1327d1a8e074c6e4021cc8ca6ad0aa1154a36b9b327e51e51473cca103ee3865[.]zip[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

1327d1a8e074c6e4021cc8ca6ad0aa1154a36b9b327e51e51473cca103ee3865.zip.zip
Size

8.9MB
MD5

7181b142ac16584a018c4edb03ab9891
SHA1

501068b7cdff61570567c19e814a30d4e5d8bcce
SHA256

8bc1d3a17dd38ee28cdc9104e13fa5c48783d0b5e883e39c29414aefb477f913
SHA512

04173c38ceebfdbdeafb3aaf73210966fa342f852292675b5b05bbe15204a837279bd9c267355e9df046231546329618b14068a7ee47e6016008e07d26a1a66a
SSDEEP

196608:PVp1cKXs55gvU3xCXEADEuwQoS9ZrQyV0Wb7/PjZf:oeUBegdQoS9ZrHxDd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/setup.exe	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack003/LVANLYS.DLL.4.99BE9A60B3B24BD2BFC12AF748DECC2D
unpack003/LVZLIB.DLL.5.99BE9A60B3B24BD2BFC12AF748DECC2D
unpack003/SMARTSOFTSSI.EXE.1.99BE9A60B3B24BD2BFC12AF748DECC2D
unpack002/setup.exe
unpack004/out.upx
unpack002/supportfiles/customResource0009.dll

Files

1327d1a8e074c6e4021cc8ca6ad0aa1154a36b9b327e51e51473cca103ee3865.zip.zip
.zip

Password: infected
1327d1a8e074c6e4021cc8ca6ad0aa1154a36b9b327e51e51473cca103ee3865.zip
.zip
bin/dp/DevPartDef.xml
bin/dp/data.cab
.cab
JET.JPG.8.99BE9A60B3B24BD2BFC12AF748DECC2D
.jpg
LVANLYS.DLL.4.99BE9A60B3B24BD2BFC12AF748DECC2D
.dll windows:4 windows x86

925d69d4fe9d05657a61fcd3a1e09775

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
ExitProcess
LocalAlloc
ReleaseMutex
LoadLibraryExA
GetModuleFileNameA
CloseHandle
ReadFile
CreateFileA
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
GetStdHandle
RaiseException
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetProcAddress
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
InitializeCriticalSection
RtlUnwind
InterlockedExchange
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsSetValue
FreeLibrary
CreateMutexA
WaitForSingleObject

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Exports

Exports

ANOVA3Way_head
AllCosWinH
Anova1Way_head
Anova2Way_head
AperiodTriangleH
ArbitraryWaveCIN
AutoCorrMtrxH
AutoCorrelation
AutoCorrelation80
AxBCxAlignedCIN
AxBCxCIN
AxVectAligned_head
AxVect_head
AxVectorCx
AxVectorCxAligned
BSplineFit_head
BWCoefs
BWCoefs90
BandEqsDriH
BandEqsSetDriH
BartHannWinH
BesselCoefs
BesselCoefs90
BiExpFit_head
BiGaussFit_head
BiLinearFit_head
BiLogFit_head
BiPolyFit_head
BiPowerFit_head
BinomialNoiseH
BohmanWinH
BoundExpFit_head
BoundGaussianFit_head
BoundLinearFitBi_head
BoundLinearFitLAR_head
BoundLinearFit_head
BoundLogFit_head
BoundPowerFit_head
CartesianShift2D_head
CartesianShift3D_head
ChebyshevCoefs
ChebyshevCoefs90
CheckPosSemiDef_head
CheckPosdef_head
CheckSym_head
ChiSquare_head
ChirpCIN
ChirpZT_head
CholeskyLinEqs_head
Cholesky_InvMatrix_head
Cholesky_head
CompactToMatrix_H
Compact_to_Matrix_head
CondNumber_head
ConfBndExp_head
ConfBndGauss_head
ConfBndLinear_head
ConfBndLog_head
ConfBndPoly_head
ConfBndPower_head
Contingency_head
Convolution
Convolve_2DH
CoordConversion_head
CoordRotation2D_head
CoordRotationDirect_head
CoordRotationEuler2011_head
CoordRotationEuler_head
Correlation_2DH
CosTapered
CosTaperedH
CreateMatrixFromEVs_head
CrossSpectrumH
CubicSplineFit_head
CxAllCosWinH
CxAutoCorrMtrxH
CxBandEqsDriH
CxBandEqsSetDriH
CxBartHannWinH
CxBohmanWinH
CxCascadedMovingAverageH
CxCheckPosSemiDef_head
CxCheckPosdef_head
CxCheckSym_head
CxChirpZT_head
CxCholeskyLinEqs_head
CxCholesky_InvMatrix_head
CxCholesky_head
CxCompact_to_Matrix_head
CxComplexModulatorH
CxCondNumber_head
CxConvolution
CxConvolve_2DH
CxCorrelation_2DH
CxCosTaperedH
CxCrossSpectrumH
CxDZTH
CxDecimateContinuous_H
CxDecimate_H
CxDecimatedMovingAverageH
CxDeterminant_head
CxDolChebyWinH
CxEigenVBack_head
CxEigenValueVector_head
CxEqsByCholeskyDri_head
CxEqsByLUDri_head
CxEqsSetByCholeskyDri_head
CxEqsSetByLUDri_head
CxEqsSetBySVDDri82_head
CxEqsSetBySVDDri_head
CxExpWinH
CxFFT2D_H
CxForceWinH
CxFullCholesky_head
CxGSVD_head
CxGaussWinH
CxGenCosWinH
CxGenEigenEx_head
CxGenLinEqs82_head
CxGenLinEqs_head
CxHessenberg_head
CxIIRReSig_Filter_H
CxIIR_Filter_H
CxInitialMatrixH
CxInvFFT2D_H
CxInvMatrixChoDri_head
CxInvMatrixLUDri_head
CxInvMatrixTriDri_head
CxKaiserH
CxKroneckerProd_H
CxLUInvMatrix_head
CxLULinEqs_head
CxLU_head
CxLyapunov85_head
CxLyapunov_head
CxMatrixBalance_head
CxMatrixCharacteristicPoly_head
CxMatrixExp_head
CxMatrixLn_head
CxMatrixPower_head
CxMatrixSqrt_head
CxMatrix_to_Compact_head
CxMultPolyRoots_head
CxNIFFTH
CxNIFFTH80
CxNorm_head
CxParzenWinH
CxPolyGCD_H
CxPolyRoots_head
CxPseudoInverse_head
CxQRDecH
CxQZ80_head
CxQZ_head
CxRMS_head
CxRank_head
CxRationalResampleMCh_H
CxRationalResample_H
CxResample_Const
CxResample_Variable
CxSVDEx_head
CxSVDS_head
CxSVD_head
CxScaledWinH
CxSchur80_head
CxSchur_head
CxSigFIRnarrowFilter_head
CxSigIIR_Filter
CxSigIIR_Filter2
CxSpecialMatrix_head
CxSpectrumH
CxSylvester81_head
CxSylvester_head
CxSymmWinH
CxTmiQZ_head
CxTrace_head
CxTranspose_head
CxTriEqsSetDri_head
CxTriLinEqs_head
CxTri_InvMatrix_head
CxTriangleWinH
CxUnitVector80_head
CxUnitVector_head
CxVectorNormH
CxVectxAAligned_head
CxVectxA_head
CxWelchWinH
Cxqrd_head
CycleRMSAverage
DCT_1DH
DCT_2DH
DST_1DH
DST_2DH
DecimateCIN
DecimateContinuous_H
Deconvolution
Derivative
Derivative85
Determinant_head
Direction2Euler2011_head
Direction2Euler_head
DisableAnalysisWorkspaceH
DolChebyWinH
DotProduct_head
DotprodCx
EigenVBack_head
EigenValueVector_head
EllipticCoefs
EllipticCoefs90
EnableAnalysisWorkspaceH
EqsByCholeskyDri_head
EqsByLUDri_head
EqsSetByCholeskyDri_head
EqsSetByLUDri_head
EqsSetBySVDDri82_head
EqsSetBySVDDri_head
Euler2Direction2011_head
Euler2Direction_head
EvPoly2D
ExpFit80_head
ExpFitCoef80_head
ExpFitCoef_head
ExpFit_head
ExpWinH
ExpWindCIN
FDist_head
FHTH
FIRCoefs
FIRNarrowCoef_head
FIRnarrowFilter_head
FastHilbertTransformH
ForceWinH
ForceWindCIN
FreqMod
FullCholesky_head
GSVD_head
GammaNoiseH
Gauss
GaussMonopulseH
GaussPulseH
GaussWinH
GaussianPeakFitCoef_head
GaussianPeakFit_head
GenBisquareFit_Weight_head
GenBisquareFit_head
GenCosWinH
GenEigenEx_head
GenHistH
GenLARFit_head
GenLSFit80_head
GenLSFit_head
GenLinEqs2010_head
GenLinEqs82_head
GenLinEqs_head
GenLinEqsbySVD2011_head
GetNewCoef_head
GoodnessOfFit_head
Hessenberg_head
IIR_Filter
IIR_Filter2
ImpulsePtrn
InitialMatrixH
InitializeAnalysisWorkspaceH
Integral
Integral90
InvChebyshevCoefs
InvChebyshevCoefs90
InvChiSquare_head
InvChirpZT_head
InvCxNIFFTH
InvCxNIFFTH80
InvDCT_1DH
InvDCT_2DH
InvDST_1DH
InvDST_2DH
InvFDist_head
InvFHTH
InvFastHilbertTransformH
InvMatrixChoDri_head
InvMatrixLUDri_head
InvMatrixTriDri_head
InvNdist_head
InvReNIFFTH
InvReNIFFTH80
InvReNIFFTHCH
InvTdist_head
KaiserH
Kaiser_Bessel
KroneckerProd_H
LARExpFit_head
LARGaussFit_head
LARLinearFit_head
LARLogFit_head
LARPolyFit_head
LARPowerFit_head
LUInvMatrix_head
LULinEqs_head
LU_head
LV_Airy
LV_BesselIr
LV_BesselJr
LV_BesselJs
LV_BesselKn
LV_BesselYr
LV_BesselYs
LV_Beta
LV_Beta_85
LV_CosI
LV_CoshI
LV_CxAiry
LV_CxBesselHr
LV_CxBesselHs
LV_CxBesselIr
LV_CxBesselJr
LV_CxBesselJs
LV_CxBesselKr
LV_CxBesselYr
LV_CxBesselYs
LV_Dawson
LV_Diln
LV_Elliptic1
LV_Elliptic1_85
LV_Elliptic2
LV_Elliptic2_85
LV_EllipticJ
LV_Erf
LV_ErfC
LV_ExpI
LV_Fact
LV_FresnelIntegrals
LV_Gamma
LV_GammaC
LV_Gamma_85
LV_Gauss
LV_Gauss_2011
LV_KelvinI
LV_KelvinK
LV_Kummer
LV_LnFact
LV_LnGamma
LV_ParabolicCylinder
LV_Psi
LV_SinI
LV_SinhI
LV_Stirling
LV_Struve
LV_Tricomi
LV_Zeta
LinEv
LinFitCoef80_head
LinFitCoef_head
LinFit_head
Line1
LogFitCoef_head
LogFit_head
Lyapunov85_head
Lyapunov_head
MSE_head
MatrixBalance_head
MatrixCharacteristicPoly_head
MatrixExp_head
MatrixLn_head
MatrixMulAligned_head
MatrixMul_head
MatrixPower_head
MatrixSqrtH
MatrixSqrt_head
MatrixToCompact_H
Matrix_to_Compact_head
Mean_head
MedianFilter81_H
MedianFilterCIN
Median_head
ModeH
Moment_head
MultPolyRoots_head
Norm1
Norm2
NormDist_head
Norm_head
NumWinConstH
NumerIntegration2D_head
NumerIntegration3D_head
NumerIntegration_head
OuterProdCx_head
OuterProd_head
Parks
ParzenWinH
PeakD
PeakD2010
PeakDetector
PeriodNoise
PeriodicSincH
PhasMod
PoissonNoiseH
PolarToRect1D_head
PolyEv
PolyFit80_head
PolyFit81_head
PolyFit_head
PolyGCD_H
PolyInterp_head
PolyRootsNtBst_head
PowerFitCoef_head
PowerFit_head
PreallocInvMatrixChoDri_H
PredBndExp_head
PredBndGauss_head
PredBndLinear_head
PredBndLog_head
PredBndPoly_head
PredBndPower_head
PseudoInverse_head
PulseMeas
PulseMeasEx
PulseParameters
PulsePtrn
QRDecH
QS1D
QScale
QZ80_head
QZ_head
RMS_head
RampPtrn
RampPtrn80
RampPtrn85
Rank_head
RatInterp_head
RationalResampleMultiCh_H
RationalResample_H
ReCascadedMovingAverageH
ReComplexModulatorH
ReDZTH
ReDecimatedMovingAverageH
ReFFT2D_H
ReInvFFT2D_H
ReNIFFTH
ReNIFFTH80
ReNIFFTHCH
RectToPolar1D_head
Resample_Const
Resample_Variable
RiffleArrayCDB2012_head
RiffleArrayCDB_head
RiffleArrayDBL2012_head
RiffleArrayDBL_head
RiffleArrayInt2012_head
RiffleArrayInt_head
RiffleIntNum2012_head
RiffleIntNum_head
RmvOutlierIndx_head
RmvOutlierRng_head
Rxy
Rxy80
SVDEx_head
SVDS_head
SVD_head
SavitzkyGolayCoefH
SavitzkyGolayFiltH
SawtoothWaveCIN
Scale
Scale1DCIN
ScaledCxGenCosWinH
ScaledGenCosWinH
ScaledWinH
Schur80_head
Schur_head
SetLVRTModule
SetLVRTModuleHook
SetLVRTTLSIndex
SetLVRTTLSIndexHook
SincWave
SinePtrn
SineWaveCIN
SpInterp_head
SpecialMatrix_head
SpectrumH
Spline_head
Square
SquareWaveCIN
StateLevels
Sylvester81_head
Sylvester_head
SymEvectorEvalue_head
SymmWinH
TDist_head
TmiQZ_head
Trace_head
TransMeas
Transpose_head
TriDiagEqsByLU_head
TriDiagEqsSetByLU_head
TriDiagLU_head
TriEqsSetDri_head
TriLinEqs_head
Tri_InvMatrix_head
TriangleWaveCIN
TriangleWin
TriangleWinH
Triggerh
Triggerh_86

Sections

.text
Size: 1004KB - Virtual size: 1000KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT
Size: 4KB - Virtual size: 37B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_DATA
Size: 4KB - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LVZLIB.DLL.5.99BE9A60B3B24BD2BFC12AF748DECC2D
.dll windows:4 windows x86

552e3251a0fb4057c9aaf7cf23e30566

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
GetLastError
ReadFile
WriteFile
SetFilePointer
Sleep
FindNextFileA
SetFileAttributesA
GetFileAttributesA
SetFileTime
FindClose
FindFirstFileA
GetModuleHandleA
GetProcAddress
ExitProcess
DisableThreadLibraryCalls

msvcrt

fseek
ftell
malloc
free
sprintf
_ftol
remove
rand
srand
time
_initterm
_adjust_fdiv
fopen
fread
fwrite
fclose

user32

MessageBoxA

Exports

Exports

DLLVersion
InitializeFileFuncs
LVPath_DecodeMacbinary
LVPath_EncodeMacbinary
LVPath_HasResourceFork
LVPath_OpenFile
LVPath_ToText
LVPath_UtilFileInfo
SetLVRTModule
lvzip_adler32
lvzip_compress
lvzip_compress2
lvzip_crc32
lvzip_deflate
lvzip_inflate
lvzip_uncompress
lvzip_unzClose
lvzip_unzCloseCurrentFile
lvzip_unzGetCurrentFileInfo
lvzip_unzGetFilePos
lvzip_unzGetGlobalComment
lvzip_unzGetGlobalInfo
lvzip_unzGetLocalExtrafield
lvzip_unzGoToFilePos
lvzip_unzGoToFirstFile
lvzip_unzGoToNextFile
lvzip_unzLocateFile
lvzip_unzOpen
lvzip_unzOpen2
lvzip_unzOpenCurrentFile
lvzip_unzOpenCurrentFile2
lvzip_unzOpenCurrentFile3
lvzip_unzOpenCurrentFilePassword
lvzip_unzReadCurrentFile
lvzip_unzRepair
lvzip_unzStringFileNameCompare
lvzip_unzeof
lvzip_unztell
lvzip_zipClose
lvzip_zipClose2
lvzip_zipCloseFileInZip
lvzip_zipCloseFileInZipRaw
lvzip_zipOpen
lvzip_zipOpen2
lvzip_zipOpenNewFileInZip
lvzip_zipOpenNewFileInZip2
lvzip_zipOpenNewFileInZip3
lvzip_zipWriteInFileInZip
lvzip_zlibVersion

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MODBUSLIBRARY_ERRORS.TXT.11.99BE9A60B3B24BD2BFC12AF748DECC2D
.xml
MODBUSVIEWOTCP_ERRORS.TXT.12.99BE9A60B3B24BD2BFC12AF748DECC2D
.xml
SMARTSOFTSSI.ALIASES.2.99BE9A60B3B24BD2BFC12AF748DECC2D
SMARTSOFTSSI.EXE.1.99BE9A60B3B24BD2BFC12AF748DECC2D
.exe windows:5 windows x86

4bf9d6e6469eba82b7ea0dcf78d6a5f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

comctl32

ord17

kernel32

IsDebuggerPresent
GetLastError
GetProcAddress
GetUserDefaultLCID
LoadLibraryA
FormatMessageA
SearchPathA
VirtualFree
VirtualAlloc
GetModuleFileNameA
LoadLibraryExA
GetFileAttributesA
ExpandEnvironmentStringsA
GetPrivateProfileStringA
HeapSize
GetCommandLineA
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
RtlUnwind

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

LVRTTable

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SMARTSOFTSSI.INI.3.99BE9A60B3B24BD2BFC12AF748DECC2D
SOUND_AND_VIBRATION_ERRORS.TXT.13.99BE9A60B3B24BD2BFC12AF748DECC2D
SOUND_AND_VIBRATION_ERRORS.TXT.14.99BE9A60B3B24BD2BFC12AF748DECC2D
SOUND_AND_VIBRATION_ERRORS.TXT.15.99BE9A60B3B24BD2BFC12AF748DECC2D
SOUND_AND_VIBRATION_ERRORS.TXT.16.99BE9A60B3B24BD2BFC12AF748DECC2D
TEMPERATURE__LINEAR_FIT_.PNG.6.99BE9A60B3B24BD2BFC12AF748DECC2D
.png
TEMPERATURE__QUADRATIC_FIT_.PNG.7.99BE9A60B3B24BD2BFC12AF748DECC2D
.png
WEC_ROTOR.JPG.9.99BE9A60B3B24BD2BFC12AF748DECC2D
.jpg
WELL.JPG.10.99BE9A60B3B24BD2BFC12AF748DECC2D
.jpg
bin/dp/install.msi
.msi
license/SmartSoft SSI License.rtf
.rtf
nidist.id
setup.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Exports

Exports

NI_MetaToolbox_MetaOutput_GetSharedGlobalData

Sections

UPX0
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 210KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
setup.ini
supportfiles/NICustomGraphics.cab
.cab
NIMDFCustomGraphicsTopBar0.bmp
supportfiles/customResource0009.dll
.dll windows:5 windows x86

d0b0ab81bf0e4cd20070f6525db9fd67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
supportfiles/merged.cab
.cab
merged.bin
.msi
supportfiles/niPie.exe
.exe windows:4 windows x86

8fcbb82d712dc622f705d3815ebb3266

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:fd:29:06:e8:2f:87:a0:2b:46:66:7f:3e:38:0d:d0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

09/05/2007, 00:00

Not After

25/05/2010, 23:59

Subject

CN=National Instruments Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fe:2b:ba:9d:b9:42:e4:bd:6a:1a:0a:45:74:ab:c2:a2:a7:1b:95:52
Signer

Actual PE Digest

fe:2b:ba:9d:b9:42:e4:bd:6a:1a:0a:45:74:ab:c2:a2:a7:1b:95:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
WaitForSingleObjectEx
CreateThread
Sleep
lstrlenA
FindFirstFileA
FindNextFileA
FindClose
RemoveDirectoryA
CreateMutexA
ExitProcess
GetCurrentProcess
UnhandledExceptionFilter
FlushFileBuffers
ReadFile
CloseHandle
LoadLibraryA
GetProcAddress
SetStdHandle
HeapReAlloc
VirtualAlloc
GetStringTypeW
GetStringTypeA
SetFilePointer
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
DeleteFileA
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
HeapFree
TerminateProcess
GetLastError
GetFileType
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile

user32

SendMessageA
SetDlgItemTextA
MessageBoxA
EndDialog
LoadStringA
DialogBoxParamA

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA

msi

ord95
ord141
ord93
ord144
ord33
ord8

Exports

Exports

RFL_RegSetBinary
_RFL_RegGetBinary@20

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
supportfiles/nistdtrans0007.mst
supportfiles/nistdtrans0012.mst
supportfiles/nistdtrans0017.mst
supportfiles/nistdtrans0018.mst
supportfiles/nistdtrans2052.mst
supportfiles/nistdtransbase.mst
supportfiles/updateInfo.xml

Sharing

General

Malware Config

Signatures

Files

Password: infected

925d69d4fe9d05657a61fcd3a1e09775

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 1004KB - Virtual size: 1000KB

_TEXT Size: 4KB - Virtual size: 37B

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 20KB - Virtual size: 20KB

_DATA Size: 4KB - Virtual size: 53B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 20KB

552e3251a0fb4057c9aaf7cf23e30566

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 1KB

4bf9d6e6469eba82b7ea0dcf78d6a5f4

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

comctl32

kernel32

version

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 5.7MB - Virtual size: 5.7MB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 3.8MB

UPX1 Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 133KB - Virtual size: 136KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 210KB - Virtual size: 240KB

.rsrc Size: 345KB - Virtual size: 344KB

d0b0ab81bf0e4cd20070f6525db9fd67

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 7KB - Virtual size: 6KB

.text
Size: 1004KB - Virtual size: 1000KB

_TEXT
Size: 4KB - Virtual size: 37B

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 20KB - Virtual size: 20KB

_DATA
Size: 4KB - Virtual size: 53B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 20KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 5.7MB - Virtual size: 5.7MB

UPX0
Size: - Virtual size: 3.8MB

UPX1
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 133KB - Virtual size: 136KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 210KB - Virtual size: 240KB

.rsrc
Size: 345KB - Virtual size: 344KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 8KB - Virtual size: 7KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

20:fd:29:06:e8:2f:87:a0:2b:46:66:7f:3e:38:0d:d0
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

fe:2b:ba:9d:b9:42:e4:bd:6a:1a:0a:45:74:ab:c2:a2:a7:1b:95:52
Signer

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 2KB