e
SHA256

e1b696026cfc581927223878ba84a848a106139a8c3479410099e128accedbb2
SHA512

3cce0f9279ca2a0cadf23950ecaa7cf4bb043ca38b044f1adebfb81c79de8a459f6a8a06535536ac3253981beaf63f1bdf576ea306df4feaf7d0431f6bda16eb
SSDEEP

12288:0erHJGvML1rljs/34MxkmVKXQMa7NowRGvIm1ZCwVlZPxs:Brj1tMxkmVKXRazRGvZ1wQlpi

Score

N/A

Malware Config

Signatures

Files

e1b696026cfc581927223878ba84a848a106139a8c3479410099e128accedbb2
.dll windows x86

473914c20a133618d6b802e994dfafde

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
LoadLibraryA
GlobalSize
DeleteFileA
GetModuleFileNameA
GetModuleHandleA
GetTickCount
GetTempFileNameA
GetTempPathA
MulDiv
GetFullPathNameA
GetPrivateProfileIntA
WritePrivateProfileStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapSize
HeapReAlloc
FreeLibrary
GetProcAddress
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
CreateFileA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
SetUnhandledExceptionFilter
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
GetOEMCP
LocalAlloc
OpenFile
_lclose
GlobalReAlloc
LocalFree
_lwrite
GlobalAlloc
_lread
_llseek
GlobalHandle
GlobalLock
GlobalUnlock
ReadFile
SetEndOfFile
HeapFree
GetSystemTime
GetLocalTime
RtlUnwind
HeapAlloc
GetTimeZoneInformation
GetCommandLineA
GetVersion
RaiseException
HeapCreate
HeapDestroy
GetLastError
CloseHandle
WriteFile
SetFilePointer
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCPInfo
GlobalFree
GetACP

user32

LoadCursorA
SetCursor
GetActiveWindow
SetRect
PostMessageA
CopyRect
IntersectRect
LoadStringA
FillRect
InflateRect
ReleaseDC
GetDC
EnableWindow
GetClientRect
GetDlgItem
UpdateWindow
CheckRadioButton
wsprintfA
EndDialog
DialogBoxParamA
GetParent
SetFocus
SetActiveWindow
DestroyWindow
CreateDialogParamA
ShowWindow

gdi32

CreatePen
MoveToEx
GetStockObject
SelectObject
DeleteObject
LineTo
GetPaletteEntries
CreatePalette
GetObjectA

fineocrengine

_FineEngineDeinitialize@0
_FineEngineFree@4
_FineEngineGetApplication@8
_FineEngineInitialize@16

ocrutil

OCR_RecordVerLineInformation
OCR_RemoveHongKongCharacter
OCR_RemoveClassIICharacter
OCR_RecordHorLineInformation
IndexPatch
OCR_InitClassIIFilter
duplicate_block
get_average_chinese_size_of_subblock
rtf_record_free
rtf_record_alloc
DBCS
OCR_RecordSpaceInformation
mem_get_bank
Index_to_code
GetCodeParameter
OCR_fopen
OCR_fread
mem_bank_info
get_parameter_of_subblock
Code_to_index
mem_create_bank
OCR_GetProfileString
SetCodeParameter
close_code_converter
OCR_Timer
mem_init_bank
mem_close_bank
OCR_fwrite
OCR_remove
Code_to_index_for_train
copy_attribute
OCR_realloc
char_alloc
OCR_printf
line_alloc
char_free
line_free
word_alloc
word_free
cpnt_alloc
cpnt_free
block_alloc
OCR_malloc
OCR_free
subblock_alloc
set_attribute
OCR_fclose
CheckFreeDiskSpace
get_attribute
mem_free_bank
block_free
subblock_free
init_code_converter

recogn

close_oecr_system
recognize_one_character
cut_char_of_subblock
init_charing_system
close_charing_system
RegisterCutMarkCallbackFunc
close_recognizing_system
init_recognizing_system
init_oecr_system
recognize_solid_symbol_character
recognize_english_by_experts
RegisterRcgPercentCallbackFunc
recognize_kana_character
recognize_english_character
get_font_face_ID
train_remove_char
train_get_dbs
train_add_char
train_change_dbs
train_clear_dbs

