f9eef0a9013e81a11067af93397971844d217f012cb6cff5078aea8eb9ef7a96

Sharing

Copy URL Twitter E-mail

General

Target

f9eef0a9013e81a11067af93397971844d217f012cb6cff5078aea8eb9ef7a96
Size

147KB
MD5

130628d1b6fd6b477acc9e1e76fb0660
SHA1

b2aecfda9f118f5859e1bbbaf8751f854529f309
SHA256

f9eef0a9013e81a11067af93397971844d217f012cb6cff5078aea8eb9ef7a96
SHA512

89859ab83c31a11a1cbfc966755357d38992370767383da41a646e6e34dc55bb44888caa4e258e38a90dc577821ec45c623a108fd27deed00ca0b8643de742ea
SSDEEP

3072:NfNLCWnH7ooT0Xv++pzb6B9VY+nu6f0szqAeAFDk:JHEoIfb6BLdD04e2D

Score

N/A

Malware Config

Signatures

Files

f9eef0a9013e81a11067af93397971844d217f012cb6cff5078aea8eb9ef7a96
.exe windows x86

641768fec1879976ca13acf338103f87

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hcreg8

?GetCompanyName@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
hcreg_SetErrorHandler
?GetProgramName@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
_DoHtmlHelp
?GetProductName@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetPMPDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
SetAppKey
?GetPlotStylesDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetLogFileDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetDriverDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ

plotcfg8

?SPMP@@YAPAVHT_SPMem_Pool@@XZ

plcfmgr

??0HT_Plot_Config_Manager@@QAE@AAVHT_String@@00V?$HT_Smart_Pointer@VHT_Error_Handler@@@@K@Z
?load_pc3@HT_Plot_Config_Manager@@QAE?AV?$HT_Smart_Pointer@VHT_Plot_Config@@@@VHT_String@@_N@Z
?load_pc3@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@PBD0@Z
?delete_path@HT_Plot_Config_Manager@@QAE_NPBD@Z
?get_property_from_pm@HT_Plot_Config_Manager@@QAE_NPBD0AA_N@Z
?get_property_from_pm@HT_Plot_Config_Manager@@QAE_NPBD0AAJ@Z

heidi8

??1HT_String@@UAE@XZ
??3HT_String@@SAXPAX@Z
??0HT_String@@QAE@PBD@Z
?copy@HT_String@@QAEXPBD@Z
?concatenate@HT_String@@QAEXPBD@Z
??2HT_Object@@SAPAXI@Z
??3HT_Object@@SAXPAX@Z
??0HT_String@@QAE@ABV0@@Z
?copy@HT_String@@QAEXABV1@@Z

pc3edit

SavePC3
EndPC3Dialog
PC3EditEx

apperr

HD_Create_App_Error_Handler

userdata

?InstallUserData@@YGIXZ

adui16

??1CERutil@@UAE@XZ
??0CERutil@@QAE@XZ
?setTheCERutil@CERutil@@SA_NPAV1@@Z
?makeBuildVersion@CERutil@@UAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HHHH@Z
?makeRegistryVersion@CERutil@@UAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z
?getVersionNumber@CERutil@@UAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PADAAH111@Z
?getInstalledProductKey@CERutil@@UBE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?getInstalledProductName@CERutil@@UBE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ

