f6ce27a85ba0565b68a0b072a5c754082c85a41a392b41acdc8c81949e6af433

Sharing

Copy URL Twitter E-mail

General

Target

f6ce27a85ba0565b68a0b072a5c754082c85a41a392b41acdc8c81949e6af433
Size

500KB
MD5

409f28844cf59abdcfbd14c3c8a12a2c
SHA1

b99edc50b5f223cfc43c1a7abcd3559323da375a
SHA256

f6ce27a85ba0565b68a0b072a5c754082c85a41a392b41acdc8c81949e6af433
SHA512

4262bb1cdf5c02471c431c902c339c267b3969bec5fc4307b601edd42c2cf81ea5e2042876ebd26843d3a14b5e39273c1cc47fe71fadcd934600157c8eaa05a8
SSDEEP

6144:onWSwXFjqnZNlKym0FGr4OimdHyq2/QHNDO+Oa7INDoypZmKh:m7CkNl9mEGr1H/vVOoU

Score

N/A

Malware Config

Signatures

Files

f6ce27a85ba0565b68a0b072a5c754082c85a41a392b41acdc8c81949e6af433
.dll windows x86

a2d397f4a010d6fc410c383d3471629a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

nsmem

??1PVirtualMem@@UAE@XZ
?AllocMemory@PVirtualMem@@UAEPAEIK@Z
?FreeMemory@PVirtualMem@@UAEXXZ
??0PVirtualMem@@QAE@XZ

mfc42

ord3830
ord3831
ord3825
ord2976
ord3079
ord4080
ord4622
ord4424
ord565
ord817
ord2726
ord4226
ord823
ord1842
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord3262
ord3081
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord6055
ord4077
ord1776
ord4407
ord5237
ord2385
ord5163
ord6374
ord4353
ord5282
ord2649
ord2985
ord3798
ord4837
ord4436
ord4303
ord3350
ord1665
ord3749
ord5065
ord1727
ord2446
ord2124
ord5277
ord4627
ord4427
ord674
ord926
ord366
ord4242
ord4413
ord1232
ord1153
ord3663
ord2841
ord5450
ord6394
ord2107
ord5440
ord6383
ord1168
ord2379
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord5302
ord4698
ord5714
ord3738
ord561
ord3136
ord3953
ord2725
ord6467
ord4160
ord5572
ord2915
ord2818
ord1199
ord1200
ord4465
ord3259
ord3147
ord2982
ord5715
ord5289
ord5307
ord4699
ord4079
ord5303
ord5300
ord3346
ord2396
ord1948
ord825
ord356
ord924
ord2770
ord668
ord2781
ord3178
ord1980
ord922
ord537
ord939
ord5683
ord860
ord5710
ord4203
ord2784
ord540
ord535
ord4129
ord858
ord800
ord2614
ord6376
ord2648
ord2055
ord815
ord269
ord826
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1116
ord1243
ord342
ord1182
ord1577
ord1575
ord1176

msvcrt

_splitpath
_stricmp
abs
_strcmpi
strcat
_itoa
_ftol
sprintf
atof
labs
strcpy
strlen
memset
memcpy
strcmp
_mbscmp
_access
__CxxFrameHandler
sscanf
localtime
time
exp
sqrt
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
??1type_info@@UAE@XZ
strstr
_mbsicmp

kernel32

CloseHandle
LocalAlloc
LocalFree
GetPrivateProfileStringA
SetEvent
GlobalFree
GlobalAlloc
GlobalLock
CreateDirectoryA
OpenEventA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary
IsDBCSLeadByte
GetModuleHandleA
GetLastError
SetLastError
lstrcpyA
GetWindowsDirectoryA
WritePrivateProfileStringA
WriteProfileStringA
FindClose
FindNextFileA
FindFirstFileA
GetProfileStringA
lstrcmpiA
DeleteFileA
GetFileAttributesA
lstrcatA
_lclose
GetDiskFreeSpaceA
OpenFile
_lwrite
GlobalSize
_llseek
_lread
lstrlenA
GetVersionExA
GetTickCount
lstrcpynA
GlobalUnlock
GlobalMemoryStatus
GlobalHandle

user32

SendMessageA
EnableWindow
IsWindowEnabled
GetFocus
GetWindowLongA
GetDesktopWindow
wsprintfA
LoadStringA
FindWindowA
MessageBoxA
GetForegroundWindow
LoadIconA
LoadCursorA
IsWindowVisible
ShowWindowAsync
GetWindowTextA
PostMessageA
GetParent
IsWindow
RegisterWindowMessageA
KillTimer
SetTimer
GetClassInfoA
SetForegroundWindow
GetClassNameA

Exports

Exports

??1PMirrorMem@@UAE@XZ
PMScan_CancelAllXfer
PMScan_CancelScanForNetScan
PMScan_CloseDS
PMScan_DisableDS
PMScan_DoInit
PMScan_GetADFAvailable
PMScan_GetAllDS
PMScan_GetCap
PMScan_GetDSProductName
PMScan_GetDefaultDriver
PMScan_GetDuplexEnable
PMScan_GetDuplexType
PMScan_GetEPDSFamilyName
PMScan_GetEPDSName
PMScan_GetEPDefaultRgbMatrix
PMScan_GetEPExposureMode
PMScan_GetEPLUT1
PMScan_GetEPLUT2
PMScan_GetEPRgbMatrix
PMScan_GetEPRgbResponse
PMScan_GetEPVersion
PMScan_GetImageDim
PMScan_GetMaxArea
PMScan_GetResolutionEx
PMScan_GetSupportedFileType
PMScan_GetXResolution
PMScan_GetXScale
PMScan_GetXferCount
PMScan_GetXferPendingCount
PMScan_GetYResolution
PMScan_GetYScale
PMScan_Init
PMScan_IsADFPaperLoaded
PMScan_IsDSEvent
PMScan_IsNonUIAvailable
PMScan_IsScanReady
PMScan_NegotiateCAP
PMScan_NegotiateEPCAP
PMScan_OnCloseDSReq
PMScan_OnSetDuplex
PMScan_OnXferData
PMScan_OnXferEnd
PMScan_OnXferStart
PMScan_Read
PMScan_ResetCAP
PMScan_ScanImage
PMScan_ScanImage2
PMScan_SelectScanner
PMScan_SetADFAvailable
PMScan_SetAutoMode
PMScan_SetClearPage
PMScan_SetDefaultDriver
PMScan_SetDuplexEnable
PMScan_SetEPAutoExposureMode
PMScan_SetEPDescreeing
PMScan_SetEPRgbResponse
PMScan_SetEPUIMode
PMScan_SetEPUnSharpMask
PMScan_SetImageLayout
PMScan_SetPIMFlag
PMScan_SetParameter
PMScan_SetPixelType
PMScan_SetXResolution
PMScan_SetYResolution
PMScan_SpecialOperateForA8Scanner
PMScan_Terminate
PMScan_TurnOffProgressIndicators
PMScan_UnDoInit

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a2d397f4a010d6fc410c383d3471629a

Headers

File Characteristics

Imports

nsmem

mfc42

msvcrt

kernel32

user32

Exports

Exports

Sections

.text Size: 260KB - Virtual size: 257KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 68KB - Virtual size: 96KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 16KB - Virtual size: 13KB

.text Size: 112KB - Virtual size: 112KB

.text
Size: 260KB - Virtual size: 257KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 68KB - Virtual size: 96KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 16KB - Virtual size: 13KB

.text
Size: 112KB - Virtual size: 112KB