3e809ad946df4db2d4c3d3f341b1d4c94e1c7f44e96ac07e9905dfc3b949b054

Sharing

Copy URL Twitter E-mail

General

Target

3e809ad946df4db2d4c3d3f341b1d4c94e1c7f44e96ac07e9905dfc3b949b054
Size

748KB
MD5

43abf92cd104624fa6042772e369f909
SHA1

58e398fd4e2bbf1896a8d4968a8180c88a24539e
SHA256

3e809ad946df4db2d4c3d3f341b1d4c94e1c7f44e96ac07e9905dfc3b949b054
SHA512

ab5837935625b87eab3e15d6f2430cee5eb97d160fc4e59a277c9052a976da400b4bf5bda4fc5e0242bf59de27b6ca630c7b2f341f13a3e5c32e2b634622a3d1
SSDEEP

12288:yMl6QU2o3MvoMlWZ7LTh8+BTkwZWbH0vj8/nfEYYvKQpNrqIQs+lxeZaz:r6QoMQlDBTkH0vjCfEYYLpNrs9z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e809ad946df4db2d4c3d3f341b1d4c94e1c7f44e96ac07e9905dfc3b949b054

Files

3e809ad946df4db2d4c3d3f341b1d4c94e1c7f44e96ac07e9905dfc3b949b054
.dll windows x86

8123b094967bd3313e20e24771fd2d4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

cschangetext

ord8
ord4
ord6

baseinterface

?ScannerSettingFolder@@YA?AVCString@@XZ
?LaserSettingIni@@YA?AVCString@@XZ
?WriteConfigProfileString@@YAHPBD000@Z
?GetConfigProfileDouble@@YANPBD0N0@Z
?WriteConfigProfileInt@@YAHPBD0H0@Z
?GetConfigProfileInt@@YAHPBD0H0@Z
?MmToOthers@@YANN@Z
?GetUnit@@YAHXZ
?OthersToMm@@YANN@Z
GetUserConfigPath
?ScannerSettingIni@@YA?AVCString@@XZ
?GetConfigProfileString@@YAKPBD00PADK0@Z
?WriteConfigProfileDouble@@YAHPBD0N0@Z

mfc42

ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord800
ord641
ord860
ord540
ord324
ord825
ord2370
ord4234
ord6334
ord2379
ord4710
ord2575
ord6055
ord1776
ord4396
ord5290
ord3402
ord4424
ord3574
ord3571
ord609
ord567
ord3663
ord3626
ord2414
ord2367
ord2302
ord4299
ord1641
ord1146
ord1200
ord535
ord858
ord922
ord2818
ord537
ord6199
ord3092
ord2289
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord2301
ord2358
ord2864
ord668
ord1980
ord3185
ord2781
ord2770
ord924
ord356
ord941
ord939
ord926
ord2393
ord5583
ord3317
ord5981
ord3097
ord2642
ord6215
ord798
ord6648
ord1997
ord4129
ord5465
ord5194
ord533
ord2915
ord1140
ord6877
ord6407
ord5710
ord3610
ord2582
ord4402
ord3370
ord3640
ord693
ord5065
ord2363
ord3181
ord4204
ord3178
ord823
ord6453
ord3499
ord2515
ord355
ord4224
ord2764
ord3177
ord665
ord603
ord1979
ord1969
ord2801
ord6663
ord5461
ord273
ord5186
ord354
ord6404
ord3301
ord6762
ord6907
ord3874
ord6929
ord3998
ord686
ord3996
ord2862
ord2096
ord384
ord6696
ord1168
ord1253
ord342
ord1182
ord5572
ord6883
ord6467
ord1154
ord3398
ord3733
ord810
ord3920
ord6880
ord2086
ord4000
ord2425
ord801
ord541
ord1199
ord1948
ord2396
ord3346
ord5300
ord5303
ord4079
ord4699
ord5307
ord5289
ord5715
ord4622
ord565
ord817
ord2726
ord4226
ord2298
ord1106
ord2362
ord2452
ord4275
ord640
ord5875
ord1640
ord323
ord2243
ord2089
ord4278
ord6662
ord2080
ord2078
ord2516
ord361
ord5683
ord2513
ord293
ord4124
ord613
ord289
ord4133
ord4297
ord6119
ord4694
ord5148
ord2291
ord2294
ord755
ord2405
ord5794
ord5785
ord470
ord6007
ord6905
ord5608
ord2847
ord6143
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord656

msvcrt

_onexit
__dllonexit
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
time
srand
rand
strncpy
printf
malloc
free
sprintf
_vsnprintf
_CxxThrowException
__CxxFrameHandler
_ftol
atof
_mbscmp
atoi
_splitpath

kernel32

WritePrivateProfileStringA
GetPrivateProfileIntA
OutputDebugStringA
lstrcpyA
lstrlenA
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameA
CopyFileA
DeleteFileA
CreateDirectoryA
Sleep
GetPrivateProfileStringA
GetTickCount

user32

EnableWindow
GetWindowRect
GetDC
SendMessageA
LoadBitmapA
SetTimer
SetCursor
GetClientRect
SetCapture
GetCapture
ReleaseCapture
ClipCursor
InvalidateRect
LoadCursorA
PostQuitMessage
UpdateWindow
UnregisterHotKey
RegisterHotKey
IsWindowVisible
SetParent
ShowCaret
GetParent
IsWindow
KillTimer

gdi32

GetObjectA
CreateCompatibleDC
StretchBlt
GetTextExtentPoint32A
GetDeviceCaps

shlwapi

PathIsDirectoryA

usbdevice

ord540
ord548
ord551
ord542
ord552
ord609
ord612
ord541
ord565
ord553
ord593
ord596
ord594
ord613
ord602
ord603
ord624
ord635
ord534
ord557
ord558
ord559
ord628
ord638
ord536
ord537
ord644
ord597
ord587
ord623
ord599
ord591
ord590
ord589
ord600
ord598
ord588
ord42
ord630
ord32
ord626
ord535
ord632
ord645

Exports

Exports

CanPreviewToMarkAuto
CloseAdjustThread
CloseMotorStatusThread
CorrectCurrent
DbgPrint
DownloadMarkSettings
EnInvertPWM
EnSetPulseWidth
FreeEMSetting
GetAdjustEnergyProperty
GetAdjustSpace
GetAssSnapState
GetAssState
GetAutoPreviewState
GetCO2DutyLimit
GetCorDatatType
GetCorrectFileName
GetCorrectFolderName
GetCorrectMode
GetCurrentUserLevel
GetFrequencyLimit
GetGridSnapState
GetGridSpace
GetGridState
GetHomeType
GetIPG_PWM_Type
GetInputPortSetting
GetLaserType
GetLightCorrect
GetLightSpeed
GetMarkIOSetting
GetMaxCurrent
GetModuleMaxHomeTime
GetMotorDirection
GetMotorHomeSpeed
GetMotorParameters
GetMotorSpeedSetting
GetMotorStepSpeed
GetMotorWorkSpace
GetObjectSnapState
GetOptimizationCenter
GetOptimizationCutting
GetOptimizationFill
GetOriginPos
GetOriginXYZ
GetOutputPortSetting
GetPA_MO_Delay
GetPasteOffset
GetPreionization
GetPrintLogoSetting
GetPrinterSetting
GetPulseMode
GetRotateCorrectInfo
GetRotateDelay
GetRotateRatio
GetRotateSplitAngleRange
GetRotateSplitType
GetRulerState
GetSPIProperty
GetSafePort
GetSafetyMarkState
GetScannerDynamicNum
GetScannerModeName
GetScannerModeNum
GetScannerType
GetSortType
GetSplitSize
GetSplitType
GetStepMotorSetting
GetTableHomePos
GetWorkpieceInfo
GetWorkpieceSplitInfo
GetWorkspaceSize
GetXCorrectPara
GetYCorrectPara
GetZCorrect
GetZCorrectOffset
GetZDefaultPos
GetZHeight
GetZMode
GetZOffsets
HideAdjustWindow
HideModuleAdjustWindow
HideMotorStatusWindow
InitializeAdjustEnergy
InitializeLaserSetting
IsAdjustWindowVisible
IsFinishedHome
IsModuleAdjustWindowVisible
IsMotorStatusWindowVisible
IsMotorXEnable
IsMotorYEnable
IsNewAdjustType
IsRotateMarkEnable
IsRotateMarkFinishedHome
IsScannerAutomic
IsScannerAutomicHomeInit
IsScannerAutomicHomeRangeChange
IsSplitMarkEnable
IsTableModuleEnable
ReadCorrectPara_0
ReadCorrectPara_1
ReadCorrectPara_PV
ReadMotorPara
ReadSystemPara
RefreshAdjustWindow
RefreshMotorStatusWindow
ResetCorrectMode
ResetDynamicModulePos
ResetMotorZProperty
ResetTableModulePos
SetAssSnapState
SetAssState
SetCurCSCBoard
SetGridSnapState
SetGridState
SetMotorHomeSpeed
SetMotorSpeedSetting
SetObjectSnapState
SetRulerState
SetSafetyMarkState
ShowAdjustWindow
ShowEMSettingDlg
ShowModuleAdjustWindow
ShowMotorStatusWindow
ShowRotateMarkWindow
ShowSplitMarkWindow
ShowTableAdjustWindow
StartAdjustThread
StartMotorStatusThread
TableModuleHome
TransMotorValue

Sections

.text
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8123b094967bd3313e20e24771fd2d4d

Headers

File Characteristics

Imports

cschangetext

baseinterface

mfc42

msvcrt

kernel32

user32

gdi32

shlwapi

usbdevice

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 152KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 492KB - Virtual size: 491KB

.rsrc Size: 44KB - Virtual size: 43KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 156KB - Virtual size: 152KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 492KB - Virtual size: 491KB

.rsrc
Size: 44KB - Virtual size: 43KB

.reloc
Size: 20KB - Virtual size: 17KB