329da9f4fb4e6e9074ba9b8f43286802

Sharing

Copy URL Twitter E-mail

General

Target

329da9f4fb4e6e9074ba9b8f43286802
Size

208KB
MD5

329da9f4fb4e6e9074ba9b8f43286802
SHA1

0539259eef0c03408c86a2ed7c69d7301319459c
SHA256

6c0e6e7484f4a1e3185d376acc46adc6bc79151d4112ea6a7de29d6dd22bd87d
SHA512

2da22db74a3862b57d8664af316dbe31f96d8f97c40d9073c38ea2b06be97c8c4a76b3fc12dbc661eb9aa79e36ef705ede209779f1866f1beac5a995178efb98
SSDEEP

3072:SxL5+/2oiccZJYrz56wi/ROevmZgKb1VYBjSZDV9JaCjqk9Rxyj0LI1BQuESdvZx:aUMZC6wiUWKb1VsO9JaCjqEydFBh4ry

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
329da9f4fb4e6e9074ba9b8f43286802

Files

329da9f4fb4e6e9074ba9b8f43286802
.dll windows:4 windows x86 arch:x86

b626acaeda8473079aa81922ebd01662

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

xerces-c_2_2_0

?resolveEntity@DefaultHandler@xercesc_2_2@@UAEPAVInputSource@2@QBG0@Z
??1DefaultHandler@xercesc_2_2@@UAE@XZ
??0DefaultHandler@xercesc_2_2@@QAE@XZ
?notationDecl@DefaultHandler@xercesc_2_2@@UAEXQBG00@Z
?release@XMLString@xercesc_2_2@@SAXPAPAD@Z
?replicate@XMLString@xercesc_2_2@@SAPADQBD@Z
?unparsedEntityDecl@DefaultHandler@xercesc_2_2@@UAEXQBG000@Z
?resetDocType@DefaultHandler@xercesc_2_2@@UAEXXZ
?endDocument@DefaultHandler@xercesc_2_2@@UAEXXZ
?processingInstruction@DefaultHandler@xercesc_2_2@@UAEXQBG0@Z
?setDocumentLocator@DefaultHandler@xercesc_2_2@@UAEXQBVLocator@2@@Z
?startDocument@DefaultHandler@xercesc_2_2@@UAEXXZ
?skippedEntity@DefaultHandler@xercesc_2_2@@UAEXQBG@Z
?resetErrors@DefaultHandler@xercesc_2_2@@UAEXXZ
?comment@DefaultHandler@xercesc_2_2@@UAEXQBGI@Z
?endCDATA@DefaultHandler@xercesc_2_2@@UAEXXZ
?endDTD@DefaultHandler@xercesc_2_2@@UAEXXZ
?endEntity@DefaultHandler@xercesc_2_2@@UAEXQBG@Z
?startCDATA@DefaultHandler@xercesc_2_2@@UAEXXZ
?startDTD@DefaultHandler@xercesc_2_2@@UAEXQBG00@Z
?startEntity@DefaultHandler@xercesc_2_2@@UAEXQBG@Z
?elementDecl@DefaultHandler@xercesc_2_2@@UAEXQBG0@Z
?attributeDecl@DefaultHandler@xercesc_2_2@@UAEXQBG0000@Z
?internalEntityDecl@DefaultHandler@xercesc_2_2@@UAEXQBG0@Z
?externalEntityDecl@DefaultHandler@xercesc_2_2@@UAEXQBG00@Z
??0BinInputStream@xercesc_2_2@@IAE@XZ
??1BinInputStream@xercesc_2_2@@UAE@XZ
??0XMLPScanToken@xercesc_2_2@@QAE@XZ
?createXMLReader@XMLReaderFactory@xercesc_2_2@@SAPAVSAX2XMLReader@2@XZ
??1XMLPScanToken@xercesc_2_2@@QAE@XZ
??0InputSource@xercesc_2_2@@IAE@XZ
??1InputSource@xercesc_2_2@@UAE@XZ
?getEncoding@InputSource@xercesc_2_2@@UBEPBGXZ
?getPublicId@InputSource@xercesc_2_2@@UBEPBGXZ
?getSystemId@InputSource@xercesc_2_2@@UBEPBGXZ
?getIssueFatalErrorIfNotFound@InputSource@xercesc_2_2@@UBE?B_NXZ
?setEncoding@InputSource@xercesc_2_2@@UAEXQBG@Z
?setPublicId@InputSource@xercesc_2_2@@UAEXQBG@Z
?setSystemId@InputSource@xercesc_2_2@@UAEXQBG@Z
?setIssueFatalErrorIfNotFound@InputSource@xercesc_2_2@@UAEX_N@Z
?fgXercescDefaultLocale@XMLUni@xercesc_2_2@@2QBDB
?Terminate@XMLPlatformUtils@xercesc_2_2@@SAXXZ
?transcode@XMLString@xercesc_2_2@@SAPADQBG@Z
?Initialize@XMLPlatformUtils@xercesc_2_2@@SAXQBD@Z

