178490587fa0d90e0db5713b3db2c287fcf85caee0bd94b84f4a11fc1412b82e

Sharing

Copy URL Twitter E-mail

General

Target

178490587fa0d90e0db5713b3db2c287fcf85caee0bd94b84f4a11fc1412b82e
Size

5.9MB
MD5

3db942cb8becca1495460257de17ac48
SHA1

32b3275bc415181b06f1a1f81f6aad801f73fd50
SHA256

178490587fa0d90e0db5713b3db2c287fcf85caee0bd94b84f4a11fc1412b82e
SHA512

8b36ad990ed799a24230ef63d076ff8b9a737fdd9be5c9feef7e56595f4b78a4302bd9660e4620eb3ec1f74f2a56b88a2570516ee30d102c0242662f1e8b254a
SSDEEP

98304:/wmtC/Mut8mWOobgyuL+Na0O5c4RPVWKPe7RGuqi8f2JtuY3A99yBWAFTDP9ZMSw:W0hOobgyuL+hGt4of2/yyB7dGekX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
178490587fa0d90e0db5713b3db2c287fcf85caee0bd94b84f4a11fc1412b82e

Files

178490587fa0d90e0db5713b3db2c287fcf85caee0bd94b84f4a11fc1412b82e
.dll windows:5 windows x86

d727e7daa768ad6cd4028c6030cc0e23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr100

_CIasin
_CIacos
_CIlog10
_CIsin
memcmp
__RTtypeid
??8type_info@@QBE_NABV0@@Z
_purecall
memset
strlen
__CxxFrameHandler3
memcpy
__FrameUnwindFilter
_cexit
strcpy_s
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
memmove
_CxxThrowException
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_CItan
_CIsinh
_CIcosh
_CIatan
_CIlog
?what@exception@std@@UBEPBDXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
printf
??_V@YAXPAX@Z
??_U@YAPAXI@Z
??2@YAPAXI@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
_CIcos
_CIsqrt
_CIpow
_CIexp

msvcp100

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_BADOFF@std@@3_JB
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

mfc100u

ord4113
ord2057
ord1450
ord4274
ord296
ord902
ord1987
ord4290

kernel32

GetExitCodeThread
DeleteFiber
GetComputerNameExW
TlsGetValue
FindNextFileA
GetLocalTime
DeleteFileW
GetTimeZoneInformation
RemoveDirectoryW
QueryPerformanceFrequency
GetVersionExA
SetFilePointerEx
DeleteCriticalSection
CreateProcessW
CreateMutexA
CloseHandle
OpenSemaphoreA
DeviceIoControl
InitializeCriticalSection
GetFileInformationByHandle
GetEnvironmentVariableW
SearchPathA
GetSystemTime
GetModuleFileNameA
GetComputerNameW
CreateFileA
HeapFree
GetFileSize
MoveFileExW
IsProcessorFeaturePresent
LocalFree
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SystemTimeToFileTime
OutputDebugStringA
SetEndOfFile
ReleaseSemaphore
ReleaseMutex
OpenProcess
CreateEventA
FreeLibrary
HeapReAlloc
CreateFileMappingA
MultiByteToWideChar
LeaveCriticalSection
MapViewOfFile
GetSystemDirectoryA
GetModuleFileNameW
SwitchToThread
GetVolumeInformationA
CreateThread
SetFileAttributesW
GetModuleHandleA
GetLogicalDrives
WriteFile
SetLastError
SetErrorMode
GetProcessHeap
FlushFileBuffers
OpenMutexA
InterlockedExchangeAdd
GetDriveTypeA
FindNextFileW
InterlockedIncrement
QueryDosDeviceA
GetLastError
HeapAlloc
TlsSetValue
DefineDosDeviceA
FindFirstFileW
TerminateThread
CreateFileW
CreateDirectoryW
GetEnvironmentVariableA
GetSystemInfo
GetVersion
LocalAlloc
GetProcAddress
ReadFile
ResumeThread
CreateSemaphoreA
SwitchToFiber
EnterCriticalSection
SetEvent
SetThreadPriority
FindFirstFileA
TlsAlloc
InterlockedDecrement
ConvertThreadToFiber
UnmapViewOfFile
LoadLibraryExA
DuplicateHandle
WideCharToMultiByte
GetProcessTimes
WaitForSingleObject

oleaut32

SysFreeString

mscoree

_CorDllMain

Exports

Exports

?WellPathInterpolation_Calculation@@YAHPBUWellPathData@@HAAU1@@Z
SurveyMiniCurve
f_survey1001
f_survey1002
f_survey1003
f_survey1005
f_survey1007
f_survey2001

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 201KB - Virtual size: 637KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 559KB - Virtual size: 560KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d727e7daa768ad6cd4028c6030cc0e23

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

msvcp100

mfc100u

kernel32

oleaut32

mscoree

Exports

Exports

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 201KB - Virtual size: 637KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 183KB - Virtual size: 183KB

.text Size: 559KB - Virtual size: 560KB

.data Size: 4KB - Virtual size: 4KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 201KB - Virtual size: 637KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 183KB - Virtual size: 183KB

.text
Size: 559KB - Virtual size: 560KB

.data
Size: 4KB - Virtual size: 4KB