NEAS[.]7b9d8f3761b46e85b4106998b700bd80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7b9d8f3761b46e85b4106998b700bd80.exe
Size

985KB
MD5

7b9d8f3761b46e85b4106998b700bd80
SHA1

fc1a098a33ea5da14f4375c1ff1ba42c0ee0b153
SHA256

2b76ee2ceed1e95121a6565b03a579d76cd2d6057320d0a13b738917530f1dc4
SHA512

7912f53f15cc2542d854b57b71d7c43b99dfd1b5d12860781e341961d6ceda8f28f78ba3f4b7e15a3fba6a8a274523fe06433b2bf0d301ae80047b99ce08e000
SSDEEP

24576:YWvHwUEpBdzHPs+2+EaF9BnL+YOypIZQJ7po:hEpBBHPyXarBaYHICto

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7b9d8f3761b46e85b4106998b700bd80.exe

Files

NEAS.7b9d8f3761b46e85b4106998b700bd80.exe
.dll windows:5 windows x86

3907740fb8922036a9af5ea0030cf23c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CloseHandle
TlsAlloc
CreateMutexA
CreateSemaphoreA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
CreateSemaphoreW
DecodePointer
InterlockedIncrement
InterlockedDecrement
LockResource
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
Sleep
LoadResource
GetFileSize
WriteFile
SetFilePointer
FindClose
MulDiv
GetLocalTime
CompareFileTime
GetTickCount
lstrcmpA
lstrlenW
GetModuleFileNameA
FindResourceA
FindResourceW
CreateFileA
DeleteFileA
FindFirstFileA
FindNextFileA
MoveFileA
MultiByteToWideChar
WideCharToMultiByte
AllocConsole
GetProcAddress
LocalFree
GetCurrentProcess
GetOverlappedResult
ReadFile
FlushFileBuffers
ClearCommBreak
ClearCommError
SetupComm
EscapeCommFunction
GetCommModemStatus
GetCommState
GetCommTimeouts
PurgeComm
SetCommMask
SetCommState
SetCommTimeouts
WaitCommEvent
FormatMessageA
CreateThread
lstrcatA
lstrlenA
CreateEventA
GetModuleHandleA
lstrcmpW
ResumeThread
TerminateThread
SizeofResource
LoadLibraryA
SuspendThread
ResetEvent
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FreeLibraryAndExitThread
ExitThread
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
GetConsoleMode
GetConsoleCP
GetFileType
CreateFileW
GetACP
VirtualQuery
VirtualProtect
GetSystemInfo
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
TlsFree
TlsSetValue
TlsGetValue
SetFilePointerEx
EncodePointer
TryEnterCriticalSection
GetExitCodeThread
GetCurrentThread
SwitchToThread
DuplicateHandle
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
QueryDepthSList
RaiseException
DeleteFileW
MoveFileExW
ReadConsoleW
GetCPInfo
IsValidCodePage
GetOEMCP
SetStdHandle
SetEndOfFile
UnregisterWaitEx
LoadLibraryW
lstrcpyA
WriteConsoleW
FindFirstFileExA
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
GetThreadPriority
SetThreadPriority
SignalObjectAndWait

user32

MonitorFromWindow
MapDialogRect
LoadCursorA
GetWindow
GetClassNameA
GetParent
GetDesktopWindow
SetWindowLongA
GetWindowLongA
FillRect
MapWindowPoints
ScreenToClient
ClientToScreen
MessageBoxA
SetWindowContextHelpId
GetWindowRect
GetClientRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
GetMonitorInfoA
ReleaseCapture
SetCapture
GetFocus
GetActiveWindow
SetFocus
CharNextA
CharToOemA
SendDlgItemMessageA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SetWindowPos
MoveWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExA
GetClassInfoExA
RegisterClassExA
UnregisterClassA
CallWindowProcA
DefWindowProcA
SendMessageA
RegisterWindowMessageA
RegisterDeviceNotificationA
wsprintfW
OemToCharW
PostMessageA
CreateAcceleratorTableA
RedrawWindow
GetSysColor

gdi32

GetObjectA
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
OleInitialize
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal

oleaut32

OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString

ws2_32

setsockopt
send
select
recv
ioctlsocket
WSAGetLastError
closesocket
bind
__WSAFDIsSet
WSAStartup
WSASocketA
shutdown
WSAStringToAddressA
connect

Exports

Exports

??0CMoebiusKKM@@QAE@XZ
??1CMoebiusKKM@@UAE@XZ
??_7CMoebiusKKM@@6B@
?AddDataToResponseQueue@CMoebiusKKM@@IAEXPAVCResponseData@@EK@Z
?Binary2Text@CMoebiusKKM@@SAHPAEPADH@Z
?CatLogFile@CMoebiusKKM@@SAXK@Z
?ClearOutput@CMoebiusKKM@@QAEEH@Z
?ClearOutput@CMoebiusKKM@@QAEXXZ
?ClearVatTableAndSum@CMoebiusKKM@@QAEXXZ
?ClrDTR@CMoebiusKKM@@QAEXXZ
?ClrPort@CMoebiusKKM@@QAEXXZ
?ConnectPort@CMoebiusKKM@@QAEHXZ
?CreateOutputCompleteEvent@CMoebiusKKM@@QAEXJE@Z
?DisconnectPort@CMoebiusKKM@@QAEHH@Z
?DoPrinting@CMoebiusKKM@@QAEEJPAEJJEH@Z
?DoPrintingLastCmd@CMoebiusKKM@@QAEEXZ
?DrawData@CMoebiusKKM@@QAEXPAVCResponseData@@@Z
?FileReport@CMoebiusKKM@@QAEEPAUtm@@0PAHPAMH@Z
?FlushLocTags@CMoebiusKKM@@IAEEXZ
?GetBarrierState@CMoebiusKKM@@QAEEXZ
?GetCheckSum@CMoebiusKKM@@IAEEPAEK@Z
?GetDSRStatus@CMoebiusKKM@@QAEHJ@Z
?GetDSRStatus@CMoebiusKKM@@QAEHXZ
?GetIndentReceiptHead@CMoebiusKKM@@QAEEXZ
?GetInternalPrinterStatus@CMoebiusKKM@@QAEEE@Z
?GetLastKkmErr@CMoebiusKKM@@QAEEXZ
?GetLastResponseData@CMoebiusKKM@@QAEPAVCResponseData@@XZ
?GetPowerState@CMoebiusKKM@@QAEKXZ
?GetPrinterData@CMoebiusKKM@@IAEEPAEE0PAJE@Z
?GetReceipt2Sleep@CMoebiusKKM@@QAEEXZ
?GetVatSum@CMoebiusKKM@@QAEEHPAH@Z
?GetVatValue@CMoebiusKKM@@QAEEHPAH@Z
?InitHeaderData@CMoebiusKKM@@IAEXEGEEPAD@Z
?InitModel@CMoebiusKKM@@QAEHXZ
?InnerDoPrinting@CMoebiusKKM@@QAEEJPAEJJEH@Z
?IsCommEnable@CMoebiusKKM@@SAHH@Z
?IsConnected@CMoebiusKKM@@QAE_NXZ
?KkmAddLocTag@CMoebiusKKM@@QAEEGPAXGH@Z
?KkmAddTag@CMoebiusKKM@@QAEEGPAXG@Z
?KkmAgentAtom@CMoebiusKKM@@QAEEEEEFPAE@Z
?KkmAgentItem@CMoebiusKKM@@QAEEEEPAVTag@@000000@Z
?KkmCasherChg@CMoebiusKKM@@QAEEEPAD0@Z
?KkmChangeHeader@CMoebiusKKM@@QAEEPAD@Z
?KkmChangeHeaderEx@CMoebiusKKM@@QAEEPADH@Z
?KkmCheckPaper@CMoebiusKKM@@QAEEXZ
?KkmCheckPaperNew@CMoebiusKKM@@QAEEXZ
?KkmCleanFsclStorage@CMoebiusKKM@@QAEEXZ
?KkmClearLocTag@CMoebiusKKM@@QAEEXZ
?KkmCloseShift@CMoebiusKKM@@QAEEPAUDate@@E@Z
?KkmCloseShiftNew@CMoebiusKKM@@QAEEPAUDate@@@Z
?KkmCodeAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@K@Z
?KkmCodeAtomEx@CMoebiusKKM@@QAEEPAEE0K@Z
?KkmComKKM645@CMoebiusKKM@@QAEEEPADH@Z
?KkmCommonReset@CMoebiusKKM@@QAEEPAD@Z
?KkmConvertToOEM@CMoebiusKKM@@QAEPADPAD@Z
?KkmCorrAtom@CMoebiusKKM@@QAEEEPAUDate@@PAD1@Z
?KkmCurrCodeAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@E@Z