msvcp70

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?_Nomemory@std@@YAXXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

msvcr70

??4exception@@QAEAAV0@ABV0@@Z
strlen
strcpy
__CxxFrameHandler
strcat
??0exception@@QAE@XZ
_purecall
??_V@YAXPAX@Z
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
malloc
_callnewh
?terminate@@YAXXZ
??1type_info@@UAE@XZ
free
_initterm
_adjust_fdiv
_except_handler3
??1exception@@UAE@XZ
_onexit
__dllonexit

kernel32

DisableThreadLibraryCalls

Exports

Exports

??0AxisException@axiscpp@@QAE@ABV01@@Z
??0AxisException@axiscpp@@QAE@HPBD@Z
??0AxisException@axiscpp@@QAE@XZ
??0AxisParseException@@QAE@ABV0@@Z
??0AxisParseException@@QAE@HPBD@Z
??0AxisTrace@axiscpp@@QAE@ABV01@@Z
??0AxisTrace@axiscpp@@QAE@XZ
??0ISoapAttachment@axiscpp@@QAE@ABV01@@Z
??0ISoapAttachment@axiscpp@@QAE@XZ
??1AxisException@axiscpp@@UAE@XZ
??1AxisParseException@@UAE@XZ
??1AxisTrace@axiscpp@@UAE@XZ
??1ISoapAttachment@axiscpp@@UAE@XZ
??4AnyType@axiscpp@@QAEAAV01@ABV01@@Z
??4AxisException@axiscpp@@QAEAAV01@ABV01@@Z
??4AxisParseException@@QAEAAV0@ABV0@@Z
??4AxisTrace@axiscpp@@QAEAAV01@ABV01@@Z
??4AxisTraceEntrypoints@axiscpp@@QAEAAV01@ABV01@@Z
??4Axis_Array@axiscpp@@QAEAAV01@ABV01@@Z
??4ISoapAttachment@axiscpp@@QAEAAV01@ABV01@@Z
??_7AxisException@axiscpp@@6B@
??_7AxisParseException@@6B@
??_7AxisTrace@axiscpp@@6B@
??_7ISoapAttachment@axiscpp@@6B@
?getExceptionCode@AxisException@axiscpp@@UBE?BHXZ
?getMessage@AxisException@axiscpp@@QBEPBDXZ
?getMessageForExceptionCode@AxisParseException@@AAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?getTraceEntrypoints@AxisTrace@axiscpp@@SAPAVAxisTraceEntrypoints@2@XZ
?isTraceOn@AxisTrace@axiscpp@@SA_NXZ
?resetException@AxisException@axiscpp@@QAEXXZ
?setExceptionCode@AxisException@axiscpp@@QAEXH@Z
?setExceptionFromException@AxisException@axiscpp@@QAEXABV12@@Z
?setMessage@AxisException@axiscpp@@QAEXPBD@Z
?setTraceEntrypoints@AxisTrace@axiscpp@@SAXPAVAxisTraceEntrypoints@2@@Z
?traceCatch@AxisTrace@axiscpp@@SAXPBD0PBXHHIPAX@Z
?traceEntry@AxisTrace@axiscpp@@SAXPBD0PBXHZZ
?traceExit@AxisTrace@axiscpp@@SAXPBD0PBXHHIPAX@Z
?traceLine@AxisTrace@axiscpp@@SAXPBD@Z
?what@AxisException@axiscpp@@UBEPBDXZ
CreateInstance
DestroyInstance
initializeLibrary
uninitializeLibrary

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b626acaeda8473079aa81922ebd01662

Headers

File Characteristics

Imports

xerces-c_2_2_0

msvcp70

msvcr70

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 4KB - Virtual size: 1KB

.text Size: 148KB - Virtual size: 148KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 148KB - Virtual size: 148KB