LVRTTable
Static task
static1
Behavioral task
behavioral1
Sample
builds/Welder Data R3.1.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
builds/Welder Data R3.1.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
builds/Welder Data R3.11.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
builds/Welder Data R3.11.exe
Resource
win10v2004-20231020-en
General
-
Target
ac9baa2ebc3f8343316fd95dbfcc2e4c2cccbef78bcf44d010377623777bddac
-
Size
9.7MB
-
MD5
c28a60e257d6e1f601e1e24adfd43622
-
SHA1
f767de4bbcce64c64e53bc865a608073ea8ffe03
-
SHA256
ac9baa2ebc3f8343316fd95dbfcc2e4c2cccbef78bcf44d010377623777bddac
-
SHA512
a50ce9eae254e04b5b1f097407ff0157d88bd308b88ab4f540039f77b7a857f086d25eca4d99bc3a6726062816e514856110432f7882a3bf255c3ca935f191b9
-
SSDEEP
196608:uh0D0QrUQOJpg+csEQcyXWDUCiMKIZyzfH7wXxZ1wx16IMcRfPX/bONZV:bD0QrZqgLRQXHJtIszfH7wBzwx16cRvQ
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/builds/Welder Data R3.1.exe unpack001/builds/Welder Data R3.11.exe
Files
-
ac9baa2ebc3f8343316fd95dbfcc2e4c2cccbef78bcf44d010377623777bddac.zip
-
.gitignore
-
Configure file/Setting.ini
-
Configure file/Test Data.ini
-
Control Value/COM Value.ctl
-
Control Value/COM port.ctl
-
Control Value/Device Setting Value.ctl
-
Control Value/Weld Data Upload Value.ctl
-
File Edit/Check Receive Data RS485.vi
-
File Edit/Check Receive Data.vi
-
File Edit/Get Data From String-0.vi
-
File Edit/Get Data From String.vi
-
File Edit/Read-Write Settings.vi
-
File Edit/Save Data to csv RS485.vi
-
File Edit/Save Data to csv-0.vi
-
File Edit/Save Data to csv.vi
-
File Edit/Save Data to txt RS485.vi
-
File Edit/Save Data to txt.vi
-
MQTT/Connect Status.ctl
-
MQTT/Connect status to json string.vi
-
MQTT/Get Data to Send.vi
-
MQTT/MQTT Config.ctl
-
Main v3.1.vi
-
README.md
-
SQL/SQL Settings.ctl
-
SQL/SQLexec.vi
-
SQL/SQLinsert2.vi
-
SQL/Test_SQLinsert.vi
-
SQL/ctrlTypeResults.ctl
-
Serial COM/Save COM Setting.vi
-
Step Control/Step Sequence 1 Out -RS485.vi
-
Step Control/Step Sequence 1 Out.vi
-
Step Control/Step Sequence 2 Out -RS485.vi
-
Step Control/Step Sequence 2 Out.vi
-
Step Control/Step Sequence 3 Out -RS485.vi
-
Step Control/Step Sequence 3 Out.vi
-
User Event/Automatic Start.vi
-
User Event/Creat user event.vi
-
User Event/Start Welder1 Data Event SQL.vi
-
User Event/Start Welder1 Data Event.vi
-
User Event/Start Welder2 Data Event SQL.vi
-
User Event/Start Welder2 Data Event.vi
-
User Event/Start Welder3 Data Event SQL.vi
-
User Event/Start Welder3 Data Event.vi
-
User Event/User Event SQL.ctl
-
User Event/User Event.ctl
-
Welder Data Collection.aliases
-
Welder Data Collection.lvlps
-
Welder Data Collection.lvproj
-
Welder.ico
-
builds/Configure file/Setting.ini
-
builds/Configure file/Test Data.ini
-
builds/Welder Data R3.1.aliases
-
builds/Welder Data R3.1.exe.exe windows:6 windows x86 arch:x86
7aa4c3eb831240e8b5d5e0cfd7258a52
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
comctl32
ord17
kernel32
DecodePointer
GetLastError
GetProcAddress
SearchPathA
VirtualAlloc
VirtualFree
GetModuleFileNameA
LoadLibraryA
FormatMessageA
GetUserDefaultLCID
ExpandEnvironmentStringsA
FreeLibrary
GetFileAttributesA
LoadLibraryExA
GetPrivateProfileStringA
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
MultiByteToWideChar
GetACP
HeapAlloc
HeapFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
LCMapStringW
RaiseException
IsValidCodePage
GetOEMCP
GetCPInfo
GetStringTypeW
ExitProcess
GetModuleHandleExW
GetProcessHeap
WideCharToMultiByte
HeapSize
HeapReAlloc
RtlUnwind
CreateFileW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetStdHandle
WriteFile
CloseHandle
FindClose
FindFirstFileExA
FindNextFileA
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
builds/Welder Data R3.1.ini
-
builds/Welder Data R3.11.exe.exe windows:6 windows x86 arch:x86
7aa4c3eb831240e8b5d5e0cfd7258a52
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
comctl32
ord17
kernel32
DecodePointer
GetLastError
GetProcAddress
SearchPathA
VirtualAlloc
VirtualFree
GetModuleFileNameA
LoadLibraryA
FormatMessageA
GetUserDefaultLCID
ExpandEnvironmentStringsA
FreeLibrary
GetFileAttributesA
LoadLibraryExA
GetPrivateProfileStringA
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
MultiByteToWideChar
GetACP
HeapAlloc
HeapFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
LCMapStringW
RaiseException
IsValidCodePage
GetOEMCP
GetCPInfo
GetStringTypeW
ExitProcess
GetModuleHandleExW
GetProcessHeap
WideCharToMultiByte
HeapSize
HeapReAlloc
RtlUnwind
CreateFileW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetStdHandle
WriteFile
CloseHandle
FindClose
FindFirstFileExA
FindNextFileA
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
LVRTTable
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
builds/data/Setting.ini
-
builds/data/Test Data.ini
-
menu2.rtm