Static task
static1
Behavioral task
behavioral1
Sample
8721ee368f171a9010c1772008d8966addd6c71ce1170d086d9e24a352d6855b.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8721ee368f171a9010c1772008d8966addd6c71ce1170d086d9e24a352d6855b.exe
Resource
win10v2004-20230703-en
General
-
Target
8721ee368f171a9010c1772008d8966addd6c71ce1170d086d9e24a352d6855b
-
Size
344KB
-
MD5
8c9800ac53b22bf5a3d58b3bdbd8b2e8
-
SHA1
c5e8aaa2051ac9a56abdceaca0c5605cc63710bd
-
SHA256
8721ee368f171a9010c1772008d8966addd6c71ce1170d086d9e24a352d6855b
-
SHA512
9b80f3dee6982b0eb8204736055273ed38fd3b961ca4c8237a7b50fd54a41369d39a3063923348aa7755e7682bf982369d7d225589efec8195caad0b1ac8df06
-
SSDEEP
6144:s0bR2qHgUWaIGRrU0Hp7AFL47qVYBIgjcM8dGDrmgKzU1/Od9Utv6MK:hbRHgUWoLJL7CG/mgKw1/Ody
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8721ee368f171a9010c1772008d8966addd6c71ce1170d086d9e24a352d6855b
Files
-
8721ee368f171a9010c1772008d8966addd6c71ce1170d086d9e24a352d6855b.exe windows x86
9267d1ec4449f4d58bc8f4a7a1337c7e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42d
ord1764
ord1756
ord1766
ord1769
ord1757
ord1857
ord3524
ord1136
ord3403
ord734
ord3554
ord2129
ord684
ord943
ord487
ord3447
ord2068
ord2435
ord880
ord2168
ord4633
ord492
ord1179
ord1373
ord1098
ord3831
ord5056
ord3340
ord4653
ord2793
ord4208
ord3177
ord2725
ord2406
ord2561
ord2719
ord3015
ord507
ord3110
ord4701
ord3282
ord2291
ord2640
ord4645
ord3029
ord1830
ord4837
ord5065
ord4589
ord4934
ord490
ord721
ord711
ord1190
ord1041
ord1100
ord669
ord565
ord736
ord460
ord306
ord1767
ord1772
ord4615
ord3302
ord4621
ord2413
ord4385
ord4841
ord3175
ord2383
ord945
ord3174
ord683
ord680
ord586
ord484
ord478
ord335
ord4551
ord1096
ord901
ord4756
ord1365
ord4216
ord3657
ord2024
ord1288
ord2965
ord596
ord1661
ord349
ord1809
ord4291
ord3553
ord4566
ord3867
ord4011
ord3281
ord2799
ord1863
ord343
ord723
ord1510
ord4258
ord2636
ord592
ord590
ord4123
ord714
ord728
ord344
ord2593
ord3212
ord2044
ord4170
ord1546
ord739
ord511
ord4302
ord654
ord3355
ord4403
ord429
ord814
ord3481
ord4405
ord4792
ord4800
ord903
ord1523
ord2810
ord4273
ord4447
ord4803
ord4125
ord4061
ord3717
ord2995
ord2936
ord1922
ord3650
ord2972
ord688
ord496
ord3545
ord4617
ord2594
ord3755
ord2385
ord3713
ord643
ord410
ord1042
ord2193
ord1122
ord4264
ord5093
ord3382
ord2419
ord797
ord803
ord1996
ord1264
ord1613
ord4256
ord5084
ord899
ord3803
ord3552
ord5077
ord3702
ord1880
ord1860
ord4415
ord3231
ord1033
ord4130
ord1789
ord2661
ord4227
ord4229
ord2104
ord3366
ord3826
ord4239
ord4215
ord4408
ord3784
ord2021
ord1285
ord2986
ord528
ord706
ord1116
ord2052
ord1087
ord4448
ord3432
ord730
ord3572
ord5072
ord3201
ord2324
ord1590
ord719
ord454
ord4676
ord1212
ord3070
ord4053
ord3960
ord646
ord1906
ord4475
ord2993
ord413
ord3365
ord4610
ord3290
ord1791
ord317
ord299
ord382
ord574
ord559
ord619
ord2875
ord4492
ord1228
ord1952
ord3658
ord3786
ord3367
ord2431
ord3142
ord3144
ord3143
ord2339
ord2432
ord2341
ord2585
ord2473
ord3691
ord2584
ord2481
ord2340
ord4205
ord1631
ord4191
ord1344
ord4064
ord3002
ord5078
ord1566
ord2076
ord3670
ord3944
ord3069
ord1310
ord2078
ord3618
ord5076