?KkmCurrCodeAtomEx@CMoebiusKKM@@QAEEPAEE0E@Z
?KkmDropTransFsclStorage@CMoebiusKKM@@QAEEXZ
?KkmEKLZActivate@CMoebiusKKM@@QAEEPAUDate@@@Z
?KkmEKLZActivateReport2Port@CMoebiusKKM@@QAEEXZ
?KkmEKLZActivateReport@CMoebiusKKM@@QAEEXZ
?KkmEKLZCloseArchive@CMoebiusKKM@@QAEEXZ
?KkmEKLZGetShiftTotal@CMoebiusKKM@@QAEEK@Z
?KkmEKLZGetShiftTotalDFP@CMoebiusKKM@@QAEEK@Z
?KkmEKLZGetShiftTotalInternal@CMoebiusKKM@@QAEEKE@Z
?KkmEKLZReport@CMoebiusKKM@@QAEEEEEPAUDate@@0KKE@Z
?KkmEKLZReportDFP@CMoebiusKKM@@QAEEEEEPAUDate@@0KKE@Z
?KkmEKLZReportInternal@CMoebiusKKM@@QAEEEEEPAUDate@@0KKEE@Z
?KkmEodDoc@CMoebiusKKM@@QAEEXZ
?KkmExec@CMoebiusKKM@@QAEEEGGEEEPAD@Z
?KkmFactoryReg@CMoebiusKKM@@QAEEPAD0PAUDate@@00@Z
?KkmFirmAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@@Z
?KkmFirmAtomEx@CMoebiusKKM@@QAEEPAEE0@Z
?KkmFiscalProcess@CMoebiusKKM@@QAEEPAD0PAUDate@@000@Z
?KkmFiscalProcessTmp@CMoebiusKKM@@QAEEPAD0PAUDate@@000E@Z
?KkmFiscalReport@CMoebiusKKM@@QAEEPADEEPAUDate@@11GG@Z
?KkmFsclClose@CMoebiusKKM@@QAEEQAH@Z
?KkmFsclGetRegData@CMoebiusKKM@@QAEEPAEHPAH@Z
?KkmFsclGetRegInfo@CMoebiusKKM@@QAEEFFPAEHPAH@Z
?KkmGenCommand@CMoebiusKKM@@QAEEEEEPAEHPAH@Z
?KkmGetArchDoc@CMoebiusKKM@@QAEEKPAEHPAH@Z
?KkmGetCommonData@CMoebiusKKM@@QAEEE@Z
?KkmGetDepData@CMoebiusKKM@@QAEEXZ
?KkmGetDopInfo@CMoebiusKKM@@QAEEPAE@Z
?KkmGetDopInfoNew@CMoebiusKKM@@QAEEEPAE@Z
?KkmGetEKLData@CMoebiusKKM@@QAEEXZ
?KkmGetEKLDataNew@CMoebiusKKM@@QAEEEHPAEHPAH@Z
?KkmGetEKLZChek2@CMoebiusKKM@@QAEEKE@Z
?KkmGetEKLZChek@CMoebiusKKM@@QAEEK@Z
?KkmGetEKLZChekDFP@CMoebiusKKM@@QAEEK@Z
?KkmGetEKLZContrLent@CMoebiusKKM@@QAEEK@Z
?KkmGetEKLZContrLentDFP@CMoebiusKKM@@QAEEK@Z
?KkmGetEKLZContrLentInternal@CMoebiusKKM@@QAEEKE@Z
?KkmGetEKLZNumber@CMoebiusKKM@@QAEEPADH@Z
?KkmGetFSLastDoc@CMoebiusKKM@@QAEEPAEHPAH@Z
?KkmGetKKMInfo@CMoebiusKKM@@QAEEPADEE@Z
?KkmGetKKMInfoEx@CMoebiusKKM@@QAEEPAD@Z
?KkmGetKKMInfoExNew@CMoebiusKKM@@QAEEPAD@Z
?KkmGetLastErrFsclStorage@CMoebiusKKM@@QAEEQAE@Z
?KkmGetMbsDate@CMoebiusKKM@@QAEEPAUDate@@@Z
?KkmGetMbsDateNew@CMoebiusKKM@@QAEEPAUDate@@@Z
?KkmGetOdometerValue@CMoebiusKKM@@QAEEPADH@Z
?KkmGetPPPStatus@CMoebiusKKM@@QAEHXZ
?KkmGetRegistrInfo@CMoebiusKKM@@QAEEPAD@Z
?KkmGetShiftData@CMoebiusKKM@@QAEEE@Z
?KkmGetShiftDataNew@CMoebiusKKM@@QAEEPAE@Z
?KkmGetShiftInfo@CMoebiusKKM@@QAEEEPAEHPAH@Z
?KkmGetShiftInfoNew@CMoebiusKKM@@QAEEPAEHPAH@Z
?KkmGetTransPsw@CMoebiusKKM@@QAEEPAD0@Z
?KkmGetTvlData@CMoebiusKKM@@QAEEPAEHPAH@Z
?KkmGetTvlDoc@CMoebiusKKM@@QAEEHQAF@Z
?KkmGetVerInternalNum@CMoebiusKKM@@QAEEPAD@Z
?KkmGoodsPosPrintCommon@CMoebiusKKM@@QAEEHPAEAAY02U<unnamed-type-Coord>@@PAD22AANNNHHH@Z
?KkmGoodsText@CMoebiusKKM@@QAEEEPAD@Z
?KkmIncTag@CMoebiusKKM@@QAEEGPAXG@Z
?KkmMakeCheck@CMoebiusKKM@@QAEEPAUDate@@EE@Z
?KkmMakeCheckEx2@CMoebiusKKM@@QAEEPAUDate@@EE@Z
?KkmMakeCheckEx@CMoebiusKKM@@QAEEPAUDate@@EEEEEEE@Z
?KkmMakeCheckNew@CMoebiusKKM@@QAEEPAUDate@@EE@Z
?KkmMakeRegNum@CMoebiusKKM@@QAEEPAD0000@Z
?KkmMirror@CMoebiusKKM@@QAEEE@Z
?KkmMkItm@CMoebiusKKM@@QAEEHPAUItem@@@Z
?KkmMkItmNew@CMoebiusKKM@@QAEEHPAUItemNew@@@Z
?KkmMkItmNewEx@CMoebiusKKM@@QAEEHPAUItemNew@@E@Z
?KkmNumAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@G@Z
?KkmNumAtomEx@CMoebiusKKM@@QAEEPAEE0G@Z
?KkmOpenShift@CMoebiusKKM@@QAEEPAUDate@@EPAD@Z
?KkmOpenShiftNew@CMoebiusKKM@@QAEEPAUDate@@@Z
?KkmPasswordChg@CMoebiusKKM@@QAEEPAD0@Z
?KkmPereregProcess@CMoebiusKKM@@QAEEPAD0PAUDate@@000@Z
?KkmPrintArchDoc@CMoebiusKKM@@QAEEKE@Z
?KkmPrintCmd@CMoebiusKKM@@QAEEEIPAEH0HPAH@Z
?KkmPrintCmdNew@CMoebiusKKM@@QAEEEIPAEH0HPAH@Z
?KkmPrintDocByNum@CMoebiusKKM@@QAEEHEEE@Z
?KkmPrintVersion@CMoebiusKKM@@QAEEXZ
?KkmPrnEKLCassir@CMoebiusKKM@@QAEEXZ
?KkmPrnEKLDep@CMoebiusKKM@@QAEEXZ
?KkmPrnEKLInfo@CMoebiusKKM@@QAEEXZ
?KkmPrnEKLSale@CMoebiusKKM@@QAEEXZ
?KkmPrnEKLStep@CMoebiusKKM@@QAEEXZ
?KkmPrnIDData@CMoebiusKKM@@QAEEPAEHPAH@Z
?KkmPrnIDDataEx@CMoebiusKKM@@QAEEHPAEHPAH@Z
?KkmRcptClose@CMoebiusKKM@@QAEEUDate@@E_JEPAUKkmReceiptClose@@@Z
?KkmReceiptText@CMoebiusKKM@@QAEEEPAD@Z
?KkmRegistrate@CMoebiusKKM@@QAEEE@Z
?KkmResetCheck@CMoebiusKKM@@QAEEXZ
?KkmRoundSet2@CMoebiusKKM@@QAEEK@Z
?KkmRoundSet@CMoebiusKKM@@QAEEG@Z
?KkmSelectPrinter@CMoebiusKKM@@QAEEXZ
?KkmSelectPrinterNew@CMoebiusKKM@@QAEEXZ
?KkmSendQR@CMoebiusKKM@@QAEEPAD@Z
?KkmSendQRSlip@CMoebiusKKM@@QAEEPAD@Z
?KkmSendTextBlock@CMoebiusKKM@@QAEEPADH@Z
?KkmSendTextBlockNew@CMoebiusKKM@@QAEEPADH@Z
?KkmSendTextBlockWithCheckPaper@CMoebiusKKM@@QAEEPADH@Z
?KkmSendTextBlockWithCheckPaperNew@CMoebiusKKM@@QAEEPADH@Z
?KkmSetBuyerId@CMoebiusKKM@@QAEEPAD@Z
?KkmSetBuyerName@CMoebiusKKM@@QAEEPAD@Z
?KkmSetCountryCode@CMoebiusKKM@@QAEEPADH@Z
?KkmSetCustomsDNum@CMoebiusKKM@@QAEEPADH@Z
?KkmSetEMail@CMoebiusKKM@@QAEEPAD@Z
?KkmSetExcise@CMoebiusKKM@@QAEENH@Z
?KkmSetFDSParams@CMoebiusKKM@@QAEEIIGQAE@Z
?KkmSetFirmInfo@CMoebiusKKM@@QAEEPAD@Z
?KkmSetOutput@CMoebiusKKM@@QAEEH@Z
?KkmSetOutputNew@CMoebiusKKM@@QAEEH@Z
?KkmSodDoc@CMoebiusKKM@@QAEEXZ
?KkmSumAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@PADH@Z
?KkmSumAtomEx@CMoebiusKKM@@QAEEPAEE0PADH@Z
?KkmSupplItem@CMoebiusKKM@@QAEEEEPAVTag@@00@Z
?KkmSysAtom28@CMoebiusKKM@@QAEEPAEAAY02U<unnamed-type-Coord>@@@Z
?KkmSysAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@@Z
?KkmSysAtomEx@CMoebiusKKM@@QAEEPAEE0@Z
?KkmTestCommand@CMoebiusKKM@@QAEEPAEHPAH@Z
?KkmTextAtom@CMoebiusKKM@@QAEEPAEEQAU<unnamed-type-Coord>@@EPAD@Z
?KkmTextAtomEx@CMoebiusKKM@@QAEEPAEE0EPAD@Z
?LoadTagsGood@CMoebiusKKM@@QAEEXZ
?OtherConsumerThread@CMoebiusKKM@@QAEXXZ
?Prn_GetPrinterStatus@CMoebiusKKM@@QAEEEPAE@Z
?Prn_Paper_cut@CMoebiusKKM@@QAEEXZ
?Prn_drawer_chk@CMoebiusKKM@@QAEEPAE@Z
?Prn_drawer_open@CMoebiusKKM@@QAEEXZ
?Prn_slp_insert@CMoebiusKKM@@QAEEXZ
?Prn_slp_remove@CMoebiusKKM@@QAEEXZ
?Prn_tpm_write@CMoebiusKKM@@QAEEJPADH@Z
?ReceiveDataThread@CMoebiusKKM@@QAEXXZ
?ResetLastResponseData@CMoebiusKKM@@QAEXXZ
?SendDataToLwIP@CMoebiusKKM@@QAEHPAEH@Z
?SetAddrCreateOutputCompleteEvent@CMoebiusKKM@@QAEEJ@Z
?SetAddrDrawData@CMoebiusKKM@@QAEEJ@Z
?SetAddrUpdatePrinterState@CMoebiusKKM@@QAEEJ@Z
?SetCurrDate@CMoebiusKKM@@SAXPAUDate@@H@Z
?SetDTR@CMoebiusKKM@@QAEXXZ
?SetEMail@CMoebiusKKM@@QAEEXZ
?SetIndentReceiptHead@CMoebiusKKM@@QAEEE@Z
?SetIpConfig@CMoebiusKKM@@QAEEPAD0H0@Z
?SetReceipt2Sleep@CMoebiusKKM@@QAEEE@Z
?SetVatSum@CMoebiusKKM@@QAEEHH@Z
?SetVatValue@CMoebiusKKM@@QAEEHH@Z
?SetupPrinter@CMoebiusKKM@@IAEEXZ
?StartOtherConsumerThread@CMoebiusKKM@@SAXPAX@Z
?StartReceiveDataThread@CMoebiusKKM@@SAXPAX@Z
?StrToDateTime@CMoebiusKKM@@SAXPADPAUDate@@H@Z
?Text2Binary@CMoebiusKKM@@SAHPADPAEHH@Z
?TextDataHandler@CMoebiusKKM@@SAHPADPAPAD@Z
?UpdatePrinterState@CMoebiusKKM@@QAEXJ@Z
?WaitDSR@CMoebiusKKM@@QAEHJ@Z
?XRepOld@@3AAKA
?_FileReport@@YGEPAUtm@@0PAHPAMH@Z
?_KkmFsclGetRegData@@YGEPAEHPAH@Z
?_KkmFsclGetRegInfo@@YGEFFPAEHPAH@Z
?_KkmGenCommand@@YGEEEEPAEHPAH@Z
?_KkmGetShiftInfoNew@@YGEPAEHPAH@Z
?_KkmSetCountryCode@@YGEPADH@Z
?_KkmSetCustomsDNum@@YGEPADH@Z
?_KkmSetExcise@@YGENH@Z
?__autoclassinit2@CMoebiusKKM@@QAEXI@Z
?crc16@CMoebiusKKM@@QAEGPBEG@Z
?m_AsyncMode@CMoebiusKKM@@2HA
?m_CmdTimeOut@CMoebiusKKM@@2EA
?m_Comm@CMoebiusKKM@@2EA
?m_DopInfo@CMoebiusKKM@@2TKkmFS_state@@A
?m_DsrTimeOut@CMoebiusKKM@@2EA
?m_IndentReceiptHead@CMoebiusKKM@@2EA
?m_KkmType@CMoebiusKKM@@2KA
?m_ModulePath@CMoebiusKKM@@2PADA
?m_OutputID@CMoebiusKKM@@2KA
?m_PPD@CMoebiusKKM@@2PADA
?m_PauseSendByte@CMoebiusKKM@@2KA
?m_Precision@CMoebiusKKM@@2EA
?m_RI@CMoebiusKKM@@2UKkmRegistrInfo@@A
?m_Speed@CMoebiusKKM@@2KA
?m_Ver@CMoebiusKKM@@2EA
?m_XRepOld@CMoebiusKKM@@2KA
?m_Zebra@CMoebiusKKM@@2EA
?m_bConsoleOpened@CMoebiusKKM@@2HA
?m_bEmailDialog@CMoebiusKKM@@2HA
?m_bFirstCall@CMoebiusKKM@@2HA
?m_bLogToFile@CMoebiusKKM@@2HA
?m_fConnectPort@CMoebiusKKM@@2HA
?m_fConsoleApl@CMoebiusKKM@@2HA
?m_fExitTreadFinish@CMoebiusKKM@@2HA
?m_fLetUseHandleMessage@CMoebiusKKM@@2HA
?m_fOutxDsrFlow@CMoebiusKKM@@2HA
?m_fPrintNDS@CMoebiusKKM@@2HA
?m_fProshDebug@CMoebiusKKM@@2HA
?m_fReceipt2Sleep@CMoebiusKKM@@2EA
?m_fRound@CMoebiusKKM@@2EA
?m_fWaitingResponse@CMoebiusKKM@@2HA
?m_fpNotCutRep@CMoebiusKKM@@2KA
?m_ks@CMoebiusKKM@@2UKkmState@@A
?m_ksEx@CMoebiusKKM@@2UTotSendHost@@A
?m_ksExNew@CMoebiusKKM@@2UTotSendHostNew@@A
?mbs_DataMatrix@CMoebiusKKM@@QAEEEEPAD@Z
?mbs_NamePlusCode@CMoebiusKKM@@QAEEEPAD@Z
?mbs_RecItem@CMoebiusKKM@@QAEEPAD00KKKKH0@Z
?mbs_RecItemAdjust@CMoebiusKKM@@QAEEHHHHPAD@Z
?mbs_RecItemAdjustVoid@CMoebiusKKM@@QAEEHHHHPAD@Z
?mbs_RecItemVoid@CMoebiusKKM@@QAEEPAD00KKKKH0@Z
?mbs_Subtotal@CMoebiusKKM@@QAEEK@Z
?mbs_SubtotalAdjust@CMoebiusKKM@@QAEEHHHPAD@Z
?mbs_SubtotalAdjustVoid@CMoebiusKKM@@QAEEHHHPAD@Z
?mbs_addressee@CMoebiusKKM@@QAEEPAD@Z
?mbs_adjust_sum@CMoebiusKKM@@QAEEHHHHHHH@Z
?mbs_adjust_sum@CMoebiusKKM@@QAEEHHHHHHHPAD@Z
?mbs_buy@CMoebiusKKM@@QAEEPAD00NNNHHHEH@Z
?mbs_cashier@CMoebiusKKM@@QAEEPAD@Z
?mbs_head2@CMoebiusKKM@@QAEEEEPADE@Z
?mbs_head@CMoebiusKKM@@QAEEEEPAD@Z
?mbs_headEx2@CMoebiusKKM@@QAEEEEPAD@Z
?mbs_pos@CMoebiusKKM@@QAEEHPAD000HHHKHHH@Z
?mbs_put2@CMoebiusKKM@@QAEEHKKEHHHPAD0EHHH@Z
?mbs_put3@CMoebiusKKM@@QAEEHKKEE@Z
?mbs_put4@CMoebiusKKM@@QAEEHKKEHHHPAD0EHHHH@Z
?mbs_put@CMoebiusKKM@@QAEEHKKEHHPAD0EHH@Z
?mbs_sale@CMoebiusKKM@@QAEEHKHHHHEH@Z
?mbs_sender@CMoebiusKKM@@QAEEPAD@Z
?mbs_tot2@CMoebiusKKM@@QAEEHHHHQAUPaymentSt@@0PADKKKK@Z
?mbs_tot@CMoebiusKKM@@QAEEHHHQAUPaymentSt@@0PADKK@Z
?mbs_tot_first_rec@CMoebiusKKM@@QAEEHHHHQAUPaymentSt@@0PADKKKKE@Z
?moebius_init@CMoebiusKKM@@QAEHHHPAD0@Z
?moebius_send@CMoebiusKKM@@QAEHHPADH@Z
?moebius_uninit@CMoebiusKKM@@QAEHH@Z
?pMoebiusKKM@CMoebiusKKM@@2PAV1@A
?pRI@@3AAUKkmRegistrInfo@@A
?prn_log@CMoebiusKKM@@SAXPAD@Z
?prn_log_bin@CMoebiusKKM@@QAEXPADH@Z
?round@CMoebiusKKM@@SANN@Z
Binary2Text
CatLogFile
ClearOutput
ClearVatTableAndSum
DestroyObject
DoPrinting
DoPrintingLastCmd
ExecCommand
FileReport
GetBarrierState
GetCBMdlFreeBuffer
GetClassNames
GetClassObject
GetDSRStatus
GetInternalPrinterStatus
GetLastKkmErr
GetLastResponseData
GetPowerState
GetReadyForNextCommand
GetStatus
GetVatSum
GetVatValue
IsCommEnable
KkmAddLocTag
KkmAddTag
KkmAgentAtom
KkmAgentItem
KkmCasherChg
KkmChangeHeader
KkmChangeHeaderEx
KkmCheckPaper
KkmCleanFsclStorage
KkmClearLocTag
KkmCloseShift
KkmCloseShiftNew
KkmCodeAtom
KkmCodeAtomEx
KkmCommonReset
KkmConvertToOEM
KkmCorrAtom
KkmCurrCodeAtom
KkmCurrCodeAtomEx
KkmDropTransFsclStorage
KkmEKLZActivate
KkmEKLZActivateReport
KkmEKLZActivateReport2Port
KkmEKLZCloseArchive
KkmEKLZGetShiftTotal
KkmEKLZReport
KkmEodDoc
KkmFactoryReg
KkmFirmAtom
KkmFirmAtomEx
KkmFiscalProcess
KkmFiscalReport
KkmFsclClose
KkmFsclGetRegData
KkmFsclGetRegInfo
KkmGenCommand
KkmGetArchDoc
KkmGetCommonData
KkmGetDepData
KkmGetDopInfo
KkmGetDopInfoNew
KkmGetEKLData
KkmGetEKLDataNew
KkmGetEKLZChek
KkmGetEKLZChek2
KkmGetEKLZContrLent
KkmGetEKLZNumber
KkmGetKKMInfo
KkmGetKKMInfo2
KkmGetKKMInfoEx
KkmGetKKMInfoExNew
KkmGetLastErrFsclStorage
KkmGetMbsDate
KkmGetOdometerValue
KkmGetPPPStatus
KkmGetRegistrInfo
KkmGetShiftData
KkmGetShiftInfo
KkmGetShiftInfoNew
KkmGetTransPsw
KkmGetTvlData
KkmGetTvlDoc
KkmGetVerInternalNum
KkmGoodsText
KkmIncTag
KkmMakeCheck
KkmMakeCheckEx
KkmMakeCheckNew
KkmMakeRegNum
KkmMirror
KkmMkItm
KkmMkItmNew
KkmMkItmNewEx
KkmNumAtom
KkmNumAtomEx
KkmOpenShift
KkmOpenShiftNew
KkmPasswordChg
KkmPereregProcess
KkmPrintArchDoc
KkmPrintCmd
KkmPrintDocByNum
KkmPrintVersion
KkmPrnEKLCassir
KkmPrnEKLDep
KkmPrnEKLInfo
KkmPrnEKLSale
KkmPrnEKLStep
KkmPrnIDData
KkmPrnIDDataEx
KkmRcptClose
KkmReceiptText
KkmRegistrate
KkmResetCheck
KkmRoundSet
KkmRoundSet2
KkmSelectPrinter
KkmSendQR
KkmSendQRSlip
KkmSendTextBlock
KkmSendTextBlockWithCheckPaper
KkmSetBuyerId
KkmSetBuyerName
KkmSetCountryCode
KkmSetCustomsDNum
KkmSetEMail
KkmSetExcise
KkmSetFDSParams
KkmSetFirmInfo
KkmSetOutput
KkmSodDoc
KkmSumAtom
KkmSumAtomEx
KkmSupplItem
KkmSysAtom
KkmSysAtomEx
KkmTestCommand
KkmTextAtom
KkmTextAtomEx
Prn_GetPrinterStatus
Prn_Paper_cut
Prn_drawer_chk
Prn_drawer_open
Prn_slp_insert
Prn_slp_remove
Prn_tpm_write
ResetLastResponseData
SetAddrCreateOutputCompleteEvent
SetAddrDrawData
SetAddrUpdatePrinterState
SetCBFreeBuffer
SetCBSendAndReceive
SetCurrDate
SetIpConfig
SetPlatformCapabilities
SetVatSum
SetVatValue
StrToDateTime
Text2Binary
TextDataHandler
_AuxInit@8
_MBUSAppCall@8
_ModelStart@24
_PAuxInit@12
_ReceiverInit@4
__Binary2Text@12
__CatLogFile@4
__ClearOutput@0
__ClearVatTableAndSum@0
__DoPrinting@24
__DoPrintingLastCmd@0
__GetBarrierState@0
__GetDSRStatus@4
__GetInternalPrinterStatus@0
__GetLastKkmErr@0
__GetLastResponseData@0
__GetPowerState@0
__GetVatSum@8
__GetVatValue@8
__IsCommEnable@4
__KkmAddLocTag@16
__KkmAddTag@12
__KkmAgentAtom@20
__KkmAgentItem@36
__KkmCasherChg@12
__KkmChangeHeader@4
__KkmChangeHeaderEx@8
__KkmCheckPaper@0
__KkmCleanFsclStorage@0
__KkmClearLocTag@0
__KkmCloseShift@8
__KkmCloseShiftNew@4
__KkmCodeAtom@16
__KkmCodeAtomEx@16
__KkmCommonReset@4
__KkmConvertToOEM@4
__KkmCorrAtom@16
__KkmCurrCodeAtom@16
__KkmCurrCodeAtomEx@16
__KkmDropTransFsclStorage@0
__KkmEKLZActivate@4
__KkmEKLZActivateReport2Port@0
__KkmEKLZActivateReport@0
__KkmEKLZCloseArchive@0
__KkmEKLZGetShiftTotal@4
__KkmEKLZReport@32
__KkmEodDoc@0
__KkmFactoryReg@20

Sections

.text
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3907740fb8922036a9af5ea0030cf23c

Headers

DLL Characteristics

File Characteristics

Imports

version

setupapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

Exports

Exports

Sections

.text Size: 717KB - Virtual size: 717KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 15KB - Virtual size: 83KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 50KB - Virtual size: 49KB

.text
Size: 717KB - Virtual size: 717KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 15KB - Virtual size: 83KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 50KB - Virtual size: 49KB