segment

close_blocking_per_image
close_lining_system
cpnt_splite_small
seg_image_to_block
init_edit_block
close_blocking_system
RegisterSegPercentCallbackFunc
init_blocking_system
init_lining_system
get_page_dir_from_segmentation
Line_Post
end_edit_block
Get_Line_Fontsize
get_line_gap_from_segmentation
seg_cut_line
CreateBlockHead
cpnt_check_in
get_present_high
InitBlockParam
GetRegionSkewAngle
cpnt_adjust_word
cpnt_merge_word
analysis_style_of_window_method
analysis_style_of_window
adjacent

post

process_similar_character_per_sblk
process_alpha_numeric_per_sblk
process_similar_character
process_direction_of_hor_title
PostMark
calculate_capital_height_per_table_blk
process_capital_english_per_sblk
process_english_by_size
GetHiddenDictionary
GetUserDictionary
PostClose
GetRelationFromNeighborhood
RegisterPostPercentCallbackFunc
PostLoad
PostInit

Exports

Exports

AddNewCharacterToUserDataBase
BackupDocumentInfo
CalRegionSkewAngle
ChangeUserDataBase
ClassifySblkAfterRecogn
Create_Document
Create_Page
Create_PageInfo
Delete_Document
Delete_Page
Delete_PageInfo
DisablePccrPercentCallbackFunc
DiscardPreviousWork
DoCreateSblk
DoDeleteLine
DoDeleteSblk
DoMergeLine
DoMergeSblk
DoModifyLine
DoModifySblk
DoSplitLine
DoSplitSblk
EnablePccrPercentCallbackFunc
Exist_Document_Backup
FreeCardInformation
Free_RTF_info
GetCandidateAndRelationData
GetFieldIdentification
GetImageResolution
GetUserDataBaseInfomation
Get_Document_Info_Name
Get_PageInterName
Get_Temp_File_Name
ICR_deskewImage
ICR_despeckle_image
ICR_errno
ICR_flip_imageHorizontal
ICR_flip_imageVertical
ICR_free_attributeData
ICR_free_imagePolygonRegions
ICR_free_recognizedData
ICR_free_tableCells
ICR_get_attributeData
ICR_get_imageInfo
ICR_get_polygonByType
ICR_get_recognizedData
ICR_get_regionAttributeData
ICR_get_statistics
ICR_get_tableCells
ICR_get_totalTableNumber
ICR_get_versionId
ICR_imageDecomposition
ICR_init
ICR_invert_image
ICR_load_database
ICR_load_imageFile
ICR_readImage
ICR_readSingleLineImage
ICR_rotate_image
ICR_save_imageFile
ICR_save_textOutputFile
ICR_scale_image
ICR_scan_imageFile
ICR_scan_selectSource
ICR_set_codePage
ICR_set_dataType
ICR_set_dotMatrix
ICR_set_imageBufPointers
ICR_set_imageDecomposition
ICR_set_imageFile
ICR_set_imageModel
ICR_set_imageObjHandles
ICR_set_imageOrientation
ICR_set_imagePolygonRegions
ICR_set_imageRegions
ICR_set_imageResolution
ICR_set_imageWhiteBitValue
ICR_set_imageWidthLength
ICR_set_language
ICR_set_peekTextFunction
ICR_set_readMode
ICR_set_regionDataType
ICR_set_regionFLE
ICR_set_regionFormat
ICR_set_regionWordList
ICR_set_saveImageCallbackFunc
ICR_set_tempDirectory
ICR_set_textOutputFileName
ICR_set_textOutputFormat
ICR_set_textOutputLayout
ICR_set_unrecognizedChar
ICR_term
ICR_term_FR4
ImageOfDocumentSaved
PCCR_free_database_and_working_buffer
PCCR_load_database
PccrGetFileInfo
PccrOpenBinaryImage
PccrOpenGrayImage
PccrSaveBinaryImage
PccrSaveCsvFile
PccrSaveCurrentDocument
PccrSaveCurrentPage
PccrSaveHTMLFile
PccrSaveHTML_CSS2_File
