41aa04ddf8eef076603744f35e94538379e98d85481d15161827e62fe698b723

Sharing

Copy URL

Twitter E-mail

General

Target

41aa04ddf8eef076603744f35e94538379e98d85481d15161827e62fe698b723
Size

6.0MB
MD5

a2056e5f224a529919cb5e8ba77bb893
SHA1

de311f1cd522a7d85a678c2a5ab10804367069b6
SHA256

41aa04ddf8eef076603744f35e94538379e98d85481d15161827e62fe698b723
SHA512

9357c2e70f41ac2cf52de6d7f9d19be5f538306955bfc8b7d769024a72f26e9d6d28ec68c4054c6822195cd175a3c239d6a84ae0e58c22a2ba024bc887b089c2
SSDEEP

98304:DtHgdD9FsM1NSwdRa6LDaeqNG8vo8tkuUwn3ZCICUfJ5D:lmD9V1Nle6LDa9DtkuJCICUx5D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41aa04ddf8eef076603744f35e94538379e98d85481d15161827e62fe698b723

Files

41aa04ddf8eef076603744f35e94538379e98d85481d15161827e62fe698b723
.dll windows:6 windows x86

93a704671bba920f5d0a31d2493d0a51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FileTimeToLocalFileTime
FindFirstFileA
FileTimeToDosDateTime
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
GetFileType
GetEnvironmentVariableW
SetConsoleMode
ReadConsoleA
ReadConsoleW
LoadLibraryW
FindFirstFileW
GetExitCodeThread
WaitForSingleObjectEx
InitOnceExecuteOnce
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsWow64Process
ExitProcess
GetSystemTime
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
GetProcAddress
VirtualFree
VirtualAlloc
GetACP
IsDebuggerPresent
SetEndOfFile
FlushFileBuffers
WriteFile
ReadFile
SetFilePointerEx
GetFileSizeEx
CreateFileW
CloseHandle
GetWindowsDirectoryA
GetVersionExW
RaiseException
SwitchToThread
MultiByteToWideChar
WideCharToMultiByte
FindNextFileA
FindFirstFileExA
SetLastError
GetLocalTime
GetLastError
GetFullPathNameW
FindNextFileW
FindFirstFileExW
FindClose
GetModuleHandleW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
CreateFile2
CreateEventW
ResetEvent
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleMode
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetStringTypeW
InitializeSRWLock
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CompareStringEx
TryEnterCriticalSection
LCMapStringEx
DecodePointer
EncodePointer

user32

GetDC
ReleaseDC

gdi32

GetTextMetricsW
GetTextFaceA
CreateFontA
GetFontData
GetCharWidthW
DeleteDC
CreateCompatibleDC
CreateFontIndirectA
DeleteObject
GetOutlineTextMetricsW
SelectObject
EnumFontFamiliesExA

ole32

CoTaskMemAlloc

advapi32

ReportEventW
RegisterEventSourceW
DeregisterEventSource

vcruntime140

strstr
longjmp
_setjmp3
memcmp
strchr
_purecall
memchr
__std_terminate
memcpy
__std_type_info_destroy_list
memset
memmove
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
strrchr
__std_type_info_name
__uncaught_exception
wcsstr
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
raise
_exit
abort
_initterm
_set_errno
_errno
signal
strerror_s
_initterm_e
_seh_filter_dll
_configure_narrow_argv
terminate
_cexit
_initialize_narrow_environment
_initialize_onexit_table
perror
exit
_beginthreadex
_crt_atexit
_register_onexit_function
_execute_onexit_table

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func
___lc_codepage_func
___lc_collate_cp_func
__pctype_func
_unlock_locales
_lock_locales
___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-heap-l1-1-0

_aligned_free
malloc
free
_callnewh
calloc
_aligned_malloc
realloc

api-ms-win-crt-stdio-l1-1-0

feof
__stdio_common_vfscanf
__stdio_common_vsprintf
fread
fclose
fopen
fputs
__stdio_common_vsprintf_s
fseek
_ftelli64
ftell
fwrite
__stdio_common_vfprintf
_wfopen
_setmode
_fileno
fgets
_fsopen
__stdio_common_vswprintf
_get_stream_buffer_pointers
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
ungetc
fopen_s
fgetc
ferror
fputc
__acrt_iob_func

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
rename
_mkdir
remove
_access
_lock_file
_stat64i32
_rmdir

api-ms-win-crt-string-l1-1-0

_strnicmp
_strdup
strtok
strcat
__strncnt
strspn
isspace
isalpha
strncmp
_stricmp
isxdigit
wcscmp
isupper
wcsnlen
_wcsdup
_strlwr
tolower
islower
iswblank
strcpy
strlen
wcslen
strcspn
strncpy
strcmp
iswdigit
iswspace

api-ms-win-crt-time-l1-1-0

strftime
_localtime64
_gmtime64
_time64
_gmtime64_s

api-ms-win-crt-math-l1-1-0

atan2
round
roundf
log
log10
acos
sqrt
sin
_fdclass
_dclass
cos
ceil
floor
_fdtest
ldexp
frexp
pow

api-ms-win-crt-convert-l1-1-0

atof
strtoul
strtol
mbstowcs
_itoa
mbstowcs_s
atoi
wcstombs_s
wcstombs

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong
qsort
srand
rand

api-ms-win-crt-environment-l1-1-0

getenv

bcrypt

BCryptGenRandom

ws2_32

WSACleanup
WSAGetLastError
recv
send
WSASetLastError
closesocket

Exports

Exports

_C_GetOcrKey@4
_C_GetOcrSecret@0
_C_GetPagesCount@8
_C_InitConverter@4
_C_IsSDKDeveloper@0
_C_LicenseVerify@16
_C_PdfToCSV_Cancel@4
_C_PdfToCSV_InitWork@56
_C_PdfToCSV_StartWork@20
_C_PdfToExcel_Cancel@4
_C_PdfToExcel_InitWork@56
_C_PdfToExcel_StartWork@20
_C_PdfToHTML_Cancel@4
_C_PdfToHTML_InitWork@56
_C_PdfToHTML_StartWork@20
_C_PdfToImg_Cancel@4
_C_PdfToImg_InitWork@56
_C_PdfToImg_StartWork@20
_C_PdfToPPT_Cancel@4
_C_PdfToPPT_InitWork@56
_C_PdfToPPT_StartWork@20
_C_PdfToRTF_Cancel@4
_C_PdfToRTF_InitWork@56
_C_PdfToRTF_StartWork@20
_C_PdfToTable_Cancel@4
_C_PdfToTable_InitWork@56
_C_PdfToTable_StartWork@20
_C_PdfToTxt_Cancel@4
_C_PdfToTxt_InitWork@56
_C_PdfToTxt_StartWork@20
_C_PdfToWord_Cancel@4
_C_PdfToWord_InitWork@56
_C_PdfToWord_StartWork@20
_C_SetOcrCallback@4
_C_SetOcrResult@4

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93a704671bba920f5d0a31d2493d0a51

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

bcrypt

ws2_32

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 18KB - Virtual size: 45KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 104KB - Virtual size: 104KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 18KB - Virtual size: 45KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 104KB - Virtual size: 104KB