14d253cc8bb4c1c009dd92c09d79fde8ed1f6585fc17c1fa6f49b270116e1de1

Sharing

Copy URL Twitter E-mail

General

Target

14d253cc8bb4c1c009dd92c09d79fde8ed1f6585fc17c1fa6f49b270116e1de1
Size

110KB
MD5

431065ccd54cd5cf176a51b575916a12
SHA1

77db1cff617e4b84d036ad85c89091e1ce7aaf99
SHA256

14d253cc8bb4c1c009dd92c09d79fde8ed1f6585fc17c1fa6f49b270116e1de1
SHA512

b800d9ec0b3bff5ab7aa391d1a3abc0c96b6a902c5b5f8ebf8c6385e1dfea34f4a69d30bdc0fccc06222d5fffd7cd2f9e7ebe5c4ce78a340185133aab0491063
SSDEEP

3072:MnxYYYYhrqse0lY0MUlf9uFDkXMLPnVL2Stva1hpBqybH:Q3lAZVL2StvUpBqyb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14d253cc8bb4c1c009dd92c09d79fde8ed1f6585fc17c1fa6f49b270116e1de1

Files

14d253cc8bb4c1c009dd92c09d79fde8ed1f6585fc17c1fa6f49b270116e1de1
.dll windows x86

495abaf2759b8d6603679ab51c8d67e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetGetConnectedState
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpQueryInfoA

mfc110

ord14186
ord948
ord1132
ord491
ord2115
ord2189
ord12388
ord1955
ord1344
ord7848
ord12414
ord1950
ord1831
ord12451
ord818
ord1438
ord12417
ord13018
ord968
ord13020
ord13705
ord8525
ord4595
ord12361
ord2937
ord2931
ord1687
ord1520
ord1517
ord310
ord300
ord6345
ord2343
ord2242
ord485
ord1440
ord970
ord13019
ord13704
ord4746
ord1038
ord316
ord5732
ord1652
ord6590
ord2333
ord2327
ord2329
ord266
ord265
ord1498
ord1500
ord3783
ord1501
ord324
ord1044
ord2305
ord323
ord1043
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316
ord2128

msvcr110

free
_mktime64
_time64
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
realloc
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
__CppXcptFilter
_amsg_exit
_malloc_crt
malloc
__clean_type_info_names_internal
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_purecall
toupper
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
_mbsnbcpy_s
_errno
atoi
strtoul
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
memset
strcpy_s
strchr
_mbsrchr
printf
_initterm

kernel32

TerminateThread
GetExitCodeThread
ResumeThread
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
GetCurrentThreadId
GlobalFree
GetModuleFileNameA
WideCharToMultiByte
LocalAlloc
LocalFree
EncodePointer
DecodePointer
IsDebuggerPresent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetLastError
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter

ole32

StringFromGUID2
CoCreateGuid

oleaut32

SysFreeString

dalog

??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?Write@CDALog@@QAAXPBDZZ
??0CDALog@@QAE@XZ
??1CDALog@@QAE@XZ
?storage@CDALog@@QAEXPBD00_N1@Z

msvcp110

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xinvalid_argument@std@@YAXPBD@Z

