6af8ebd60ab6a9a160cb9b8b834acdb402ac26ef3cfbaede4f574a89975888fa

Sharing

Copy URL Twitter E-mail

General

Target

6af8ebd60ab6a9a160cb9b8b834acdb402ac26ef3cfbaede4f574a89975888fa
Size

112KB
MD5

d4d220dc452669cf227930236412a0d0
SHA1

182d95d65ff10b11d119ab0c6ebbfa037f55def6
SHA256

6af8ebd60ab6a9a160cb9b8b834acdb402ac26ef3cfbaede4f574a89975888fa
SHA512

d8d18f4afd1c54b3f16b86428ed82973961e49ae05877817c082ca04bd019d69b07c3b7c89e7498774886a32c56989a815112765230319fb7ae42689ed9bcafc
SSDEEP

1536:c3xdn42LYHGz+mP0rud7F+u5yDWq5j8AdW1P4EDxPuF0ufd8N1y5W:EBBdN5yDWq5j8RAEMffd8NU5W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6af8ebd60ab6a9a160cb9b8b834acdb402ac26ef3cfbaede4f574a89975888fa

Files

6af8ebd60ab6a9a160cb9b8b834acdb402ac26ef3cfbaede4f574a89975888fa
.dll windows x86

eaa2df6fe937b54f6e16e930e7e76d0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

dalog

?Write@CDALog@@QAAXPBDZZ
??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?storage@CDALog@@QAEXPBD00_N1@Z
??1CDALog@@QAE@XZ
??0CDALog@@QAE@XZ

jdobj

JDCreateApp
JDReleaseApp

mfc42

ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord3584
ord802
ord542
ord543
ord803
ord6569
ord2820
ord3811
ord6307
ord1567
ord1979
ord6385
ord5622
ord665
ord5186
ord354
ord268
ord521
ord6142
ord1265
ord1089
ord3938
ord348
ord397
ord663
ord1105
ord5631
ord912
ord4188
ord6283
ord922
ord535
ord696
ord394
ord909
ord5628
ord812
ord559
ord6282
ord801
ord5572
ord2915
ord2763
ord541
ord925
ord939
ord3435
ord4277
ord2764
ord1577
ord415
ord1081
ord5620
ord5605
ord996
ord3976
ord2458
ord6289
ord968
ord3470
ord1648
ord1238
ord5862
ord5710
ord6144
ord6883
ord6143
ord5683
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord6467
ord1578
ord600
ord826
ord269
ord1116
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4204
ord4129
ord941
ord537
ord6394
ord6383
ord5450
ord5440
ord3663
ord5460
ord6571
ord1871
ord858
ord860
ord5606
ord5860
ord540
ord1168
ord2818
ord823
ord800
ord825
ord500
ord772
ord1575
ord699
ord715
ord1176

msvcrt

_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
strncpy
?terminate@@YAXXZ
__CxxFrameHandler
_EH_prolog
_mbsrchr
memcpy
memset
memmove
_initterm
_adjust_fdiv
atoi
_mbscmp
strlen
strcpy
_ftol
abs
free
_CxxThrowException
wcslen
realloc
malloc
time
_purecall
_vsnprintf

kernel32

InterlockedCompareExchange
ResumeThread
CreateTimerQueue
SetEvent
WaitForSingleObject
GetExitCodeThread
TerminateThread
DeleteTimerQueueEx
GetTickCount
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
InterlockedDecrement
GetModuleFileNameA
GlobalMemoryStatusEx
MulDiv
Sleep
InterlockedExchange
InterlockedIncrement
ChangeTimerQueueTimer
WaitForMultipleObjects
LocalFree
LocalAlloc
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
ResetEvent

user32

PostMessageA

oleaut32

SetErrorInfo
SafeArrayCreateVector
VariantClear
SysFreeString
VariantChangeType
CreateErrorInfo
SysAllocString
VariantInit
GetErrorInfo

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

pdh

PdhCloseQuery
PdhAddCounterA
PdhOpenQueryA
PdhCollectQueryData
PdhGetFormattedCounterValue

shlwapi

PathStripPathA
PathRemoveExtensionA

Exports

Exports

JDAddAlertEvent
JDAddAlertTS
JDAddAlertTSEvent
JDAddCallBackData
JDAddCallBackDataEvent
JDAddExchange
JDAddHtmlData
JDAddInfoData
JDAddMsgDataNotify
JDAddMsgEvent
JDAddNews
JDAddQuote
JDAddTimerEvent
JDBackProcAbort
JDBackProcAllItems
JDBeginHistRequest
JDCheckConnect
JDClearBuffer
JDClearHtmlData
JDClearStockNewsHeadline
JDEX2XQID
JDEX2XQID2
JDEndHistRequest
JDFindSymbol
JDFindSymbol2
JDFindSymbolGroup
JDFindTradeSymbol
JDGetBaseAttrs
JDGetBaseAttrs2
JDGetDataIndexByDate
JDGetExch
JDGetExchQuoteType
JDGetExtendAttr
JDGetExtendData
JDGetExtendedAttr
JDGetFieldInfo
JDGetFrameSTAT
JDGetGroupSymbol
JDGetGroupTypeCount
JDGetHtmlData
JDGetInfoData
JDGetNewsCategoryInfos
JDGetNewsDetail
JDGetNewsHeadline
JDGetNewsItemInfo
JDGetNewsProviderInfos
JDGetNewsSymbol
JDGetNewsSymbolCount
JDGetNewsSymbolInfos
JDGetNotify
JDGetQuote
JDGetRelation
JDGetRelationID
JDGetServerDate
JDGetServerTime
JDGetSpreadRule
JDGetStockNewsDetail
JDGetStockNewsHeadline
JDGetStockNewsSymbol
JDGetSubGroup
JDGetSymbol
JDGetSymbolBaseAttr
JDGetSymbolBenchmark
JDGetSymbolCurrentIndex
JDGetSymbolDBData
JDGetSymbolExtendedAttr
JDGetSymbolFixPage
JDGetSymbolHDAfterData
JDGetSymbolHDBeforeData
JDGetSymbolHistAckDate
JDGetSymbolHistDailyTickData
JDGetSymbolHistDailyTickTAData
JDGetSymbolHistData
JDGetSymbolHistDataAfter
JDGetSymbolHistDataAfter2
JDGetSymbolHistDataBefore
JDGetSymbolHistDataBefore2
JDGetSymbolHistDataCount
JDGetSymbolInfo
JDGetSymbolInfos
JDGetSymbolInfos2
JDGetSymbolLotSize
JDGetSymbolQuote
JDGetSymbolRelation
JDGetSymbolRelationID
JDGetSymbolTADataAfter
JDGetSymbolTADataAfter2
JDGetSymbolTADataBefore
JDGetSymbolTADataBefore2
JDGetSymbolTick
JDGetSymbolTickArray
JDGetSymbolType
JDGetTAData
JDGetTradeAttr
JDGetTradeAttr2
JDGetTradeBaseAttrs
JDGetTradeID
JDGetTradeInfo
JDGetTradeSymbolInfo
JDGetTradeSymbolInfo2
JDGetTradeSymbolInfos
JDGetXQID
JDMergeMinData
JDRTConnectStatus
JDRTSetEcho
JDRTSetEchoPeriod
JDRTSetMonitorSymbol
JDRTSetNoDelay
JDReleaseNewsSymbol
JDReleaseStockNewsSymbol
JDReleaseSymbol
JDRemoveAlertEvent
JDRemoveAlertTS
JDRemoveAlertTSEvent
JDRemoveCallBackData
JDRemoveCallBackDataEvent
JDRemoveExchange
JDRemoveHtmlData
JDRemoveInfoData
JDRemoveMsgEvent
JDRemoveNews
JDRemoveQuote
JDRemoveTimerEvent
JDRemoveTradeInfoData
JDSFini
JDSGetApplication
JDSInit
JDSSetNotifyQueueSize
JDSetBackHistSpeed
JDSetExch
JDSubStragegys
JDSymbolAddDBData
JDSymbolAddFixPage
JDSymbolAddHistDailyTickData
JDSymbolAddHistDailyTickTAData
JDSymbolAddHistData
JDSymbolAddMinData
JDSymbolAddQuote
JDSymbolAddTAData
JDSymbolAddTick
JDSymbolAskPageupTickData
JDSymbolClearBuffer
JDSymbolGetMinDataUpdateRange
JDSymbolGetMinTick
JDSymbolGetMinTickCount
JDSymbolInfoToLog
JDSymbolRemoveDBData
JDSymbolRemoveFixPage
JDSymbolRemoveHistDailyTickData
JDSymbolRemoveHistDailyTickTAData
JDSymbolRemoveHistData
JDSymbolRemoveMinData
JDSymbolRemoveQuote
JDSymbolRemoveTAData
JDSymbolRemoveTick
JDSymbolUpdateData
JDUnSubStragegys
JDUpdateData
JDUpdateNews
JDUpdateQuote
JDXQ2EXID

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eaa2df6fe937b54f6e16e930e7e76d0c

Headers

File Characteristics

Imports

winmm

dalog

jdobj

mfc42

msvcrt

kernel32

user32

oleaut32

msvcp60

pdh

shlwapi

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 8KB - Virtual size: 5KB