f8ca4d8f3862b6ea2729714c3bf93dde1cf89bad994ba33a9ea8e49dac5b2d1f

Sharing

Copy URL Twitter E-mail

General

Target

f8ca4d8f3862b6ea2729714c3bf93dde1cf89bad994ba33a9ea8e49dac5b2d1f
Size

78KB
MD5

0e17e58b68abcc54fb8bc6217db7aadb
SHA1

716b166da410f1f0b567c77d21a34053007970b8
SHA256

f8ca4d8f3862b6ea2729714c3bf93dde1cf89bad994ba33a9ea8e49dac5b2d1f
SHA512

73c706aeff233c16c8e7657c14cb6e032e071d5afae482be13ffeb8842b0b3b06bf2dfa234468d7045527403804423a0dae625fe0c51b9383b9d229ee0fa8520
SSDEEP

1536:DLbhcQP6YWmWl9+iZ/ug/P/TVsBmC1iXFE8OLhPIx9Uwc:DdP1cb/z/PrVJyhPIx9a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8ca4d8f3862b6ea2729714c3bf93dde1cf89bad994ba33a9ea8e49dac5b2d1f

Files

f8ca4d8f3862b6ea2729714c3bf93dde1cf89bad994ba33a9ea8e49dac5b2d1f
.dll windows x86

3f0535c53565db5d643cfa185bc265d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc110

ord14327
ord7734
ord14329
ord12317
ord12318
ord2430
ord5212
ord8130
ord7808
ord4519
ord12638
ord12701
ord10228
ord12028
ord8191
ord1459
ord7470
ord8273
ord1517
ord2931
ord4594
ord12695
ord8166
ord13705
ord13020
ord13704
ord2300
ord2474
ord6192
ord6075
ord1706
ord14164
ord1641
ord306
ord1519
ord14149
ord2384
ord2159
ord14403
ord6194
ord14402
ord6193
ord987
ord6694
ord3786
ord9203
ord12020
ord8025
ord12032
ord12000
ord5107
ord5404
ord5614
ord9155
ord5380
ord4023
ord5110
ord5266
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord10047
ord9016
ord2189
ord1438
ord13018
ord13019
ord968
ord1176
ord6024
ord12374
ord1645
ord8311
ord553
ord265
ord310
ord266
ord1401
ord12415
ord13017
ord13703
ord922
ord4746
ord14155
ord5769
ord1687
ord1683
ord305
ord2950
ord14059
ord5765
ord4084
ord5732
ord1652
ord1132
ord491
ord1520
ord1038
ord300
ord316
ord1498
ord14186
ord948
ord6345
ord1440
ord970
ord1122
ord12412
ord13015
ord483
ord2333
ord12720
ord7753
ord1978
ord11766
ord11765
ord14201
ord12307
ord7811
ord5617
ord14401
ord3783
ord1501
ord324
ord1044
ord2305
ord323
ord1043
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316
ord2128
ord2242
ord2343
ord485
ord2327
ord2329
ord3897
ord1500

msvcr110

__CppXcptFilter
__CxxFrameHandler3
memcpy_s
memcpy
memset
_mbsrchr
strncpy
atoi
isdigit
_mbsnbcpy
strtol
wcstol
malloc
__clean_type_info_names_internal
_except_handler4_common
?terminate@@YAXXZ
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
_purecall
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
_CxxThrowException

kernel32

lstrlenA
MultiByteToWideChar
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
GetModuleFileNameA
LockResource
LocalFree
LoadResource
SizeofResource
lstrlenW
FindResourceA
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
LocalAlloc

user32

PostMessageA

ole32

CoCreateInstance
OleRun

oleaut32

SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysFreeString
SysAllocString
GetErrorInfo
SetErrorInfo
CreateErrorInfo

dalog

?storage@CDALog@@QAEXPBD00_N1@Z
?Write@CDALog@@QAAXPBDZZ
??0CDALog@@QAE@XZ
??RCDALog@@QAEAAV0@W4Lvl@0@@Z
??1CDALog@@QAE@XZ

torobj

?NewCookie@CApplication2@@QAEJPAK@Z
?ReleaseReq@CApplication2@@QAEJK@Z
?Cancel@CApplication2@@QAEJK@Z
?ExecReq@CApplication2@@QAEJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@K@Z
?RemoveNotifyInProc@CApplication2@@QAEJK@Z
?AddNotifyInProc@CApplication2@@QAEJPAUITORNotify2@@PAK@Z
??1CApplication2@@UAE@XZ
??0CApplication2@@QAE@XZ
?GetData@CApplication2@@QAEJV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAJPAPAEAAH@Z

Exports

Exports

?TORAsyncQueryTDF@@YAHPAUTORParamQueryTDF@@PAK@Z
?TORAsyncTDFReady@@YAHPAUTORParamAsyncTDFReady@@@Z
?TORCancel@@YAHK@Z
?TORChangePwd@@YAHPAUTORParamChangePwd@@PAK@Z
?TORGetInterfaceAsyncQueryTDF@@YAHKPAPAUITORTDF@@@Z
?TORGetInterfaceChangePasswd@@YAHKPAPAUITORChangePasswd@@@Z
?TORGetInterfaceQueryTDF@@YAHKPAPAUITORTDF@@@Z
?TORGetInterfaceVerify@@YAHKPAPAUITORVerify@@@Z
?TORGetSalesAuth@@YAHPAUTORParamSalesAuth@@PAPAVITORSalesAuth@@@Z
?TOROpenPage@@YAHPAUTORParamOpenPage@@@Z
?TORProxyFini@@YAXXZ
?TORProxyInit@@YAHPAUHWND__@@HPBD1@Z
?TORQueryTDF@@YAHPAUTORParamQueryTDF@@PAK@Z
?TORRelease@@YAHK@Z
?TORUniqueAID@@YAHPAUTORParamUniqueAID@@@Z
?TORVerify@@YAHPAUTORParamVerify@@PAK@Z

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f0535c53565db5d643cfa185bc265d7

Headers

DLL Characteristics

File Characteristics

Imports

mfc110

msvcr110

kernel32

user32

ole32

oleaut32

dalog

torobj

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB