dd9b3c85bb87a06440a3d3de8205b6956c6753d71704fb9fc9dae39109629786

Sharing

Copy URL Twitter E-mail

General

Target

dd9b3c85bb87a06440a3d3de8205b6956c6753d71704fb9fc9dae39109629786
Size

452KB
MD5

80c676d7c2e6c90766e587b93107bd14
SHA1

7e5c685679cf4875ef31aad87989527042451932
SHA256

dd9b3c85bb87a06440a3d3de8205b6956c6753d71704fb9fc9dae39109629786
SHA512

7a027b93970bdeb989619c2ae174017351ac33ae7aa1510308692e531d46e4ec94a57f5d13cb9cfdd6c1d5c519007566af443902ba11d791636b23afad9bd618
SSDEEP

6144:cnHXINC7giTH2Ep2g+i7Cb5Gs62Sf79mAMs4sjEsYlUL8EXdYcoqHE6C8lW+slRj:c3Ic7gUNEdSfBmHAL8oY5qkd+aF

Score

N/A

Malware Config

Signatures

Files

dd9b3c85bb87a06440a3d3de8205b6956c6753d71704fb9fc9dae39109629786
.dll windows x86

561b27155f173ffb95c05b2ab604d4de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

xrx_xml2

xmlReaderForIO
xmlTextReaderCurrentDoc
xmlTextReaderCurrentNode
xmlTextReaderNodeType
xmlTextReaderGetAttribute
xmlTextReaderName
xmlTextReaderNext
xmlTextReaderExpand
xmlTextReaderRead
xmlTextReaderPreserve
xmlTextReaderByteConsumed
xmlFreeTextReader
xmlCleanupParser
xmlInitParser

xipinterp

STRINGArrayToList_str
call_elf_object_method
getStatus
call_elf_procedure
printStatus
lstRemoveArg
elflistRemove
lstConcatArgs
elflistRemoveName
__getELFRoot
elfCalloc
elfhash
find_elf_type
new_LIST
elflistInsert
setStatus
mapPath
elfFindScriptFile
elfPath
_elfFree
initELF
__lstBuildArgs
ELFScriptExec
elfRegisterError
elfRegisterPrint
elfStrDup
lstBuildArgs
lstScanArgs
new_elf_object
lstAppendArgs
attach_elf_debugger_net

xeext

inflateEnd
inflateInit_
inflateInit2_
deflateEnd
deflate
deflateInit_
inflate

xesup

XEngSScanf
XEngSPrintf
XEngStrLen
XEngUnregisterLibrary
xeng_internal_free
xeng_internal_malloc
xeng_internal_calloc
XEngFindAndReadFuncDesc
XEngFreeFuncDesc
XEngError
XEngGetenv
XEngStrDup
XEngSetLoggingCallback
XEngineEnd
XEngRetrieveFunc
XEngineDisableRegistryLoad
XEngineInit
XEngSetenv
XEngVSNPrintf
XEngGetCurrentDate
XEngUTF8ConvertFromUTF16
XEngineUnlock
XEngineLock
XEngSBRead
XEngSBFree
XEngSBBytesAvailable
XEngGetClockTick

msvcr80

strstr
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
strrchr
strpbrk
_CIacos
clock
strncmp
_ftime64
exit
vsprintf
abort
strtol
fgetc
tolower
putc
getc
strftime
_time64
_mktime64
_localtime64
_gmtime64
_difftime64
ftell
fseek
_CIsqrt
_CIatan
_CIsin
_CIcos
_CIpow
floor
ceil
_setjmp3
isprint
realloc
longjmp
isalpha
iscntrl
isdigit
islower
ispunct
isspace
isupper
isalnum
isxdigit
strncpy
vfprintf
__iob_func
fflush
malloc
free
sprintf
fclose
fprintf
fopen
calloc
memcpy
atoi
_strdup
printf
fwrite
feof
fread
memset
strchr
sscanf
atof

