f6ad076be9e22167850eb548c359d05984ebb51cee44c16ff140b27df794425a

Sharing

Copy URL Twitter E-mail

General

Target

f6ad076be9e22167850eb548c359d05984ebb51cee44c16ff140b27df794425a
Size

1.6MB
MD5

348c13cae5bed5a50864e2d67a58d67b
SHA1

4b62c84fb7b349291f72b35c448787228654096d
SHA256

f6ad076be9e22167850eb548c359d05984ebb51cee44c16ff140b27df794425a
SHA512

53f66afdc075d78d6bf8b87d3552395615e91deb977169999c15646e9f86f26c3b1230834c79fad259d972e94b8dff931cec11deec3122ba18d503e1bc4a9b79
SSDEEP

24576:c3s+BHRu3nVjoBgBtSrLjYKcK7wiTA/dTjR8SnnsCndUuxMjMlNhQA4LoQPwOGiO:kgUuxMqNhQZLTwPkMka

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6ad076be9e22167850eb548c359d05984ebb51cee44c16ff140b27df794425a

Files

f6ad076be9e22167850eb548c359d05984ebb51cee44c16ff140b27df794425a
.exe windows x86

8db84a61808c998fe8f938269cf87440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList

kernel32

TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
SetStdHandle
GetFileType
ExitProcess
HeapSize
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
FatalAppExitA
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetModuleFileNameA
lstrlenW
CreateDirectoryA
IsProcessorFeaturePresent
InterlockedCompareExchange
OpenMutexA
CreateMutexA
FlushInstructionCache
MultiByteToWideChar
GetFileSize
SetFilePointer
ReadFile
WideCharToMultiByte
FindResourceA
LoadResource
RtlUnwind
GetTickCount
GetCurrentDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
SetErrorMode
GetFileTime
GetFileSizeEx
GetFileAttributesA
SetFileAttributesA
WriteFile
SetFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
GlobalFlags
GetAtomNameA
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetModuleHandleW
SystemTimeToFileTime
FileTimeToSystemTime
lstrcpyA
lstrcpyW
GlobalReAlloc
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiA
GetStringTypeExA
DeleteFileA
MoveFileA
CreateEventA
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GetCurrentProcessId
InterlockedDecrement
GetModuleFileNameW
GetThreadLocale
InterlockedIncrement
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
LoadLibraryA
LockResource
SizeofResource
Sleep
CreateFileA
CloseHandle
GetLastError
WaitForSingleObject
DeviceIoControl
ReleaseMutex
GlobalAlloc
GlobalFree
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
SetLastError
CopyFileA
GlobalSize
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
lstrlenA
GetLocalTime
InitializeCriticalSectionAndSpinCount

user32

LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorA
RegisterClipboardFormatA
SetRectEmpty
MessageBeep
GetNextDlgGroupItem
DestroyIcon
WaitMessage
WindowFromPoint
DeleteMenu
GetDialogBaseUnits
UnregisterClassA
ReleaseCapture
SetCapture
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableA
LoadCursorA
GetSysColorBrush
DestroyMenu
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
SetCursor
PostQuitMessage
CharUpperA
MapVirtualKeyA
GetKeyNameTextA
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
GetMenuBarInfo
GetWindowThreadProcessId
InflateRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
TabbedTextOutA
FillRect
CharNextA
ScrollWindowEx
IsWindowEnabled
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
EnableWindow
GetWindow
UnregisterDeviceNotification
RegisterClassExA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetTimer
KillTimer
PostThreadMessageA
SetParent
UnionRect
GetDCEx
LockWindowUpdate
EndDialog
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
MsgWaitForMultipleObjects
LoadBitmapA
DrawIcon
GetWindowRect
GetClientRect
InvalidateRect
DrawTextA
GetSysColor
GetSystemMetrics
PostMessageA
UpdateWindow
RedrawWindow
SendMessageA
RegisterDeviceNotificationA
MessageBoxA
PeekMessageA
wsprintfA
AppendMenuA
GetSystemMenu
IsIconic
LoadIconA
ShowWindow
AnimateWindow
MoveWindow
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
GetMenuItemID
GetMenuStringA
GetMenuState
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
SetWindowLongA
GetWindowLongA
IsWindowVisible
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
GetMenuItemInfoA

gdi32

SaveDC
GetMapMode
PatBlt
DPtoLP
GetTextExtentPoint32A
GetRgnBox
GetTextMetricsA
GetCharWidthA
StretchDIBits
CreateCompatibleBitmap
SetRectRgn
CreateRectRgnIndirect
CreateFontIndirectA
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
CreateFontA
GetObjectA
CreateCompatibleDC
BitBlt
GetDeviceCaps
CopyMetaFileA
CreateDCA
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
GetStockObject
GetBkColor
GetTextColor
CombineRgn