PccrSaveRtfFile
PccrSaveSlkFile
PccrSaveTextFile
PccrSaveXlsFile
ProcessSinglePage
ReadDeferJob
Read_Page
Read_PageInfo
Read_RTF_info
RecogPage
RegisterPccrErrMsgCallbackFunc
RegisterPccrMarkCallbackFunc
RegisterPccrPercentCallbackFunc
RegisterPccrRcgWinCallbackFunc
RegisterPccrSaveImgCallbackFunc
RegisterPccrUpScrCallbackFunc
RemoveCharacterFromUserDataBase
RemoveDocumentInfo
RemoveUserDataBase
ReplacePageResultByPhrase
Reset_Document
Reset_Page
Reset_PageInfo
RestoreDocumentInfo
ResultOfDocumentSaved
SaveDeferJob
Save_Page
Save_PageInfo
SegmentPage
SpellingCheckPage
SpellingCheckPageByPhrase
UpdateErasedRegion
Write_RTF_info
_ICR_readBarcodeTest@16
_fioDecodeImg_BMP@24
_fioDecodeImg_PCT@24
_fioDecodeImg_PCX@24
_fioDecodeImg_TIF@24
_fioEncodeImg_PCX@20
_fioEncodeImg_TIF@20
_fioIsCorrectHeader_BMP@4
_fioIsCorrectHeader_PCT@4
_fioIsCorrectHeader_PCX@4
_fioIsCorrectHeader_TIF@4
_fioNeedReadOption_BMP@0
_fioNeedReadOption_PCT@0
_fioNeedReadOption_PCX@0
_fioNeedReadOption_TIF@0
_fioNeedSaveOption_BMP@0
_fioNeedSaveOption_PCT@0
_fioNeedSaveOption_PCX@0
_fioNeedSaveOption_TIF@0
_fioReadDIBImg_BMP@12
_fioReadDIBImg_PCT@12
_fioReadDIBImg_PCX@12
_fioReadDIBImg_TIF@12
_fioReadHeader_BMP@12
_fioReadHeader_PCT@12
_fioReadHeader_PCX@12
_fioReadHeader_TIF@12
_fioReadImg_BMP@8
_fioReadImg_PCT@8
_fioReadImg_PCX@8
_fioReadImg_TIF@8
_fioReadPalette_BMP@4
_fioReadPalette_PCT@4
_fioReadPalette_PCX@4
_fioReadPalette_TIF@4
_fioSaveDIBImg_BMP@12
_fioSaveDIBImg_PCT@12
_fioSaveDIBImg_PCX@12
_fioSaveDIBImg_TIF@12
_fioSaveData_BMP@16
_fioSaveData_PCT@16
_fioSaveData_PCX@16
_fioSaveData_TIF@16
_fioSaveHeader_BMP@16
_fioSaveHeader_PCT@16
_fioSaveHeader_PCX@16
_fioSaveHeader_TIF@16
_fioSaveImg_BMP@8
_fioSaveImg_PCT@8
_fioSaveImg_PCX@8
_fioSaveImg_TIF@8
_fioSavePalette_BMP@8
_fioSavePalette_PCT@8
_fioSavePalette_PCX@8
_fioSavePalette_TIF@8
_fioSetReadOption_BMP@4
_fioSetReadOption_PCT@4
_fioSetReadOption_PCX@4
_fioSetReadOption_TIF@4
_fioSetSaveOption_BMP@4
_fioSetSaveOption_PCT@4
_fioSetSaveOption_PCX@4
_fioSetSaveOption_TIF@4
_fioSetWaitingCallback@4
erase_and_recognize
free_grid_rect_info
merge_and_recognize
obtain_grid_rect_info
process_inline_English_character
reset_working_space
split_and_recognize

Sections

.text
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 164KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

473914c20a133618d6b802e994dfafde

Headers

File Characteristics

Imports

kernel32

user32

gdi32

fineocrengine

ocrutil

recogn

segment

post

Exports

Exports

Sections

.text Size: 411KB - Virtual size: 411KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 159KB - Virtual size: 198KB

.idata Size: 6KB - Virtual size: 6KB

.reloc Size: 17KB - Virtual size: 16KB

.text Size: 164KB - Virtual size: 168KB

.text
Size: 411KB - Virtual size: 411KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 159KB - Virtual size: 198KB

.idata
Size: 6KB - Virtual size: 6KB

.reloc
Size: 17KB - Virtual size: 16KB

.text
Size: 164KB - Virtual size: 168KB