9629fb0722b70a373968611ea8551139ef724427ef43608383f3a8ff1790b361

Sharing

Copy URL

Twitter E-mail

General

Target

9629fb0722b70a373968611ea8551139ef724427ef43608383f3a8ff1790b361
Size

315KB
MD5

95f14e97f79379045eea0768c3863cae
SHA1

fcd2d10f3d3e37af1ca8814be94777e1f85aabf2
SHA256

9629fb0722b70a373968611ea8551139ef724427ef43608383f3a8ff1790b361
SHA512

bf2ace7d5491ff5a693d06b9b8cb28ef8f2832947c17aa56e8fac01c740125183c5c4320728ad032ef659ca0af41adfc7cda0c00e5a4abddd5fdfd86506c643e
SSDEEP

6144:2ToWRoPudFNVtnF2B/3X27cn56r2R+u583ZQqKHM:ZPIBF2B/3XkS56qREZQqKHM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9629fb0722b70a373968611ea8551139ef724427ef43608383f3a8ff1790b361

Files

9629fb0722b70a373968611ea8551139ef724427ef43608383f3a8ff1790b361
.dll regsvr32 windows x86

1067f2fb79bb9668210219e5940afce3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetGetConnectedState
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
HttpAddRequestHeadersA
InternetCrackUrlA

iphlpapi

GetAdaptersInfo

jtobj

?SetJTLotSizeData@@YAXPBD@Z
?JTSetAuth@@YAXPBD@Z
?JTSetExecOrderType@@YAXH@Z
?JTMsgConnect@@YAHHPBD0HH0000H0@Z
?JTSetTSServiceType@@YAXPBDK@Z
?JTAddMsg@@YAHPBD0H@Z
?JTRemoveMsg@@YAHPBD0@Z
??0CCJTApp@@QAE@XZ
??1CCJTApp@@QAE@XZ
?AddNotifyInProc@CCJTApp@@QAEJPAUIIJTAppNotify@@PAK@Z
?RemoveNotifyInProc@CCJTApp@@QAEJK@Z
?tsInit@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@KPAH@Z
?tsGetConfig@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV23@@Z
?SetIJTLotSize@@YAXPAUIJTLotSize@@@Z
?tsGetResult@CCJTApp@@QAEJKAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?tsReleaseResult@CCJTApp@@QAEJK@Z
?tsAddCA@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAUCAInfo@@@Z
?tsGetCA@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HPAUCAInfo@@0@Z
?tsClearAccount2@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAUAccInfo@@@Z
?tsAddAccount2@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAUAccInfo@@@Z
?tsGetSingleStockQuota@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV23@11@Z
?Load@CCJTApp@@QAEJXZ
?JTOnMsgNotify@@YAHPBDHHPAE0AAH@Z
?JTInitData@@YAHPBD00000H@Z
?JTFini@@YAXXZ
?JTInit@@YAHPAUHINSTANCE__@@PBD11@Z
?GetLocalIP@CCJTApp@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?tsCall@CCJTApp@@QAEJABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0K@Z
?JTSetTDate@@YAHPBDHPAUDAS_TDATE@@@Z
?JTMsgDisconnect@@YAXPBDH@Z

mfc110

ord12020
ord5765
ord3786
ord6694
ord987
ord6193
ord14402
ord6194
ord14403
ord6192
ord14401
ord7811
ord12307
ord14201
ord11765
ord11766
ord1978
ord7753
ord12720
ord4023
ord4084
ord9203
ord14327
ord7734
ord14329
ord12317
ord12318
ord2430
ord5212
ord8130
ord7808
ord4519
ord12638
ord12701
ord10228
ord12028
ord8191
ord1459
ord7470
ord8273
ord2144
ord2322
ord6590
ord12125
ord14338
ord12182
ord14391
ord13704
ord3175
ord4780
ord262
ord1687
ord14155
ord4595
ord13705
ord13020
ord12415
ord970
ord1440
ord6345
ord948
ord14186
ord818
ord12451
ord1950
ord1344
ord491
ord1132
ord2115
ord2199
ord2245
ord12658
ord967
ord1437
ord11755
ord14357
ord2840
ord979
ord1452
ord553
ord8311
ord1645
ord12467
ord1176
ord306
ord1519
ord2384
ord12538
ord4672
ord4256
ord8571
ord556
ord8314
ord1648
ord12470
ord12377
ord6027
ord1179
ord12374
ord6024
ord1518
ord13019
ord8025
ord1641
ord6643
ord554
ord12375
ord1177
ord311
ord301
ord4977
ord6160
ord4026
ord1134
ord500
ord7311
ord11912
ord6064
ord13498
ord2704
ord9017
ord11953
ord1102
ord8848
ord10808
ord11180
ord10266
ord4025
ord457
ord3340
ord3341
ord3104
ord6936
ord3243
ord3240
ord10052
ord8018
ord10082
ord10084
ord10083
ord10081
ord10085
ord5507
ord11509
ord11510
ord8947
ord11870
ord3772
ord11719
ord14322
ord8773
ord6809
ord10795
ord9063
ord3204
ord13619
ord12040
ord12038
ord1702
ord1711
ord1719
ord1715
ord1724
ord4842
ord4879
ord4850
ord4862
ord4858
ord4854
ord4885
ord4875
ord4846
ord4889
ord4867
ord4831
ord4837
ord4870
ord4432
ord5643
ord9495
ord4424
ord2995
ord14330
ord7735
ord14328
ord14242
ord6710
ord11501
ord13449
ord5782
ord2626
ord11905
ord3874
ord3308
ord3309
ord3203
ord11949
ord5107
ord5404
ord5614
ord9155
ord5380
ord5110
ord5266
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord3750
ord1438
ord13018
ord968
ord1401
ord13017
ord13703
ord12032
ord12000
ord5617
ord10047
ord9016
ord3783
ord1043
ord323
ord8270
ord14149
ord1500
ord1498
ord265
ord266
ord2329
ord2343
ord2242
ord2128
ord922
ord4746
ord8166
ord12695
ord8525
ord4594
ord2937
ord2931
ord5769
ord1683
ord1520
ord1517
ord1038
ord310
ord300
ord305
ord316
ord2950
ord14059
ord7991
ord5732
ord4941
ord1652
ord2333
ord2327
ord1501
ord324
ord1044
ord2305
ord2189
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316