mfc70

ord1097
ord4996
ord2232
ord2356
ord2546
ord2648
ord4088
ord2529
ord2359
ord2463
ord2352
ord3522
ord3523
ord3513
ord2461
ord3751
ord3452
ord4929
ord4058
ord4944
ord2094
ord1765
ord4977
ord2432
ord4790
ord4793
ord4046
ord3747
ord576
ord4090
ord3917
ord2747
ord4685
ord2021
ord1178
ord832
ord5126
ord2800
ord2254
ord2253
ord3819
ord1409
ord341
ord3271
ord1077
ord257
ord705
ord977
ord1081
ord5669
ord1472
ord1469
ord4267
ord1273
ord4025
ord1760
ord4854
ord5989
ord3966
ord3208
ord4503
ord1452
ord5714
ord812
ord817
ord821
ord819
ord823
ord2239
ord2223
ord2242
ord2237
ord2214
ord2216
ord2234
ord2026
ord2675
ord2020
ord1377
ord5993
ord3610
ord5991
ord3152
ord4748
ord1234
ord1814
ord1508
ord1507
ord1451
ord4972
ord703
ord534
ord280
ord2651
ord4262
ord4042
ord957
ord256
ord1051
ord982
ord493
ord3832
ord3487
ord698
ord3814
ord4998
ord4349
ord5322
ord2096
ord5992
ord3609
ord5990
ord4107
ord1913
ord1868
ord5339
ord3614
ord4997
ord4900
ord899
ord4883
ord848
ord5933
ord5152
ord3640
ord512
ord3140
ord1014
ord947
ord1770
ord2741
ord2244
ord3750
ord5002
ord4985
ord663
ord5208
ord5472
ord476
ord956
ord2201
ord3449
ord4045
ord4263
ord4347
ord2431
ord2438
ord5952
ord1866
ord1901
ord557
ord4935
ord5348
ord1251
ord5178
ord2555
ord5255
ord4038
ord4633
ord4520
ord4486
ord1772
ord4003
ord2848
ord2581
ord5688
ord5791
ord314
ord3255
ord3486
ord4932
ord4953
ord4054
ord3151
ord1233
ord697
ord4225
ord4224
ord4571
ord3985
ord4562
ord4761
ord3953
ord3962
ord4372
ord4558
ord4167
ord4182
ord4180
ord4162
ord4165
ord4160
ord4645
ord4642
ord3776
ord511
ord3395
ord3748
ord4986
ord4063
ord5007
ord5005
ord2219
ord2229
ord2227
ord2225
ord2221

msvcr70

_setmbcp
_CxxThrowException
_purecall
vsprintf
memmove
strtok
_getcwd
_vscprintf
_splitpath
__CxxFrameHandler
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

kernel32

WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetModuleHandleA
lstrcpyA
LocalFree
LockResource
LoadLibraryA
FindClose
GlobalGetAtomNameA
GetLastError
SizeofResource
FormatMessageA
GlobalAddAtomA
LoadResource
FreeLibrary
FindResourceA
GlobalDeleteAtom
GetVersionExA
FindFirstFileA

user32

PostMessageA
FindWindowA
RegisterWindowMessageA
LoadCursorA
DefWindowProcA
UpdateWindow
LoadIconA
PostQuitMessage
UnregisterClassA
EnableWindow

winspool.drv

EnumPrintersA

Exports

Exports

??1HT_Media_Info@@UAE@XZ
??1HT_Media_Names@@UAE@XZ
??1HT_PC3_Data@@UAE@XZ
??1HT_Plot_Config@@UAE@XZ
??1HT_Plot_Style@@UAE@XZ
??1HT_Style_Sheet_Configuration@@UAE@XZ
??1HT_Thin_Plot_Config_Manager@@UAE@XZ
??1PCM_Class_Factory@@UAE@XZ
?get_driver_search_path@HT_Plot_Config_Manager@@QAE?AVHT_String@@XZ
?get_style_sheet_search_path@HT_Plot_Config_Manager@@QAE?AVHT_String@@XZ
?get_udm_search_path@HT_Plot_Config_Manager@@QAE?AVHT_String@@XZ
?set_driver_search_path@HT_Plot_Config_Manager@@QAEXVHT_String@@@Z
?set_style_sheet_search_path@HT_Plot_Config_Manager@@QAEXVHT_String@@@Z
?set_udm_search_path@HT_Plot_Config_Manager@@QAEXVHT_String@@@Z

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

641768fec1879976ca13acf338103f87

Headers

File Characteristics

Imports

hcreg8

plotcfg8

plcfmgr

heidi8

pc3edit

apperr

userdata

adui16

mfc70

msvcr70

kernel32

user32

winspool.drv

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 115KB - Virtual size: 116KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 115KB - Virtual size: 116KB