ord4118
ord1781
ord4176
ord3651
ord1364
ord3362
ord4753
ord1862
ord4017
ord3948
ord3629
ord4195
ord588
ord342
ord337
msvcrtd
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_controlfp
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_chkesp
__CxxFrameHandler
memset
strcpy
sprintf
_CxxThrowException
strstr
_vsnprintf
malloc
_snprintf
strncpy
_setmbcp
fclose
_except_handler3
__getmainargs
free
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_ftol
strcat
_mbsnbicmp
atoi
strlen
time
ctime
memcpy
memcmp
fopen
fflush
fwrite
_strlwr
kernel32
GetStartupInfoA
GetModuleHandleA
OpenProcess
GetExitCodeProcess
TerminateProcess
LoadLibraryA
GetProcAddress
GetLastError
GetPrivateProfileIntA
WritePrivateProfileStringA
GetModuleFileNameA
FreeLibrary
GetCurrentDirectoryA
SetCurrentDirectoryA
GetLocalTime
Sleep
CreateEventA
WaitForSingleObject
ResetEvent
GetTickCount
GetACP
CreateThread
CloseHandle
lstrcmpiA
lstrcpynA
SetEvent
TerminateThread
user32
GetSystemMetrics
PeekMessageA
EnableWindow
ShowWindow
IsDlgButtonChecked
GetClassNameA
LoadImageA
GetSysColor
SetCursor
SendMessageA
KillTimer
SetTimer
gdi32
DeleteObject
CreateSolidBrush
GetObjectA
GetStockObject
shell32
ShellExecuteA
mfco42d
ord798
ord809
devbasedlld
?iCloseComm@ODevBase@@QAEHXZ
?iPreInitDev@ODevBase@@QAEHXZ
?iGetIntValue@ODevBase@@QAEHPBD0AAH@Z
?iSetIntValue@ODevBase@@QAEHPBD0J@Z
?iGetDefaultCommConfig2@ODevBase@@QAEHAAUtCommCfg2@@@Z
?iInitComm2@ODevBase@@QAEHUtCommCfg2@@_N@Z
?vSetErrorFlag@ODevBase@@QAEXUtDevReturn@@@Z
?vSetErrorFlag@ODevBase@@QAEXH@Z
?iSendCommand2@ODevBase@@QAEHPBEIF_N1@Z
?iWaitResult2@ODevBase@@QAEHPAEAAIIF_N@Z
??0ODevBase@@QAE@XZ
??1ODevBase@@UAE@XZ
?vCallProcFun@ODevBase@@UAEXHPADHPBX@Z
?vSetBreakAsynRecvFlag@ODevBase@@UAEX_N@Z
?bGetBreakAsynRecvFlag@ODevBase@@UAE_NXZ
?iGetVersion@ODevBase@@UAEHPAD@Z
?iGetDevVersion@ODevBase@@UAEHPAD@Z
?iInit@ODevBase@@UAEHPAUtDevReturn@@@Z
?iTest@ODevBase@@UAEHPAUtDevReturn@@@Z
?vOnDataReceived@ODevBase@@UAEXPADH@Z
?iWaitResult@ODevBase@@QAEHPAEAAII_N@Z
?vClearRecvBuf@ODevBase@@QAEXXZ
?iSendCommand@ODevBase@@QAEHPBEI_N1@Z
msvcp60d
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
shlwapi
PathFileExistsA
psapi
EnumProcessModules
EnumProcesses
GetModuleBaseNameA
tim004cardsenderdevdlld
??0OTIM004CardSenderDev@@QAE@XZ
?iHotReset@OTIM004CardSenderDev@@QAEHPAUtDevReturn@@@Z
?iCloseComm@OTIM004CardSenderDev@@QAEHXZ
?iSetCommPara@OTIM004CardSenderDev@@QAEHPAUtDevReturn@@@Z
?iGetCurFileProgress@OTIM004CardSenderDev@@QAEHPAU_tTIM004_Pdl_Progress@@@Z
??1OTIM004CardSenderDev@@UAE@XZ
?iRFWriteBlock@OTIM004CardSenderDev@@QAEHEEPADPAUtDevReturn@@@Z
?GetDevBase@OTIM004CardSenderDev@@QAEPAVODevBase@@XZ
?iDownloadFile@OTIM004CardSenderDev@@QAEHPBDPAUtDevReturn@@@Z
?iGetDevVersion@OTIM004CardSenderDev@@QAEHPADAAEPAUtDevReturn@@@Z
?iSetModelCfg@OTIM004CardSenderDev@@QAEHEEEPAUtDevReturn@@@Z
?iBeep@OTIM004CardSenderDev@@QAEHEEEPAUtDevReturn@@@Z
?iCardForgetRecover@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iSendCardEx@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iDCMotorCtrl@OTIM004CardSenderDev@@QAEHEEGPAUtTIM004SensorStatus@@PAUtDevReturn@@@Z
