64f1e2e8e5acad6257092e8f9283ef96f8a2a29a7eaf0e83747459fb8a06c493

Sharing

Copy URL Twitter E-mail

General

Target

64f1e2e8e5acad6257092e8f9283ef96f8a2a29a7eaf0e83747459fb8a06c493
Size

86KB
MD5

c16539aeda7d4545f0760e30370f3afb
SHA1

d76675b9e77e75f3bef203c5108aa12a1b1d64a0
SHA256

64f1e2e8e5acad6257092e8f9283ef96f8a2a29a7eaf0e83747459fb8a06c493
SHA512

d97145274b1076c33b92152e95f4ab3ded9faaf784cc7c9d82e4e59a74f65d8ed701ded7a7d78f105832423b8dfae2fd41a6dba2b8881acd8b457db46730ecdd
SSDEEP

1536:BuIfDioKgymnQH60jJVpqdsdx55jw1fO2KuQ+1ZgQ:4IfuBgymng6psT55jwc2KD+b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64f1e2e8e5acad6257092e8f9283ef96f8a2a29a7eaf0e83747459fb8a06c493

Files

64f1e2e8e5acad6257092e8f9283ef96f8a2a29a7eaf0e83747459fb8a06c493
.dll windows x86

4e30847602eccb6cc598e42014368411

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCanonicalizeUrlA
InternetOpenA
InternetGetConnectedState
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetStatusCallback
InternetSetOptionA
InternetQueryOptionA
InternetReadFileExA
InternetConnectA
InternetCloseHandle
InternetCrackUrlA

rpcrt4

UuidToStringA
RpcStringFreeA

mfc110

ord7734
ord14329
ord12317
ord12318
ord2430
ord5212
ord8130
ord7808
ord4519
ord12638
ord12701
ord10228
ord12028
ord8191
ord1459
ord7470
ord8273
ord4977
ord14327
ord12451
ord1950
ord1344
ord2340
ord320
ord2322
ord6590
ord12125
ord14338
ord12182
ord14391
ord3175
ord4780
ord4256
ord8532
ord14155
ord14149
ord8570
ord8571
ord499
ord11745
ord12128
ord14340
ord2826
ord1133
ord13019
ord12538
ord9203
ord4084
ord4023
ord12720
ord7753
ord1978
ord11766
ord11765
ord14201
ord12307
ord7811
ord14401
ord6192
ord14403
ord6194
ord14402
ord6193
ord987
ord6694
ord3786
ord5765
ord12020
ord8025
ord12032
ord12000
ord5107
ord5404
ord5614
ord9155
ord5380
ord5617
ord5110
ord5266
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord10047
ord9016
ord8525
ord4595
ord14186
ord948
ord2115
ord1520
ord266
ord265
ord6345
ord1132
ord491
ord1440
ord970
ord1173
ord12464
ord1642
ord8308
ord550
ord6436
ord1438
ord2343
ord2242
ord2128
ord13018
ord13704
ord968
ord4746
ord2937
ord2931
ord1517
ord1038
ord310
ord300
ord316
ord12336
ord5732
ord4978
ord1652
ord2333
ord2327
ord2329
ord1498
ord1500
ord818
ord3783
ord1501
ord324
ord1044
ord2305
ord2189
ord323
ord1043
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316

msvcr110

_onexit
??1type_info@@UAE@XZ
__dllonexit
_unlock
_lock
rand
ldiv
strncmp
_localtime64_s
_calloc_crt
_mktime64
_purecall
realloc
malloc
free
_mkdir
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
atoi
_mbsnbcpy
strchr
memmove
_time64
__clean_type_info_names_internal
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter

kernel32

GetExitCodeThread
ResumeThread
LocalAlloc
EncodePointer
DecodePointer
TerminateThread
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
WaitForMultipleObjects
ResetEvent
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
LocalFree
GetLastError

user32

PostMessageA

ole32

CoInitialize
CoCreateGuid

msvcp110

?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z

dalog

??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?DALogFini@@YAXXZ
??0CDALog@@QAE@XZ
??1CDALog@@QAE@XZ
?storage@CDALog@@QAEXPBD00_N1@Z
?Write@CDALog@@QAAXPBDZZ

gzip2

Gzip2A
A2Gzip

xmlhelper3

??0CXmlDocument@PugiXMLHelper@@QAE@XZ
??1CXmlDocument@PugiXMLHelper@@QAE@XZ

Exports

Exports

?jdCmdGetNotify@JDCmdSvr@@YAXHPAPAEAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAHW4CMDNotifyType@1@@Z
?jdCmdSetServerTime@JDCmdSvr@@YAXJJ@Z
?jdCmdSvcConnect@JDCmdSvr@@YAHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?jdCmdSvcDisconnect@JDCmdSvr@@YAXXZ
?jdCmdSvcFini@JDCmdSvr@@YAXXZ
?jdCmdSvcFireUIEvent@JDCmdSvr@@YAXW4CMDNotifyType@1@PAXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?jdCmdSvcGetService@JDCmdSvr@@YAPAVIJDCmdService@1@XZ
?jdCmdSvcInit@JDCmdSvr@@YAHPAUHWND__@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@11@Z

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e30847602eccb6cc598e42014368411

Headers

DLL Characteristics

File Characteristics

Imports

wininet

rpcrt4

mfc110

msvcr110

kernel32

user32

ole32

msvcp110

dalog

gzip2

xmlhelper3

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB