90ba4be10b2f9047d72145213195441c4bf81484a6df9025b120947592414e83

Sharing

Copy URL

Twitter E-mail

General

Target

90ba4be10b2f9047d72145213195441c4bf81484a6df9025b120947592414e83
Size

76KB
MD5

7f6a5acb3e5cdfee49e2604ff78a2c21
SHA1

53aa14332b91812538cf46492f5a2771e4572a5d
SHA256

90ba4be10b2f9047d72145213195441c4bf81484a6df9025b120947592414e83
SHA512

660c263ad5557505d1c56289b5a0f5b07c197dd11c0451be6ef9d995ee2ad4637bf97ec86ae9bef680c9c2500a65a14be16ee77affdeb86e6c7b01b00fcf6de8
SSDEEP

768:dulnwREfOuDVL3Dp+1aBSmUB8HbbbzKRNI436amBY0HKQ2JLAS4mVctksaK0GQDw:dGne8j3h7+PIPBY0Z2/3cukQDm5C4nF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90ba4be10b2f9047d72145213195441c4bf81484a6df9025b120947592414e83

Files

90ba4be10b2f9047d72145213195441c4bf81484a6df9025b120947592414e83
.dll windows:4 windows x86

5d12adae708ffff213e9846cc472101f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetQueryOptionA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetReadFileExA
HttpQueryInfoA
InternetGetConnectedState
InternetSetStatusCallback
InternetReadFile
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA

rpcrt4

UuidToStringA
RpcStringFreeA

mfc42

ord541
ord348
ord909
ord5628
ord858
ord800
ord6883
ord537
ord6143
ord2818
ord540
ord535
ord860
ord823
ord6307
ord1105
ord521
ord2764
ord4202
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord663
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord1265
ord2915
ord715
ord415
ord1081
ord5620
ord1567
ord268
ord3663
ord2841
ord2107
ord551
ord3811
ord1116
ord5440
ord6383
ord6394
ord2614
ord3337
ord6283
ord6282
ord4204
ord4277
ord4278
ord6663
ord1979
ord6385
ord665
ord5186
ord354
ord5442
ord5861
ord801
ord4185
ord803
ord825
ord394
ord543
ord696
ord3643
ord3584
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord3081
ord5450

msvcrt

__dllonexit
rand
strncmp
free
realloc
_onexit
__CxxFrameHandler
_mbscmp
atoi
strchr
_mbsnbcpy
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
malloc
_mkdir
_purecall
_mbsicmp

kernel32

GetLastError
LeaveCriticalSection
ResumeThread
WaitForSingleObject
GetExitCodeThread
LocalFree
LocalAlloc
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
SetEvent
ResetEvent
Sleep
TerminateThread
WaitForMultipleObjects
InterlockedCompareExchange

user32

PostMessageA

ole32

CoCreateGuid
CoInitialize

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ

dalog

?storage@CDALog@@QAEXPBD00_N1@Z
?DALogFini@@YAXXZ
??1CDALog@@QAE@XZ
??0CDALog@@QAE@XZ
??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?Write@CDALog@@QAAXPBDZZ

gzip2

A2Gzip
Gzip2A

xmlhelper3

??0CXmlDocument@PugiXMLHelper@@QAE@XZ
?SelectSingleNode@CXmlDocument@PugiXMLHelper@@QBE?AVCXmlNode@2@PBDPAVxpath_variable_set@pugi@@@Z
?GetNodeValue_String@CXmlUtil@PugiXMLHelper@@SAPBDAAVCXmlNode@2@PAD@Z
??1CXmlNode@PugiXMLHelper@@QAE@XZ
??1CXmlDocument@PugiXMLHelper@@QAE@XZ

Exports

Exports

?jdCmdGetNotify@JDCmdSvr@@YAXHPAPAEAAVCString@@PAHW4CMDNotifyType@1@@Z
?jdCmdSetServerTime@JDCmdSvr@@YAXJJ@Z
?jdCmdSvcConnect@JDCmdSvr@@YAHABVCString@@0@Z
?jdCmdSvcDisconnect@JDCmdSvr@@YAXXZ
?jdCmdSvcFini@JDCmdSvr@@YAXXZ
?jdCmdSvcFireUIEvent@JDCmdSvr@@YAXW4CMDNotifyType@1@PAXABVCString@@@Z
?jdCmdSvcGetService@JDCmdSvr@@YAPAVIJDCmdService@1@XZ
?jdCmdSvcInit@JDCmdSvr@@YAHPAUHWND__@@ABVCString@@11@Z

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d12adae708ffff213e9846cc472101f

Headers

File Characteristics

Imports

wininet

rpcrt4

mfc42

msvcrt

kernel32

user32

ole32

msvcp60

dalog

gzip2

xmlhelper3

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 8KB - Virtual size: 4KB