?iFrictionMotorCtrl@OTIM004CardSenderDev@@QAEHEEGPAUtTIM004SensorStatus@@PAUtDevReturn@@@Z
?iMainMotorCtrl@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtDevReturn@@@Z
?iGetRFIDCardInfo@OTIM004CardSenderDev@@QAEHHPAEPAUtDevReturn@@@Z
?iGetTicketBoxSerialNumber@OTIM004CardSenderDev@@QAEHHPADAAEPAUtDevReturn@@@Z
?iAttachTicketBox@OTIM004CardSenderDev@@QAEHHPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAUtDevReturn@@@Z
?iDetachTicketBox@OTIM004CardSenderDev@@QAEHHPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAUtDevReturn@@@Z
?iRetractCard@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iSendCard@OTIM004CardSenderDev@@QAEHPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iCardOut@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iPurge@OTIM004CardSenderDev@@QAEHPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iGetDevStatus@OTIM004CardSenderDev@@QAEHPAUtTIM004DevStatus@@PAUtDevReturn@@@Z
?iInit@OTIM004CardSenderDev@@QAEHEEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iReadLogInfoEx@OTIM004CardSenderDev@@QAEHQAUtLogInfoEx@@PAUtDevReturn@@@Z
?iClearLog@OTIM004CardSenderDev@@QAEHPAUtDevReturn@@@Z
?iReadLogDataEx@OTIM004CardSenderDev@@QAEHIIPAEPAUtDevReturn@@@Z
?vGetLogicalDevName@OTIM004CardSenderDev@@QAEXPAD@Z
?iWriteLogDataEx@OTIM004CardSenderDev@@QAEHIIPAEPAUtDevReturn@@@Z
?iGetModelCfg@OTIM004CardSenderDev@@QAEHPAUtDevReturn@@@Z
?iCarArrive@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iRFWriteSector@OTIM004CardSenderDev@@QAEHEEPADPAUtDevReturn@@@Z
?iGetDevVersionAndCPLDVersion@OTIM004CardSenderDev@@QAEHPADAAE0101PAUtDevReturn@@@Z
?iSetCardNums@OTIM004CardSenderDev@@QAEHPAUtTIM004CardNum@@PAUtDevReturn@@@Z
?iRFIDSwitch@OTIM004CardSenderDev@@QAEHEPAUtTIM004SensorStatus@@PAUtTIM004CardNum@@PAEPAUtDevReturn@@@Z
?iGetSerialNumber@OTIM004CardSenderDev@@QAEHPADAAEPAUtDevReturn@@@Z
?iSetSerialNumber@OTIM004CardSenderDev@@QAEHPBDEPAUtDevReturn@@@Z
?iCleariButton@OTIM004CardSenderDev@@QAEHEPAUtDevReturn@@@Z
?iGetiButton@OTIM004CardSenderDev@@QAEHEEPAEAAEPAUtDevReturn@@@Z
?iGetiButtonID@OTIM004CardSenderDev@@QAEHEPAEAAEPAUtDevReturn@@@Z
?iGetLog@OTIM004CardSenderDev@@QAEHEEEPAUtDevReturn@@@Z
?iGetLogInfo@OTIM004CardSenderDev@@QAEHPAUtLogInfo@@PAUtDevReturn@@@Z
?iSetiButton@OTIM004CardSenderDev@@QAEHEEQAEEPAUtDevReturn@@@Z
?iGetAuditData@OTIM004CardSenderDev@@QAEHPAUtTIM004AuditCardNum@@PAUtDevReturn@@@Z
?iSetBeforeProdOut@OTIM004CardSenderDev@@QAEHPAUtDevReturn@@@Z
?iGetVersion@OTIM004CardSenderDev@@QAEHPAD@Z
?iGetDevType@OTIM004CardSenderDev@@QAEHPADAAEPAUtDevReturn@@@Z
?iSetDevType@OTIM004CardSenderDev@@QAEHPADEPAUtDevReturn@@@Z
?vSetLogicalDevName@OTIM004CardSenderDev@@QAEXPBD@Z
?tGetErrorFlag@OTIM004CardSenderDev@@QAE?AUtDevReturn@@XZ
?iGetErrorFlag@OTIM004CardSenderDev@@QAEHXZ
?iSetTicketBoxSerialNumber@OTIM004CardSenderDev@@QAEHHPADEPAUtDevReturn@@@Z
?iSwitchDirectionMotorControl@OTIM004CardSenderDev@@QAEHEEGPAUtTIM004SensorStatus@@PAUtDevReturn@@@Z
?iScraperMotorCtrl@OTIM004CardSenderDev@@QAEHEEGPAUtTIM004SensorStatus@@PAUtDevReturn@@@Z
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE