0f3236a602b807c3ea2648870c35457f

Sharing

Copy URL

Twitter E-mail

General

Target

0f3236a602b807c3ea2648870c35457f
Size

536KB
MD5

0f3236a602b807c3ea2648870c35457f
SHA1

8b009aedd43eb45bf5b8135e85560ed77e51c0b0
SHA256

e4b1ba4e774531c718d99997dc0d81ff0dc6ec57f76dbaabbaba5075819016ff
SHA512

7498d1fac5d1dc3e10111fe2852838c8eda557356a7c4022bfdb422051d452f746349beca398fbdb92e25331f55374f2eba4ec7e9a13c79ac71dc0a850ac8d7f
SSDEEP

12288:yf3cenyRD2LwkMIfrjADcYD9mmha48sSwa0eS/MUxGZvM1WZcI5bfCi9N:KcEyCMIjjADZs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f3236a602b807c3ea2648870c35457f

Files

0f3236a602b807c3ea2648870c35457f
.dll windows:4 windows x86 arch:x86

96b136fe7012565bb8f82f474ff206ba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

bc32fn

TABSet
szTmpBuf
SetPrintPageParms3
FindDB5
FormatNumber
TABWriteLineExt
ZOPERATORE
ZENDFIL
GetDB5
ComposeFileName
PHD
GR
SetCondition
ZDB_VALRECORD
ANNOEXT
AddSl
PHB
GetSysTime2
TABJumpRowsExt
TABCloseSettings
DelDB4
ZBCERR
FormatDouble
InsDBStruct5
FindDBStruct5
ZNOKEY
ExtractFileFromZip3
WriteDBStruct6
PHT
WS
WriteDB5
SetString
InvertDate
BCRound
SearchString
CopyDBStruct4
GetDBStruct5
TABClosePrinting
AllocLocalData
CheckProto2
BcDll
RADDR
RPED
RFLV
RPEE
TABOffset
pvTerminateProgram
VARLIST
pFrmtBuffer
FreeLocalData
DBDatabase
DBClose
DBXAccess
BcxExit
BCXGetDirList2
ZNDIR
SkipLRBlk
SkipRightBlk
CheckDirectory2
StrAdd
Kill
GetDirFileInfo2
AddFileToZip
pszSUBProto
CallDllFunction2
PROGC
ZPREXTEND
bPrintFileName
bGetActualArgsExv
ZEXVARG
PropertiesEx
ZTRADVER
ZMINVER
ZMINVERUX
pszCurrentModule
PRINTINFO

bc32ui

PutXMLStruct2
GetXMLStruct3
FindDynamicStruct
GetDblTestDynValue
InsDynamicStruct
ZDSELEM_TOT
FreeBlob
SYSDATEXT
DefinePrintJob3
WgsSetEnabledKeys
WgsSetDefinedKeys
WgsSetUncheckedKeys
WgsMessageBoxEx
DefinePos4
DBCreateVars2
DBDefineStructs
EntryInitProgramData
RCSRCH
SearchSTR
ExitInitProgramData
EntryTerminateProgram
DBRemoveVars
RCCHAN
WgsInitData
RI
RO
RIF
KYM
RRA
RTAB
cRowsRI
cColsRI
wKeyFlags
pszDecodMessage
ExitTerminateProgram
AddDynamicStruct
CountDynamicStruct
GetDynamicStruct2
DefineDynamicStruct5
ZDIR_FFILE
KillDynamicStruct
TraceDebug2
ZapDynamicStruct

kernel32

GetVersion
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
RtlUnwind
GetCommandLineA

Exports

Exports

D5_S_TRAN_USP
D5_S_TRAN_USP_ANN
D5_S_TRAN_USP_ANN_USP
D5_S_TRAN_USP_ESP
D5_S_TRAN_USP_ESP_D5ANA
D5_S_TRAN_USP_ESP_D5CRB
D5_S_TRAN_USP_ESP_D5DDR
D5_S_TRAN_USP_ESP_D5ESO
D5_S_TRAN_USP_ESP_D5LAR
D5_S_TRAN_USP_ESP_D5MD
D5_S_TRAN_USP_ESP_D5MSO
D5_S_TRAN_USP_ESP_D5NSO
D5_S_TRAN_USP_ESP_D5PRE
D5_S_TRAN_USP_ESP_D5PSO
D5_S_TRAN_USP_ESP_D5QRD
D5_S_TRAN_USP_ESP_D5QRE
D5_S_TRAN_USP_ESP_D5QRF
D5_S_TRAN_USP_ESP_D5QRG
D5_S_TRAN_USP_ESP_D5QRH
D5_S_TRAN_USP_ESP_D5QRK
D5_S_TRAN_USP_ESP_D5QRKT
D5_S_TRAN_USP_ESP_D5QRL
D5_S_TRAN_USP_ESP_D5QRM
D5_S_TRAN_USP_ESP_D5QRN
D5_S_TRAN_USP_ESP_D5RIENE
D5_S_TRAN_USP_ESP_D5RISE
D5_S_TRAN_USP_ESP_D5RMTS
D5_S_TRAN_USP_ESP_D5RPR
D5_S_TRAN_USP_ESP_D5SIQ
D5_S_TRAN_USP_ESP_D5SOS
D5_S_TRAN_USP_ESP_D5SPR
D5_S_TRAN_USP_ESP_D5TOR
D5_S_TRAN_USP_ESP_D5TOT
D5_S_TRAN_USP_ESP_D5TRH
D5_S_TRAN_USP_ESP_D5UDI
D5_S_TRAN_USP_ESP_D5USO
D5_S_TRAN_USP_ESP_D5UTI
D5_S_TRAN_USP_IMP
DFL5TRAN
vb_D5_S_TRAN_USP
vb_D5_S_TRAN_USP_ANN
vb_D5_S_TRAN_USP_ANN_USP
vb_D5_S_TRAN_USP_ESP
vb_D5_S_TRAN_USP_ESP_D5ANA
vb_D5_S_TRAN_USP_ESP_D5CRB
vb_D5_S_TRAN_USP_ESP_D5DDR
vb_D5_S_TRAN_USP_ESP_D5ESO
vb_D5_S_TRAN_USP_ESP_D5LAR
vb_D5_S_TRAN_USP_ESP_D5MD
vb_D5_S_TRAN_USP_ESP_D5MSO
vb_D5_S_TRAN_USP_ESP_D5NSO
vb_D5_S_TRAN_USP_ESP_D5PRE
vb_D5_S_TRAN_USP_ESP_D5PSO
vb_D5_S_TRAN_USP_ESP_D5QRD
vb_D5_S_TRAN_USP_ESP_D5QRE
vb_D5_S_TRAN_USP_ESP_D5QRF
vb_D5_S_TRAN_USP_ESP_D5QRG
vb_D5_S_TRAN_USP_ESP_D5QRH
vb_D5_S_TRAN_USP_ESP_D5QRK
vb_D5_S_TRAN_USP_ESP_D5QRKT
vb_D5_S_TRAN_USP_ESP_D5QRL
vb_D5_S_TRAN_USP_ESP_D5QRM
vb_D5_S_TRAN_USP_ESP_D5QRN
vb_D5_S_TRAN_USP_ESP_D5RIENE
vb_D5_S_TRAN_USP_ESP_D5RISE
vb_D5_S_TRAN_USP_ESP_D5RMTS
vb_D5_S_TRAN_USP_ESP_D5RPR
vb_D5_S_TRAN_USP_ESP_D5SIQ
vb_D5_S_TRAN_USP_ESP_D5SOS
vb_D5_S_TRAN_USP_ESP_D5SPR
vb_D5_S_TRAN_USP_ESP_D5TOR
vb_D5_S_TRAN_USP_ESP_D5TOT
vb_D5_S_TRAN_USP_ESP_D5TRH
vb_D5_S_TRAN_USP_ESP_D5UDI
vb_D5_S_TRAN_USP_ESP_D5USO
vb_D5_S_TRAN_USP_ESP_D5UTI
vb_D5_S_TRAN_USP_IMP

Sections

.text
Size: 236KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96b136fe7012565bb8f82f474ff206ba

Headers

File Characteristics

Imports

bc32fn

bc32ui

kernel32

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 232KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 228KB - Virtual size: 228KB

.rsrc Size: 4KB - Virtual size: 928B

.reloc Size: 56KB - Virtual size: 52KB

.text
Size: 236KB - Virtual size: 232KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 228KB - Virtual size: 228KB

.rsrc
Size: 4KB - Virtual size: 928B

.reloc
Size: 56KB - Virtual size: 52KB