328eff94821b3fdcb1645b073c1b64053f1305ba5fe674bc292ebbc79d98ebb6

Sharing

Copy URL

Twitter E-mail

General

Target

328eff94821b3fdcb1645b073c1b64053f1305ba5fe674bc292ebbc79d98ebb6
Size

519KB
MD5

7181ec5c424486a0d659b6cc0a465563
SHA1

772197c89e26f56bffc17ce9b0a7671d86f378ea
SHA256

328eff94821b3fdcb1645b073c1b64053f1305ba5fe674bc292ebbc79d98ebb6
SHA512

9f62bd8e5c0e82baa201a53bb6ae3434d820067afe622c0033e75ca11cae97f7f9addbd02863b09ce1664fbee217fd91a2d42c7952bca9a26e0b658789c980ca
SSDEEP

6144:H041FitlAgfFKGdt2VAGSKf7a+pdDlJ7vupSivlMtx3RdBLV+r9PE/Y67YB9SOJr:BLng0VAGSKTa+pdDnFKARd6BQ2/9EPu

Score

1^/10

Malware Config

Signatures

Files

328eff94821b3fdcb1645b073c1b64053f1305ba5fe674bc292ebbc79d98ebb6
.exe windows x86

150964fb89e2e45ce584556a7e3ee309

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump

foundation90u

??0AtomicCounter@siit@@QAE@H@Z
??1AtomicCounter@siit@@QAE@XZ
??0NullPointerException@siit@@QAE@ABV01@@Z
??0NullPointerException@siit@@QAE@H@Z
??1NullPointerException@siit@@UAE@XZ
??1FastMutex@siit@@QAE@XZ
??0FastMutex@siit@@QAE@XZ
?unexpected@BugCheck@siit@@SAXPBDH@Z
?unlock@FastMutex@siit@@QAEXXZ
??0Exception@siit@@QAE@ABV01@@Z
?lock@FastMutex@siit@@QAEXXZ
?nullPointer@BugCheck@siit@@SAXPBD0H@Z
?code@Exception@siit@@QBEHXZ
?hour@LocalDateTime@siit@@QBEHXZ
?emptyDirecotry@File@siit@@QAEXXZ
?Free@Memory@siit@@SAXPAX@Z
?Alloc@Memory@siit@@SAPAXI@Z
?create@GUIDGenerator@siit@@SA?AV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@2@XZ
??FAtomicCounter@siit@@QAEHXZ
?message@Exception@siit@@QBEABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@2@XZ
?close@FileIOS@siit@@QAEXXZ
?dllDirectory@Path@siit@@SA?AV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@2@XZ
??0FileInputStream@siit@@QAE@ABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@1@H@Z
?copyStream@StreamCopier@siit@@SAHAAV?$basic_istream@DU?$char_traits@D@std@@@std@@AAV?$basic_ostream@DU?$char_traits@D@std@@@4@I@Z
??_DFileInputStream@siit@@QAEXXZ
??1Path@siit@@QAE@XZ
??0NamedMutex@siit@@QAE@ABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@1@@Z
??1NamedMutex@siit@@QAE@XZ
??0Path@siit@@QAE@ABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@1@@Z
?getBaseName@Path@siit@@QBE?AV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@2@XZ
??0File@siit@@QAE@ABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@1@@Z
??1File@siit@@UAE@XZ
?remove@File@siit@@QAEXXZ
??0Random@siit@@QAE@H@Z
??1Random@siit@@QAE@XZ
?seed@Random@siit@@QAEXXZ
?lock@NamedMutex@siit@@QAEXXZ
?unlock@NamedMutex@siit@@QAEXXZ
?nextDouble@Random@siit@@QAENXZ
?IPCInitialize@IPCServer@siit@@QAE_NABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@2@I@Z
?IPCRead@IPCServer@siit@@QAEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z
??1IPCServer@siit@@QAE@XZ
??0IPCServer@siit@@QAE@XZ
?IPCWrite@IPCClient@siit@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z
??1IPCClient@siit@@QAE@XZ
??0IPCClient@siit@@QAE@ABV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@1@@Z
??1UIThread@siit@@UAE@XZ
??0UIThread@siit@@QAE@XZ
?createDirectories@File@siit@@QAEXXZ
?assertion@BugCheck@siit@@SAXPBD0H0@Z
?start@UIThread@siit@@QAE?AVThreadControl@2@H@Z
?getExtension@Path@siit@@SA?AV?$basic_ustring@_WU?$UStringAlloc@_W@siit@@@2@ABV32@@Z
?convert@UnicodeConverter@siit@@SAXPB_WAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?escape@UTF8@siit@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@_N@Z
??0LocalDateTime@siit@@QAE@XZ
??1LocalDateTime@siit@@QAE@XZ
??0LogicException@siit@@QAE@ABV01@@Z

iconv

libiconv_open
libiconv_close
libiconv

slog90u

??1LogMessage@@QAE@XZ
?stream@LogMessage@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?InitLogging@@YAXPBD@Z
?SetLogFilenameExtension@@YAXPBD@Z
?SetAllLogDestination@@YAXPBDH@Z
?SetLogAllInOne@@YAXXZ
?SetFileLogging@@YAXH@Z
??1Logger@@UAE@XZ
??0LogMessage@@QAE@PBDHH@Z

wb

FindArea

common

ord3
ord6

formocr_hwr

?HWOCRRecognize@@YAPAUOCRRecord@@PAX0PAD@Z
?HWOCRReleaseRes@@YAXPAX@Z
?HWOCRInitRes@@YAPAXPADH@Z
?OCRReleaseRecord@@YAXPAUOCRRecord@@@Z
?HWOCRSetOption@@YAXPAD0@Z

l031

L031_LocateRecogniseQRBar

l900

L900_ImgZoom
L900_FreeOneHdib
L900_PostProcess_T8

l055

L055_FreeMPage2

l060

L060_DecodeMultBarCode

gdiplus

GdiplusStartup
GdiplusShutdown

msvcp90

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$char_traits@_W@std@@SAPA_WPA_WI_W@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?find@?$char_traits@_W@std@@SAPB_WPB_WIAB_W@Z
?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?length@?$char_traits@_W@std@@SAIPB_W@Z
?compare@?$char_traits@_W@std@@SAHPB_W0I@Z
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z
?uncaught_exception@std@@YA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?width@ios_base@std@@QAEHH@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

ole32

CoCreateInstance

msvcr90

fclose
strpbrk
strncmp
isspace
isalnum
tolower
isalpha
memmove
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
__RTDynamicCast
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_getpid
_CxxThrowException
__CxxFrameHandler3
_onexit
fseek
ftell
memmove_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
free
calloc
_invalid_parameter_noinfo
_recalloc
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
sprintf_s
memset
memcpy
wcslen
strlen
_vscwprintf
vswprintf_s
_wtoi
strcpy
_swprintf
wcscpy
sprintf
exit
_wtol
wcscmp
malloc
_waccess
strcmp
swprintf_s
strchr
_wassert
sscanf
_vsnprintf_s
fopen_s
fread
fprintf

siitframe90u

ord5
ord3
ord1
ord2

mfc90u

ord4448
ord4519
ord2479
ord374
ord4000
ord3355
ord6411
ord1754
ord1751
ord4345
ord1493
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5664
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord4747
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord2251
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord3140
ord3286
ord4910
ord3528
ord797
ord595
ord1108
ord1137
ord1938
ord5008
ord2596
ord4442
ord2694
ord6579
ord4543
ord6604
ord4423
ord2069
ord524
ord744
ord5182
ord405
ord664
ord2209
ord3399
ord5851
ord3515
ord4682
ord5653
ord1492
ord6408
ord3353
ord1675
ord1809
ord1810
ord5324
ord5167
ord4631
ord5632
ord4324
ord1745
ord3953
ord3220
ord285
ord1607
ord6630
ord4405
ord4518
ord5979
ord280
ord3185
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord4347
ord4996
ord5680
ord5663
ord6018
ord2771
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord2447
ord654
ord639
ord2208
ord6482
ord1098
ord4211
ord811
ord813
ord6801
ord4173
ord4530
ord6803
ord286
ord1272
ord794
ord589
ord4043
ord4967
ord909
ord2537
ord600
ord296
ord4174
ord2621

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetCurrentThreadId
GetLocalTime
CreateFileW
GetModuleFileNameW
CreateDirectoryW
GetCurrentProcess
HeapFree
CloseHandle
OpenProcess
GetModuleHandleW
GetCommandLineW
SetEnvironmentVariableW
GetModuleHandleExW
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentProcessId
InterlockedExchangeAdd
InterlockedIncrement
LoadLibraryW
FreeLibrary
GetProcAddress
Sleep
InterlockedDecrement
lstrlenW
WideCharToMultiByte
GetLastError
MultiByteToWideChar
lstrlenA
GetProcessHeap
WaitForSingleObject

user32

GetWindowThreadProcessId
GetClientRect
DrawIcon
PostMessageW
GetSystemMetrics
IsIconic
SetTimer
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow

comctl32

InitCommonControlsEx

oleaut32

SysFreeString
SysAllocString

l092

L092_FreeDivHdib
L092_num_div_all_type

Exports

Exports

??0LogMessageVoidify@@QAE@XZ
??0LogVodify@@QAE@XZ
??0Logger@@QAE@ABV0@@Z
??0Logger@@QAE@XZ
??4CheckOpMessageBuilder@@QAEAAV0@ABV0@@Z
??4LogMessageVoidify@@QAEAAV0@ABV0@@Z
??4LogVodify@@QAEAAV0@ABV0@@Z
??4Logger@@QAEAAV0@ABV0@@Z
??ILogMessageVoidify@@QAEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??ILogVodify@@QAEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??_7Logger@@6B@
?ForVal1@CheckOpMessageBuilder@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ

Sections

.text
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

150964fb89e2e45ce584556a7e3ee309

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

foundation90u

iconv

slog90u

wb

common

formocr_hwr

l031

l900

l055

l060

gdiplus

msvcp90

ole32

msvcr90

siitframe90u

mfc90u

kernel32

user32

comctl32

oleaut32

l092

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 396KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 2KB - Virtual size: 8KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 396KB - Virtual size: 396KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 2KB - Virtual size: 8KB

.rsrc
Size: 24KB - Virtual size: 24KB