kernel32

IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep

Exports

Exports

BufInt_AppInt
BufInt_Free
BufInt_New
BufUCharZ_Deflate
BufUCharZ_InflateZip
BufUChar_AppAry
BufUChar_AppChr
BufUChar_AppStm
BufUChar_AppStr
BufUChar_Check
BufUChar_Free
BufUChar_New
BufUChar_ReadStm
BufUChar_WriteStm
ByteSrc_Close
ByteSrc_EndOf
ByteSrc_GetPosition
ByteSrc_GetSize
ByteSrc_NewFromArray
ByteSrc_NewFromFile
ByteSrc_Read
ByteSrc_ReadBlock
ByteSrc_SetPosition
DateTime_GetPDF
DateTime_GetXPS
FFont_ChrSzX
FFont_ForIndex
FFont_GeneratePDFToUnicodeCharMap
FFont_GetC2UForIndex
FFont_IndexForFileName
FFont_IndexToFStyle
FFont_IndexToISOCSet
FFont_PDFNameForIndex
FFont_StrSzX
FaxComp
FaxCompFinish
FaxWClose
FaxWInit
GetDIBData
GetDNMemory
ICC_sRGB
JPEGC_Close
JPEGC_CompressBlock
JPEGC_CompressMCURow
JPEGC_CompressRestartInit
JPEGC_CompressSegInit
JPEGC_DecompressSegInit
JPEGC_GetCompressSegData
JPEGC_GetNumComponents
JPEGC_NewEncoder
JPEGC_Tiff7DecompressInit
JPHuffC_GenDefaultGilaHuffTables
JPQBlk_GenQTabs
JPQBlk_NewChromQuality
JPQBlk_NewFromFile
PDFFont_CodeForName
PDFFont_NameForCode
PDFFont_StrSzX
PDFRd_GetAllPageContent
PDFWt_Close
PDFWt_MetaDataStr
PDFWt_MetaDataStr_noPacketHeader
PDFWt_Open
PDFXIP_AddXIPImage
PDFXIP_MarkRequiredFonts
PDFXIP_XMLToPDF
ReadIMStoELFLIST
ReadIMStoXIPIMAGE
Reciprocal_Get_16_256_255_Int
SPBuf_Close
SPBuf_DstScanInt
SPBuf_DstScanUCh
SPBuf_DstScanUSh
SPBuf_Free
SPBuf_OpenIn
SPBuf_OpenOut
SPBuf_OpenOutX
SPBuf_PhotometryColors
SPBuf_PhotometryZero
SPBuf_SrcScanInt
SPBuf_SrcScanUCh
SPBuf_SrcScanUSh
SPXIP_Close
SPXIP_OpenIn
SPXIP_OpenInThr
SPXIP_ReadJP
SPXIP_ReadSP
SPXIP_SrcScanUCh
SSXDoc_Free
SSXDoc_ReadBufUChar
SSXDoc_ReadByteSrc
SSXDoc_ToXML
SSXXIP_2XIP
SSXXIP_BufUChar2XIP
SSXXIP_XMLPage2XIP
SState_Calloc
SState_Err
SState_ErrPrintf
SState_Free
SState_FreeState
SState_InfPrintf
SState_LogToStm
SState_Malloc
SState_NewState
SState_NewStateDefault
SState_NewStateException
SState_OpenCheck
SState_OpenIn
SState_OpenOut
SState_Realloc
SState_Report
SState_StrDup
SState_StrsDup
SState_ToLower
SState_TransferA2B
SState_VerPrintf
SummonXIPClose
SummonXIPFreeXML
SummonXIPGetErrors
SummonXIPOpen
SummonXIPOpenEDB
SummonXIPScriptAgrv
SummonXIPScriptXML
SummonXIPSetCallback
SummonXIPSetLogging
SummonXIPSetPerfMonitor
SummonXIPSetVerbose
TokenStr_Close
TokenStr_CreateFromStrRef
TokenStr_Eof
TokenStr_Next
Util_Clock
Util_FileSize
Util_Log2
Util_Nint
Util_StmClose
Util_StrCmpLCaseN
WriteXIPIMAGEtoIMS
XForm_FactorRotation
XForm_MultPxQtoQ
XIPAssignXIPIMAGE
XIPAttributes
XIPBase64Decode
XIPBase64Encode
XIPCopyDataToPOINTER
XIPCopyPersistant
XIPCopyPersistantXIPIMAGE
XIPDeleteLayer
XIPExecute
XIPFWinParse
XIPFormatToXIPIMAGE
XIPFormatXIPIMAGE
XIPGetDictLayer
XIPGetLayer
XIPGetSize
XIPGetXEngInit
XIPHmacSha1
XIPHmacSha1Finish