msvcr110

atoi
_lock
atof
sprintf
strncpy
_CxxThrowException
strcat
realloc
_vsnprintf
_mbsnbcpy
strchr
memcpy
_resetstkoflw
_recalloc
free
calloc
_mbsrchr
wcsncpy_s
wcslen
memcmp
_purecall
memset
ldiv
_mktime64
strtol
strlen
strcpy
isdigit
__CxxFrameHandler3
_time64
malloc
__clean_type_info_names_internal
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileIntA
GetModuleHandleW
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
SetEvent
TerminateThread
GetExitCodeThread
GetLastError
ResumeThread
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
CreateDirectoryA
GetFileAttributesA
FreeLibrary
LoadLibraryA
HeapFree
HeapAlloc
GetProcAddress
InterlockedDecrement
InterlockedIncrement
lstrlenA
GetCurrentProcessId
SetCurrentDirectoryA
GetCurrentDirectoryA
GetSystemTimeAsFileTime
GetCurrentThreadId
LocalAlloc
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
LocalFree

user32

LoadStringA
CharNextW
EnableWindow

atl110

ord64
ord58
ord56
ord68
ord23
ord49
ord15
ord32
ord31
ord61

ole32

CoCreateFreeThreadedMarshaler
CoUnmarshalInterface
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoMarshalInterface
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeType
SysAllocStringByteLen
SysFreeString
SysStringLen
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
VariantInit
VariantClear
SysStringByteLen

dalog

??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?Write@CDALog@@QAAXPBDZZ
?DALogInit@@YAHPBDHJ_N1H@Z
?DALogFini@@YAXXZ
??0CDALog@@QAE@XZ
??1CDALog@@QAE@XZ
??RCDALog@@QAEAAV0@W4Lvl@0@PBD@Z
?Content@CDALog@@QAAXPBD0ZZ
?Write@CDALog@@QAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?storage@CDALog@@QAEXPBD00_N1@Z

gzip2

Gzip2A

Exports

Exports

?DJTradeAddNotify@@YAHPAUIDJTradeNotify@@@Z
?DJTradeConnect@@YAHPBD@Z
?DJTradeDisconnect@@YAXPBD@Z
?DJTradeFini2@@YAXPBDPAUIDJTradeNotify@@@Z
?DJTradeFini@@YAXXZ
?DJTradeFutOpt_CancelOrder@@YAHPBDH00HHHHHH0H0H0HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_ModifyOrder@@YAHPBDHH00HHHHHH0H0H0HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_NewOrder@@YAHPBDHH0HH0HHH0HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_QueryEquity@@YAHPBD0AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_QueryMatch@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_QueryOI@@YAHPBDHHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_QueryOneOrder@@YAHPBD00HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeFutOpt_QueryOrder@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeGetAccount@@YAHHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?DJTradeGetAccountCount@@YAJPBD@Z
?DJTradeGetAccountList@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?DJTradeGetConfig@@YAHPBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeHK_ModifyOrder@@YAHPBDHHH00HHHHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeHK_NewOrder@@YAHPBDHHHH0HH0AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeHK_QueryMatch@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeHK_QueryOrder@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeHK_QueryPosition@@YAHPBDHHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeInit2@@YAHPBD0000AAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAUIDJTradeNotify@@@Z
?DJTradeInit@@YAHPBDAAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeLogin@@YAHPBD000AAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeLogout@@YAXPBD@Z
?DJTradeMIX_QueryData@@YAHPBDH00AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeRemoveNotify@@YAXPAUIDJTradeNotify@@@Z
?DJTradeSetEchoType@@YAHHH@Z
?DJTradeSetExecOrderType@@YAXH@Z
?DJTradeSetILotSize@@YAHPAUIJTLotSize@@@Z
?DJTradeSetLogPath@@YAHPBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeSetLotSizeData@@YAHPBD@Z
?DJTradeStock_CancelOrder@@YAHPBDHHH000HHHHHH0HAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeStock_ModifyOrder@@YAHPBDHHH000HHHHHH0HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeStock_NewOrder@@YAHPBDHHHH0HH00HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeStock_QueryMatch@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeStock_QueryOneOrder@@YAHPBDH00HHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeStock_QueryOrder@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTradeStock_QueryPosition@@YAHPBDHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_CALocalSignTest@@YAHPBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_CASetting@@YAHPBD00AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_CASignCheck@@YAHPBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_CASignStatus@@YAHPBD0HAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_GetData@@YAHPBD0AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_GetSingleStockQuota@@YAHPBD00AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_GetTDate@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_InitCAModule@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DJTrade_SetTDate@@YAHPBDHPAUDAS_TDATE@@@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1067f2fb79bb9668210219e5940afce3

Headers

DLL Characteristics

File Characteristics

Imports

wininet

iphlpapi

jtobj

mfc110

msvcr110

kernel32

user32

atl110

ole32

oleaut32

dalog

gzip2

Exports

Exports

Sections

.text Size: 195KB - Virtual size: 194KB

.rdata Size: 73KB - Virtual size: 72KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 195KB - Virtual size: 194KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 30KB - Virtual size: 30KB