gzip2

Gzip2A

Exports

Exports

??0CCurlHttpFetcher@JDUtil@@QAE@XZ
??0CJDHttpFetcher@JDUtil@@QAE@XZ
??0CJDMemBuffer@JDUtil@@QAE@ABV01@@Z
??0CJDMemBuffer@JDUtil@@QAE@II@Z
??0CJDMemRWBuffer@JDUtil@@QAE@ABV01@@Z
??0CJDMemRWBuffer@JDUtil@@QAE@II@Z
??0CJDReqObject@JDUtil@@QAE@XZ
??0CJDReqQueue@JDUtil@@QAE@XZ
??0CJDReqThread@JDUtil@@QAE@PAUIJDReqThreadRunnable@1@@Z
??0CJDTimerThread@JDUtil@@QAE@PAUIJDTimerThreadRunnable@1@K@Z
??1CCurlHttpFetcher@JDUtil@@QAE@XZ
??1CJDHttpFetcher@JDUtil@@QAE@XZ
??1CJDMemBuffer@JDUtil@@UAE@XZ
??1CJDMemRWBuffer@JDUtil@@UAE@XZ
??1CJDReqObject@JDUtil@@UAE@XZ
??1CJDReqQueue@JDUtil@@UAE@XZ
??1CJDReqThread@JDUtil@@UAE@XZ
??1CJDTimerThread@JDUtil@@UAE@XZ
??4CCurlHttpFetcher@JDUtil@@QAEAAV01@ABV01@@Z
??4CJDMemBuffer@JDUtil@@QAEAAV01@ABV01@@Z
??4CJDMemRWBuffer@JDUtil@@QAEAAV01@ABV01@@Z
??_7CJDMemBuffer@JDUtil@@6B@
??_7CJDMemRWBuffer@JDUtil@@6B@
??_7CJDReqObject@JDUtil@@6B@
??_7CJDReqQueue@JDUtil@@6B@
??_7CJDReqThread@JDUtil@@6B@
??_7CJDTimerThread@JDUtil@@6B@
??_FCJDMemBuffer@JDUtil@@QAEXXZ
??_FCJDMemRWBuffer@JDUtil@@QAEXXZ
?AddHeader@CCurlHttpFetcher@JDUtil@@QAEXPBD0@Z
?AddHeader@CJDHttpFetcher@JDUtil@@QAEXPBD0@Z
?AddRequest2@CJDReqQueue@JDUtil@@QAEHPAVCObject@@H@Z
?AddRequest3@CJDReqQueue@JDUtil@@QAEHPAVCObject@@@Z
?AddRequest@CJDReqQueue@JDUtil@@QAEHPAVCObject@@@Z
?Alloc@CJDMemBuffer@JDUtil@@MAEPADK@Z
?Clear@CJDMemBuffer@JDUtil@@UAEXXZ
?ClearQueue@CJDReqQueue@JDUtil@@QAEXXZ
?ClearTime@CJDHttpFetcher@JDUtil@@QAEXXZ
?CloseSession@CJDHttpFetcher@JDUtil@@IAEXXZ
?CrackUrl@CJDHttpFetcher@JDUtil@@IAE?AW4Protocol@12@PAD00PAG@Z
?Decompress@CCurlHttpFetcher@JDUtil@@QAEJPAPAE@Z
?Decompress@CJDHttpFetcher@JDUtil@@QAEJPAPAE@Z
?EndRequest@CCurlHttpFetcher@JDUtil@@QAEXXZ
?EndRequest@CJDHttpFetcher@JDUtil@@QAEXXZ
?FindHeader@CCurlHttpFetcher@JDUtil@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@ABV34@@Z
?FindHeader@CJDHttpFetcher@JDUtil@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@ABV34@@Z
?Fini@CCurlHttpFetcher@JDUtil@@QAEXXZ
?Fini@CJDHttpFetcher@JDUtil@@QAEXXZ
?FiniHelper@CJDHttpFetcher@JDUtil@@QAEXXZ
?Free@CJDMemBuffer@JDUtil@@MAEXPAD@Z
?GetData@CJDMemBuffer@JDUtil@@QAEPBDXZ
?GetHeadPosition@CJDReqQueue@JDUtil@@QAEPAU__POSITION@@XZ
?GetNext@CJDReqQueue@JDUtil@@QAEPAVCObject@@AAPAU__POSITION@@@Z
?GetQueueCount@CJDReqQueue@JDUtil@@QAEHXZ
?GetResponse@CCurlHttpFetcher@JDUtil@@QAEPAEXZ
?GetResponse@CJDHttpFetcher@JDUtil@@QAEPAEXZ
?GetResponseHttpStatus@CCurlHttpFetcher@JDUtil@@QAEHXZ
?GetResponseHttpStatus@CJDHttpFetcher@JDUtil@@QAEHXZ
?GetResponseSize@CCurlHttpFetcher@JDUtil@@QAEJXZ
?GetResponseSize@CJDHttpFetcher@JDUtil@@QAEJXZ
?GetSize@CJDMemBuffer@JDUtil@@QAEIXZ
?GetTimer@CJDTimerThread@JDUtil@@QAEHXZ
?Grow@CJDMemBuffer@JDUtil@@MAEXK@Z
?Init@CCurlHttpFetcher@JDUtil@@QAEHXZ
?Init@CJDHttpFetcher@JDUtil@@QAEHXZ
?InitHelper@CJDHttpFetcher@JDUtil@@QAEHXZ
?IsDataBufferReady@CJDHttpFetcher@JDUtil@@IAEHXZ
?IsEncoding@CCurlHttpFetcher@JDUtil@@QAEHXZ
?IsEncoding@CJDHttpFetcher@JDUtil@@QAEHXZ
?IsInit@CCurlHttpFetcher@JDUtil@@QAEHXZ
?IsInit@CJDHttpFetcher@JDUtil@@QAEHXZ
?IsSessionReady@CJDHttpFetcher@JDUtil@@IAEHH@Z
?JDUtil_IsUseWinInet@JDUtil@@YAHXZ
?JDUtil_TimeFormatter_HHMMSS@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@N@Z
?JDUtil_gfnCurlReadHTML@JDUtil@@YA?AW4ErrorCode@1@PAVCCurlHttpFetcher@1@PBDPAPAEAAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAVCTime32@@K@Z
?JDUtil_gfnCurlReadHTML@JDUtil@@YA?AW4ErrorCode@1@PAVCCurlHttpFetcher@1@PBDPAPAEAAJK@Z
?JDUtil_gfnCurlReadHTMLWithCurlHttpFetcher@JDUtil@@YA?AW4ErrorCode@1@PBDPAPAEAAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAVCTime32@@K@Z
?JDUtil_gfnCurlReadHTMLWithPostData@JDUtil@@YA?AW4ErrorCode@1@PAVCCurlHttpFetcher@1@PBDPAPAEAAJKPAEJ@Z
