8c481cf9d9b48ceb6b691f2dd0a351d92e7f03e11294da32e27dfc251fee306f

Sharing

Copy URL

Twitter E-mail

General

Target

8c481cf9d9b48ceb6b691f2dd0a351d92e7f03e11294da32e27dfc251fee306f
Size

76KB
MD5

3d8715a59c7fdc1cb86f8911c8ba9a62
SHA1

51367272d751ff72a2f5100ffb0270006060079d
SHA256

8c481cf9d9b48ceb6b691f2dd0a351d92e7f03e11294da32e27dfc251fee306f
SHA512

d466e71762b76d1fa1a6f4c1fee4e595316ba4fbc6e550a22a3901b539e2b5a1a3eb9ba070c9866c29773ee29c9010b43c24268892e38f27401de16dba06a2e9
SSDEEP

1536:Rs5srZhYcrOeraE8vc6a6Pfikwjx5HFIX:SIh/rPaTlh7gxlFIX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c481cf9d9b48ceb6b691f2dd0a351d92e7f03e11294da32e27dfc251fee306f

Files

8c481cf9d9b48ceb6b691f2dd0a351d92e7f03e11294da32e27dfc251fee306f
.dll windows x86

b10bde2cdcce080082f44b0b82bb1f11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetQueryOptionA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetReadFileExA
HttpQueryInfoA
InternetGetConnectedState
InternetSetStatusCallback
InternetReadFile
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA

rpcrt4

UuidToStringA
RpcStringFreeA

mfc42

ord803
ord4185
ord801
ord663
ord541
ord348
ord909
ord5628
ord858
ord800
ord6883
ord537
ord6143
ord2818
ord540
ord535
ord860
ord823
ord6307
ord1105
ord521
ord2764
ord4202
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord825
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord1265
ord2915
ord715
ord415
ord1081
ord5620
ord1567
ord268
ord3663
ord2841
ord2107
ord1116
ord3811
ord5450
ord5440
ord6383
ord6394
ord2614
ord3337
ord6283
ord6282
ord4204
ord4277
ord4278
ord6663
ord1979
ord6385
ord665
ord5186
ord354
ord5442
ord5861
ord394
ord543
ord696
ord3643
ord3584
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord3262
ord551

msvcrt

__dllonexit
_EH_prolog
rand
strncmp
free
_onexit
malloc
__CxxFrameHandler
_mbscmp
atoi
strchr
_mbsnbcpy
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
realloc
_mkdir
_purecall
_mbsicmp

kernel32

GetExitCodeThread
TerminateThread
LocalAlloc
ResumeThread
LeaveCriticalSection
GetLastError
WaitForMultipleObjects
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
LocalFree
EnterCriticalSection
DeleteCriticalSection

user32

PostMessageA

ole32

CoCreateGuid
CoInitialize

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ

dalog

?storage@CDALog@@QAEXPBD00_N1@Z
?DALogFini@@YAXXZ
??1CDALog@@QAE@XZ
?Write@CDALog@@QAAXPBDZZ
??RCDALog@@QAEAAV0@W4Lvl@0@@Z
??0CDALog@@QAE@XZ

gzip2

A2Gzip
Gzip2A

xmlhelper3

??0CXmlDocument@PugiXMLHelper@@QAE@XZ
?SelectSingleNode@CXmlDocument@PugiXMLHelper@@QBE?AVCXmlNode@2@PBDPAVxpath_variable_set@pugi@@@Z
?GetNodeValue_String@CXmlUtil@PugiXMLHelper@@SAPBDAAVCXmlNode@2@PAD@Z
??1CXmlNode@PugiXMLHelper@@QAE@XZ
??1CXmlDocument@PugiXMLHelper@@QAE@XZ

Exports

Exports

?jdCmdGetNotify@JDCmdSvr@@YAXHPAPAEAAVCString@@PAHW4CMDNotifyType@1@@Z
?jdCmdSetServerTime@JDCmdSvr@@YAXJJ@Z
?jdCmdSvcConnect@JDCmdSvr@@YAHABVCString@@0@Z
?jdCmdSvcDisconnect@JDCmdSvr@@YAXXZ
?jdCmdSvcFini@JDCmdSvr@@YAXXZ
?jdCmdSvcFireUIEvent@JDCmdSvr@@YAXW4CMDNotifyType@1@PAXABVCString@@@Z
?jdCmdSvcGetService@JDCmdSvr@@YAPAVIJDCmdService@1@XZ
?jdCmdSvcInit@JDCmdSvr@@YAHPAUHWND__@@ABVCString@@11@Z

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b10bde2cdcce080082f44b0b82bb1f11

Headers

File Characteristics

Imports

wininet

rpcrt4

mfc42

msvcrt

kernel32

user32

ole32

msvcp60

dalog

gzip2

xmlhelper3

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 8KB - Virtual size: 4KB