XIPHmacSha1Init
XIPHmacSha1Update
XIPInitialize
XIPLayer2XIPIMAGE
XIPLibXmlEnd
XIPLibXmlInit
XIPPhot_Code2Clrs
XIPPhot_SPStr2Code
XIPPhot_White8Bits
XIPReadFile2XIPIMAGE
XIPRegExCompile
XIPRegExFree
XIPRegExGetErrorMsg
XIPRegExNew
XIPRegExSplit
XIPRegister
XIPReleaseClasses
XIPSetDataPOINTER
XIPSetDefines
XIPSha1Finish
XIPSha1Init
XIPSha1Update
XIPTerminate
XIPTransform2DApplyToLayer
XIPTransform2DApplyToWin
XIPTransform2DConcatenate
XIPTransform2DFree
XIPTransform2DIdentity
XIPTransform2DInvert
XIPTransform2DParse
XIPTransform2DPreconcatenate
XIPTransform2DRotate
XIPTransform2DScale
XIPTransform2DSet
XIPTransform2DShear
XIPTransform2DTranslate
XIPUpdateXIPIMAGE
XIPUtil_Adj_Layer
XIPUtil_ImageAddLayer
XIPUtil_ImageCompress
XIPUtil_ImageFree
XIPUtil_ImageNew
XIPUtil_LayerCompressFlate
XIPUtil_LayerFree
XIPUtil_LayerNew
XIPUtil_LayersFree
XIPUtil_OutputPdf
XIPUtil_Sts_LayerContone
XIPUtil_XIPShow
XIPXmlReaderAlloc
XIPXmlReaderEndOfData
XIPXmlReaderExpand
XIPXmlReaderFree
XIPXmlReaderGetAttribute
XIPXmlReaderGetCurrentNode
XIPXmlReaderGetDoc
XIPXmlReaderIsStartElement
XIPXmlReaderName
XIPXmlReaderNext
XIPXmlReaderRead
XML_AddContent
XML_AddContentDbl
XML_AddContentInt
XML_AppendElement
XML_ConvertToStr
XML_CopyElement
XML_CopyElementSS
XML_ElementFree
XML_EnsureElement
XML_EntityDecodeStr
XML_EntityEncodeStr
XML_EqualAttributes
XML_EqualElement
XML_EqualStrValue
XML_FirstPathName
XML_FullPathName
XML_GetAttributeValue
XML_GetAttributeValueDbl
XML_GetAttributeValueInt
XML_GetContent
XML_GetElement
XML_NewElement
XML_Parse
XML_ParseData
XML_ParseStm
XML_PathNameFrom
XML_RemoveElement
XML_Root
XML_SetAttributeValue
XML_SetAttributeValueDbl
XML_SetAttributeValueInt
XML_Show
XML_SwapElements
XML_Write
XPSXML_ApplyViewPortToXForm
XPSXML_GetBBox
XPSXML_GetNextPage
XPSXML_GetXForm
XPSXML_ScaleViewPort
XPSXML_XMLToXPSStr
XPSXML_XPSToXMLStr
__XIPELFErr
__XIPError
__XIPImageAddLayer
__XIPImageFree
__XIPImageNew
__XIPImg2Buffer
__XIPInfo
__XIPLayer2Buffer
__XIPObj2Struct
__XIPStruct2Obj
__XIPTIMER_elapsed
__XIPTIMER_reset
__XIPTIMER_start
__XIPTIMER_stop
__XIPWinBuildArgs
__lfError
bequeathToSState
fijiErrPrintf
fijiInfPrintf
fijiVerPrintf
getXIPImageData

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

561b27155f173ffb95c05b2ab604d4de

Headers

File Characteristics

Imports

xrx_xml2

xipinterp

xeext

xesup

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 178KB

.rdata Size: 40KB - Virtual size: 37KB

.data Size: 208KB - Virtual size: 225KB

.rsrc Size: 4KB - Virtual size: 428B

.reloc Size: 16KB - Virtual size: 12KB

.text
Size: 180KB - Virtual size: 178KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 208KB - Virtual size: 225KB

.rsrc
Size: 4KB - Virtual size: 428B

.reloc
Size: 16KB - Virtual size: 12KB