ccc14885445a29174547ba4dbe5d8ad08e6ae0279d60a789d5fcdcc8e9599668

Sharing

Copy URL Twitter E-mail

General

Target

ccc14885445a29174547ba4dbe5d8ad08e6ae0279d60a789d5fcdcc8e9599668
Size

73KB
MD5

b6b239a637085dc279d57b68ef5b99b2
SHA1

fea0e63bf42f45ab7349046365bb94d23a626749
SHA256

ccc14885445a29174547ba4dbe5d8ad08e6ae0279d60a789d5fcdcc8e9599668
SHA512

fcecd301e662a2081767471189675a37e25d2703ad6e95ec0dd467f43821dfd524ec03b326ef08e6c3014cb7dc0f6d06579c4efb2cffa03a3b637fe6478b9c51
SSDEEP

768:vsRyE3+yUXOb610ftcQ+Aqv/dYAPSgeEwO:nFu6OfV+bvlYATeEw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ccc14885445a29174547ba4dbe5d8ad08e6ae0279d60a789d5fcdcc8e9599668

Files

ccc14885445a29174547ba4dbe5d8ad08e6ae0279d60a789d5fcdcc8e9599668
.exe windows x64

3b8e5a96009de7b3c3e953f465963f1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdal307

GDALGetSpatialRef
GDALGetRasterBand
GDALClose
GDALGetRasterNoDataValue
GDALDestroyDriverManager
GDALOpen
GDALAllRegister
OGRCleanupAll
GDALGeneralCmdLineProcessor
OGRGetDriverByName
OGR_Dr_CreateDataSource
GDALContourGenerateEx
OGR_DS_CreateLayer
OGR_L_CreateField
OGR_L_GetLayerDefn
OGR_FD_GetFieldIndex
OGR_Fld_SetWidth
OGR_Fld_Destroy
OGR_Fld_Create
GDALVersionInfo
CPLDestroyXMLNode
??ACPLStringList@@QEBAPEBDH@Z
?GetOutputDriversFor@@YA?AV?$vector@VCPLString@@V?$allocator@VCPLString@@@std@@@std@@PEBDH@Z
VSIFree
??ACPLStringList@@QEAAPEADH@Z
OGRRegisterAll
?Assign@CPLStringList@@QEAAAEAV1@PEAPEADH@Z
?FetchNameValue@CPLStringList@@QEBAPEBDPEBD@Z
?InsertStringDirectly@CPLStringList@@QEAAAEAV1@HPEAD@Z
?Count@CPLStringList@@QEBAHXZ
CPLRecodeFromWChar
CSLAppendPrintf
CPLSPrintf
CPLsnprintf
CPLGetValueType
CSLPartialFindString
CSLFindString
CSLDestroy
CSLAddString
CPLGetExtension
CPLAtof
CPLStrdup
CPLCalloc
CPLError
GDALTermProgress

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException
memset
__current_exception_context
__current_exception
__std_type_info_destroy_list
__C_specific_handler
memmove
memcpy
__std_exception_destroy
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_configure_wide_argv
_get_initial_wide_environment
_set_app_type
__p___wargv
_cexit
_c_exit
_initterm
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_exit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_seh_filter_dll
exit
__p___argc
_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
__p__commode
_set_fmode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-string-l1-1-0

strcmp
_stricmp

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Exports

Exports

??0CPLXMLTreeCloser@@QEAA@$$QEAV0@@Z
??0CPLXMLTreeCloser@@QEAA@PEAUCPLXMLNode@@@Z
??0OGREnvelope3D@@QEAA@AEBV0@@Z
??0OGREnvelope3D@@QEAA@XZ
??0OGREnvelope@@QEAA@AEBV0@@Z
??0OGREnvelope@@QEAA@XZ
??1?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAA@XZ
??1CPLXMLTreeCloser@@QEAA@XZ
??4?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAAEAV01@$$T@Z
??4CPLFreeReleaser@@QEAAAEAU0@$$QEAU0@@Z
??4CPLFreeReleaser@@QEAAAEAU0@AEBU0@@Z
??4CPLStringList@@QEAAAEAV0@PEAPEAD@Z
??4CPLXMLTreeCloser@@QEAAAEAV0@$$QEAV0@@Z
??4CPLXMLTreeCloserDeleter@@QEAAAEAU0@$$QEAU0@@Z
??4CPLXMLTreeCloserDeleter@@QEAAAEAU0@AEBU0@@Z
??4CSLDestroyReleaser@@QEAAAEAU0@$$QEAU0@@Z
??4CSLDestroyReleaser@@QEAAAEAU0@AEBU0@@Z
??4OGREnvelope3D@@QEAAAEAV0@AEBV0@@Z
??4OGREnvelope@@QEAAAEAV0@AEBV0@@Z
??8OGREnvelope@@QEBA_NAEBV0@@Z
??9OGREnvelope@@QEBA_NAEBV0@@Z
??ACPLStringList@@QEAAPEAD_K@Z
??ACPLStringList@@QEBAPEBDPEBD@Z
??ACPLStringList@@QEBAPEBD_K@Z
??B?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBA_NXZ
??BCPLStringList@@QEAAPEAPEADXZ
??BCPLStringList@@QEBAPEBQEBDXZ
??C?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAPEAUCPLXMLNode@@XZ
??D?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAAEAUCPLXMLNode@@XZ
??RCPLFreeReleaser@@QEBAXPEAX@Z
??RCPLXMLTreeCloserDeleter@@QEBAXPEAUCPLXMLNode@@@Z
??RCSLDestroyReleaser@@QEBAXPEAPEAD@Z
?Contains@OGREnvelope3D@@QEBAHAEBV1@@Z
?Contains@OGREnvelope@@QEBAHAEBV1@@Z
?FindString@CPLStringList@@QEBAHPEBD@Z
?InsertString@CPLStringList@@QEAAAEAV1@HPEBD@Z
?Intersect@OGREnvelope3D@@QEAAXAEBV1@@Z
?Intersect@OGREnvelope@@QEAAXAEBV1@@Z
?Intersects@OGREnvelope3D@@QEBAHAEBV1@@Z
?Intersects@OGREnvelope@@QEBAHAEBV1@@Z
?IsInit@OGREnvelope3D@@QEBAHXZ
?IsInit@OGREnvelope@@QEBAHXZ
?IsSorted@CPLStringList@@QEBAHXZ
?List@CPLStringList@@QEAAPEAPEADXZ
?List@CPLStringList@@QEBAPEBQEBDXZ
?Merge@OGREnvelope3D@@QEAAXAEBV1@@Z
?Merge@OGREnvelope3D@@QEAAXAEBVOGREnvelope@@@Z
?Merge@OGREnvelope3D@@QEAAXNNN@Z
?Merge@OGREnvelope@@QEAAXAEBV1@@Z
?Merge@OGREnvelope@@QEAAXNN@Z
?PartialFindString@CPLStringList@@QEBAHPEBD@Z
?begin@CPLStringList@@QEBAPEBQEBDXZ
?empty@CPLStringList@@QEBA_NXZ
?end@CPLStringList@@QEBAPEBQEBDXZ
?get@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAPEAUCPLXMLNode@@XZ
?get_deleter@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAAEAUCPLXMLTreeCloserDeleter@@XZ
?get_deleter@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAAEBUCPLXMLTreeCloserDeleter@@XZ
?release@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAPEAUCPLXMLNode@@XZ
?reset@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAXPEAUCPLXMLNode@@@Z
?size@CPLStringList@@QEBAHXZ
?swap@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAXAEAV12@@Z

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b8e5a96009de7b3c3e953f465963f1b

Headers

DLL Characteristics

File Characteristics

Imports

gdal307

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 41KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 7KB

.00cfg Size: 512B - Virtual size: 337B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 460B

.text
Size: 41KB - Virtual size: 41KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 7KB

.00cfg
Size: 512B - Virtual size: 337B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 460B