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

OpenProcessToken
LookupPrivilegeValueA
RegCloseKey
RegSetValueA
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegDeleteValueA
AdjustTokenPrivileges

shell32

SHGetFileInfoA
DragFinish
DragQueryFileA
ExtractIconA

shlwapi

PathFindExtensionA
PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW

odbc32

ord48
ord72
ord4
ord17
ord5
ord51
ord50
ord45
ord44
ord68
ord43
ord59
ord13
ord18
ord46
ord12
ord19
ord11
ord49
ord8
ord20
ord14
ord9
ord15
ord23
ord1
ord2
ord41
ord16
ord3
ord61
ord10

oledlg

ord8

ole32

CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
CoRegisterClassObject
ReleaseStgMedium
StgOpenStorageOnILockBytes
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
CoInitializeEx
CoUninitialize
OleInitialize
CoFreeUnusedLibraries
OleDuplicateData
OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
StringFromGUID2
CoDisconnectObject
CoTaskMemAlloc
CoGetClassObject
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateBindCtx
OleUninitialize

oleaut32

LoadTypeLi
LoadRegTypeLi
SysFreeString
RegisterTypeLi
VariantClear
VariantChangeType
SafeArrayDestroyDescriptor
SysStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantInit
SysAllocStringLen
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle

cryp_api

Crypt_Logout
Crypt_OpenDevice
Crypt_VerifySignedData
Crypt_Login
Crypt_GetErrorMsg
Crypt_CloseDevice

winscard

SCardReconnect
SCardTransmit
g_rgSCardT1Pci
g_rgSCardT0Pci
SCardDisconnect
SCardStatusA
SCardConnectA
SCardFreeMemory
SCardListReadersA
SCardReleaseContext
SCardEstablishContext
SCardGetStatusChangeA

Exports

Exports

A9SevAuthorNum
CheckHardWare
CloseAISINODiskDevice
CloseJsp
DiskBspID
DiskQuanXian
DiskReadDateVer
DiskReadFaXingFlag
DiskReadID
DiskReadKpjNum
DiskReadNameVer
IC_CommandInit
IC_Command_QiYe
IC_Command_ShuiJu
JspCallCmd
JspCallCmdQiYe
JspCallCmdQiYeA9
JspCloseAISINODiskDevice
JspCopyTaxDate
JspEraseStatusFlag
JspFormReport
JspHistoMonthInfoFlag
JspJUMP_BA
JspOpenAISINODiskDevice
JspProcesDqbm
JspReadA9DiskIssueTime
JspReadA9DiskState
JspReadA9Mac
JspReadATR
JspReadCardCapacity
JspReadCardMemory
JspReadCardType
JspReadCopytaxTime
JspReadDeadDate
JspReadFXDate
JspReadFirstDF
JspReadHYFlag
JspReadInvoiceMachineId
JspReadInvoiceMachineState
JspReadIsClockStopped
JspReadIsCopytaxdataExist
JspReadIsFlashProblem
JspReadIsHardwareProblem
JspReadIsRegisteredBSP
JspReadLSFXDate
JspReadLockedTime
JspReadNumA
JspReadSecondDF
JspReadSubVersion
JspReadTaxpayerID
JspReadTimeA
JspReadVerTime
JspReadhunyingbiaozhi
JspReportTaxDate
JspStartCardStatus
OpenAISINODiskDevice
OpenJsp
PowerTest_QiYe
Read4K
ReadJspVer
ReadQuanXianFlag
ReadRealTaxNo
Resetjsp
SearchDevice
chaoshui

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8db84a61808c998fe8f938269cf87440

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

odbc32

oledlg

ole32

oleaut32

winhttp

cryp_api

winscard

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 210KB - Virtual size: 210KB

.data Size: 23KB - Virtual size: 39KB

.rsrc Size: 323KB - Virtual size: 323KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 210KB - Virtual size: 210KB

.data
Size: 23KB - Virtual size: 39KB

.rsrc
Size: 323KB - Virtual size: 323KB