13250d89499f7c2b23a7acaca17b9300

Sharing

Copy URL Twitter E-mail

General

Target

13250d89499f7c2b23a7acaca17b9300
Size

246KB
MD5

13250d89499f7c2b23a7acaca17b9300
SHA1

c329c718ad50e1310dd0b4ff077fdebb379ec842
SHA256

6c0727a24f7f11ef60a4daef973514509a5c06cc7cd97f085fcc33dad3b201a4
SHA512

8e3c55a16ebdfa353c5b1a1b6814f4beb8113a0809ab07043c0980cbd3b3c42a4c3e677fca7e9ac26c3870f926e56992180ebb36785c07ba39152e982ff9afe6
SSDEEP

3072:lQwr83nYYYYoHFYZjYaYOfCiJYY3YYYYYYY70GbJYYYwYZYPuYoYVCYY3bC5YYVI:lQh3IuVCdrjiO622xc6FhyqpHn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13250d89499f7c2b23a7acaca17b9300

Files

13250d89499f7c2b23a7acaca17b9300
.dll windows:5 windows x86 arch:x86

d7bac0199690549076bdeca62b4fcfdc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

usft_ext

?PInsert@CHash@Ext@@IAE?AU?$pair@VCBaseIterator@CList@Ext@@_N@ExtSTL@@PBXP6AXPAX0@Z_N@Z
ord1048
ord1397
ord326
ord325
ord153
ord164
ord385
??6Ext@@YGAAV?$basic_ostream@DU?$char_traits@D@ExtSTL@@@ExtSTL@@AAV12@ABUConstBuf@0@@Z
ord236
ord996
ord1414
ord1540
ord1165
ord949
ord554
ord555
ord567
?Insert@CBinaryTree@Ext@@IAE?AU?$pair@Viterator@CBinaryTree@Ext@@_N@ExtSTL@@PBX@Z
ord1959
ord1960
ord1965
ord1963
ord549
ord232
ord142
ord347
ord413
ord1223
ord674
ord203
ord1490
ord269
ord569
ord20
ord68
ord35
ord689
ord292
ord742
ord276
ord194
ord273
ord148
ord366
ord433
ord248
ord1456
ord1382
ord31
ord1455
ord1384
ord1383
ord224
ord227
ord767
ord1380
ord1391
ord131
ord50
ord24
ord1022
ord265
ord28
ord27
ord26
ord1255
ord1343
ord85
ord135
ord1135
ord380
ord1251
ord1961
ord1964
ord977
ord1330
ord562
ord2008
ord2013
ord2023
ord573
??0String@Ext@@QAE@ABV?$basic_string@DU?$char_traits@D@ExtSTL@@V?$allocator@D@2@@ExtSTL@@@Z
ord1824
ord973
ord279
ord277
?Split@String@Ext@@QBE?AV?$vector@VString@Ext@@V?$allocator@VString@Ext@@@ExtSTL@@@ExtSTL@@ABV12@I@Z
ord421
ord111
ord1658
ord242
ord67
ord1828
ord1063
ord147
?GetPortNames@SerialPort@Ext@@SG?AV?$vector@VString@Ext@@V?$allocator@VString@Ext@@@ExtSTL@@@ExtSTL@@XZ
ord1443
ord1489
ord558
ord539
ord1517
ord1403
ord981
ord1406
ord1506
ord1405
ord1404
ord96
ord1952
ord1951
ord1975
ord1976
ord1943
ord1944
ord1979
ord2015
ord1980
ord1969
ord1978
ord2027
ord2028
ord1970
ord1209
ord1971
ord1967
ord1958
ord1966
ord432
ord1659
ord999
?Join@String@Ext@@SG?AV12@ABV12@ABV?$vector@VString@Ext@@V?$allocator@VString@Ext@@@ExtSTL@@@ExtSTL@@@Z
ord1417
ord1159
ord420
ord542
ord1459
ord160
ord1151
ord1401
ord17
ord171
ord201
ord579
ord254
ord1319
ord700
ord772
ord204
ord1423
ord1631
ord846
ord1488
ord1509
ord1522
ord423
ord1361
ord950
ord1512
ord1520
ord1174
ord1549
ord129
ord253
ord43
ord44
ord3055
ord3070
ord3003
ord499
ord503
ord151
ord1130
ord600
ord3065
ord235
ord843
ord673
ord1543
ord343
ord72
ord640
__CxxFrameHandler3
ord1418
ord841
ord339
ord1129
ord47
ord15
ord312
ord10
ord332
ord101
ord1131
ord98
ord527
ord100
ord1594
ord300
ord263
ord779
ord71
ord97
ord1502
ord1504
ord1501
ord1500
ord1008
ord264
ord116
ord473
ord561
ord416
My_except_handler3
My_except_handler4
My_SEH_prolog
My_SEH_epilog
My_SEH_prolog4
My_SEH_epilog4
My_EH_prolog2
My__ehvec_copy_ctor
_My__CxxSetUnhandledExceptionFilter@0
_My_CxxThrowException@8
ord1607
ord706
ord214
ord717
ord697
ord337
ord477
ord708
ord716
ord721
ord410
ord705
ord773
ord712
ord54
ord175
ord60
ord552
ord222

msvcrt

_EH_prolog
memset
memcpy
fclose
_adjust_fdiv
malloc
_initterm
free
?terminate@@YAXXZ
__lconv_init
_onexit
__dllonexit
??1type_info@@UAE@XZ
_purecall
_isatty
atoi
_get_osfhandle
_write
_read
strtod
setvbuf
fopen
_fileno

oleaut32

VariantClear
VariantInit

ws2_32

ntohl

kernel32

LoadLibraryExA
InterlockedExchange
GetLastError
RaiseException
SetCommTimeouts
GetModuleHandleW
SetEvent
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
FreeLibrary

Exports

Exports

??0BitcoinMiner@Coin@@QAE@XZ
??0BitcoinSha256@Coin@@QAE@ABV01@@Z
??0BitcoinSha256@Coin@@QAE@XZ
??1BitcoinMiner@Coin@@QAE@XZ
??1BitcoinSha256@Coin@@UAE@XZ
??4BitcoinSha256@Coin@@QAEAAV01@ABV01@@Z
??_7BitcoinMiner@Coin@@6B@
??_7BitcoinSha256@Coin@@6B@
?CalcHash@BitcoinMiner@Coin@@QAE?AVBlob@Ext@@ABVBitcoinWorkData@2@@Z
?CallNotifyRequest@BitcoinMiner@Coin@@QAEXAAVWorkerThreadBase@2@ABVString@Ext@@@Z
?CheckLongPolling@BitcoinMiner@Coin@@QAEXAAVWebClient@Ext@@@Z
?CreateObject@BitcoinSha256@Coin@@SA?AV?$ptr@VBitcoinSha256@Coin@@VNonInterlocked@Ext@@@Ext@@XZ
?FindNonce@BitcoinSha256@Coin@@UAE_NAAI@Z
?FullCalc@BitcoinSha256@Coin@@QAE?AVBlob@Ext@@XZ
?GetCalIlCode@BitcoinMiner@Coin@@UAE?AVString@Ext@@_N@Z
?GetCudaCode@BitcoinMiner@Coin@@UAE?AVString@Ext@@XZ
?GetCurrentUrl@BitcoinMiner@Coin@@AAE?AVString@Ext@@XZ
?GetMethodName@BitcoinMiner@Coin@@QAE?AVString@Ext@@_N@Z
?GetOpenclCode@BitcoinMiner@Coin@@UAE?AVString@Ext@@XZ
?GetTestData@BitcoinMiner@Coin@@QAE?AVBitcoinWorkData@2@XZ
?GetWebClient@BitcoinMiner@Coin@@UAE?AVBitcoinWebClient@2@PAVWorkerThreadBase@2@@Z
?GetWork@BitcoinMiner@Coin@@UAE?AVBitcoinWorkData@2@AAPAVWebClient@Ext@@@Z
?GetWorkForThread@BitcoinMiner@Coin@@QAE?AVBitcoinWorkData@2@AAVWorkerThreadBase@2@I_N@Z
?InitDevices@BitcoinMiner@Coin@@QAEXXZ
?OnRoundComplete@BitcoinMiner@Coin@@UAEXXZ
?PrepareData@BitcoinSha256@Coin@@UAEXPBX00@Z
?SetNewData@BitcoinMiner@Coin@@QAEXABVBitcoinWorkData@2@_N@Z
?SetWebInfo@BitcoinMiner@Coin@@QAEXAAVWebClient@Ext@@@Z
?Start@BitcoinMiner@Coin@@QAEXPAVCThreadRef@Ext@@@Z
?Stop@BitcoinMiner@Coin@@QAEXXZ
?SubmitResult@BitcoinMiner@Coin@@UAE_NAAPAVWebClient@Ext@@ABVBitcoinWorkData@2@@Z
?TestAndSubmit@BitcoinMiner@Coin@@QAE_NAAVWorkerThreadBase@2@AAVBitcoinWorkData@2@I@Z
?UseSse2@BitcoinMiner@Coin@@QAE_NXZ

Sections

.text
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7bac0199690549076bdeca62b4fcfdc

Headers

DLL Characteristics

File Characteristics

Imports

usft_ext

msvcrt

oleaut32

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 181KB - Virtual size: 181KB

.rdata Size: 49KB - Virtual size: 48KB

.data Size: 1024B - Virtual size: 19KB

.rsrc Size: 1024B - Virtual size: 800B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 181KB - Virtual size: 181KB

.rdata
Size: 49KB - Virtual size: 48KB

.data
Size: 1024B - Virtual size: 19KB

.rsrc
Size: 1024B - Virtual size: 800B

.reloc
Size: 13KB - Virtual size: 12KB