?JDUtil_gfnGenerateGUID2@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?JDUtil_gfnGenerateGUID@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?JDUtil_gfnGetExpiredTime@JDUtil@@YA?AVCTime32@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?JDUtil_gfnMerge@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV?$vector@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V?$allocator@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@std@@@std@@D@Z
?JDUtil_gfnMerge@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCStringArray@@D@Z
?JDUtil_gfnMerge@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCStringList@@D@Z
?JDUtil_gfnMerge@JDUtil@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCUIntArray@@D@Z
?JDUtil_gfnReadHTML@JDUtil@@YA?AW4ErrorCode@1@PAVCJDHttpFetcher@1@PBDPAPAEAAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAVCTime32@@K@Z
?JDUtil_gfnReadHTML@JDUtil@@YA?AW4ErrorCode@1@PAVCJDHttpFetcher@1@PBDPAPAEAAJK@Z
?JDUtil_gfnReadHTMLWithHttpFetcher@JDUtil@@YA?AW4ErrorCode@1@PBDPAPAEAAJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAVCTime32@@K@Z
?JDUtil_gfnReadHTMLWithPostData@JDUtil@@YA?AW4ErrorCode@1@PAVCJDHttpFetcher@1@PBDPAPAEAAJKPAEJ@Z
?JDUtil_gfnSplit@JDUtil@@YAXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV?$vector@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V?$allocator@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@std@@@std@@DH@Z
?JDUtil_gfnSplit@JDUtil@@YAXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCStringArray@@D@Z
?JDUtil_gfnSplit@JDUtil@@YAXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCStringList@@D@Z
?JDUtil_gfnSplit@JDUtil@@YAXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCUIntArray@@D@Z
?LockQueue@CJDReqQueue@JDUtil@@QAEXXZ
?Memcpy@CJDMemBuffer@JDUtil@@MAEPADPADPBDI@Z
?OnThreadProc@CJDReqThread@JDUtil@@IAEIXZ
?OnThreadProc@CJDTimerThread@JDUtil@@IAEIXZ
?ParseHeader@CJDHttpFetcher@JDUtil@@IAEXPAD@Z
?QueueEvent@CJDReqQueue@JDUtil@@QAEPAXXZ
?Read@CJDMemRWBuffer@JDUtil@@QAEXPAXK@Z
?ReadString@CJDMemRWBuffer@JDUtil@@QAEHHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Realloc@CJDMemBuffer@JDUtil@@MAEPADPADK@Z
?RemoveAt@CJDReqQueue@JDUtil@@QAEXPAU__POSITION@@@Z
?RemoveHeader@CCurlHttpFetcher@JDUtil@@QAEXPBD@Z
?RemoveHeader@CJDHttpFetcher@JDUtil@@QAEXPBD@Z
?RemoveRequest@CJDReqQueue@JDUtil@@QAEHPAPAVCObject@@H@Z
?RemoveUnused@CJDReqQueue@JDUtil@@QAEXPAVCObject@@@Z
?ReqTime@CJDHttpFetcher@JDUtil@@QAEKXZ
?Request2@CJDHttpFetcher@JDUtil@@QAEKPBD00KPAEH@Z
?Request@CCurlHttpFetcher@JDUtil@@QAEKPBD00K@Z
?Request@CCurlHttpFetcher@JDUtil@@QAEKPBD00KPAEH@Z
?Request@CJDHttpFetcher@JDUtil@@QAEKPBD00K@Z
?Request@CJDHttpFetcher@JDUtil@@QAEKPBD00KPAEH@Z
?SaveData@CJDHttpFetcher@JDUtil@@IAEHPAEI@Z
?SetEvent@CJDReqQueue@JDUtil@@QAEXXZ
?SetNoProxy@CCurlHttpFetcher@JDUtil@@QAEXPBD@Z
?SetProxy@CCurlHttpFetcher@JDUtil@@QAEXPBDG@Z
?SetReq@CJDHttpFetcher@JDUtil@@QAEXK@Z
?SetThreadName@JDUtil@@YAXKPBD@Z
?SetTimer@CJDTimerThread@JDUtil@@QAEXH@Z
?SetZip@CJDHttpFetcher@JDUtil@@QAEXK@Z
?Start@CJDReqThread@JDUtil@@QAEHXZ
?Start@CJDTimerThread@JDUtil@@QAEHXZ
?Stop@CJDReqThread@JDUtil@@QAEXXZ
?Stop@CJDTimerThread@JDUtil@@QAEXXZ
?ThreadProc@CJDReqThread@JDUtil@@KAIPAX@Z
?ThreadProc@CJDTimerThread@JDUtil@@KAIPAX@Z
?UnlockQueue@CJDReqQueue@JDUtil@@QAEXXZ
?Write@CJDMemBuffer@JDUtil@@QAEXD@Z
?Write@CJDMemBuffer@JDUtil@@QAEXPBDH@Z
?ZipTime@CJDHttpFetcher@JDUtil@@QAEKXZ

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

495abaf2759b8d6603679ab51c8d67e5

Headers

DLL Characteristics

File Characteristics

Imports

wininet

mfc110

msvcr110

kernel32

ole32

oleaut32

dalog

msvcp110

gzip2

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB