68d749be5b3d0118e61f6fdd8f6474a7

Sharing

Copy URL Twitter E-mail

General

Target

68d749be5b3d0118e61f6fdd8f6474a7
Size

281KB
MD5

68d749be5b3d0118e61f6fdd8f6474a7
SHA1

14784c472e1736ac4660882d7876092c1785e221
SHA256

26d15a5d82f2897c959625e89d47bd042c0d8db487806c9e2bf83f204cd9d978
SHA512

d47c39cdcc18e875e77a505179ff35819fcbec3eb29dba196d23a9c409d83e28aa825ab3feb7ed652790f7d82f9e7498268ef372fd0281078a3f159c77c63726
SSDEEP

6144:vs09A/xmouE8y9QGan88docM/FcXsoPZAcJ4ujNOZM1:009A/xmouE8y9QpOf/FccoPZd4it

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68d749be5b3d0118e61f6fdd8f6474a7

Files

68d749be5b3d0118e61f6fdd8f6474a7
.exe windows:4 windows x86 arch:x86

2d72bbdeb652c428c0ae8cfbc44fe16d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt40

_exit
_XcptFilter
__p___initenv
_initterm
__getmainargs
__setusermatherr
_chmod
_putenv
strstr
_except_handler3
__dllonexit
_onexit
_controlfp
fgets
calloc
?basefield@ios@@2JB
??5istream@@QAEAAV0@AAN@Z
?put@ostream@@QAEAAV1@E@Z
__p__environ
_adjust_fdiv
realloc
_isctype
strtoul
srand
malloc
?rdbuf@ostrstream@@QBEPAVstrstreambuf@@XZ
rand
_stat
_findfirst
fwrite
strncat
_ftol
_findnext
_findclose
strpbrk
??0ostrstream@@QAE@PADHH@Z
strrchr
__p__commode
??0istrstream@@QAE@PAD@Z
setlocale
?peek@istream@@QAEHXZ
strtod
??1istrstream@@UAE@XZ
__p__fmode
__set_app_type
_purecall
remove
_mkdir
sprintf
strtok
?close@ofstream@@QAEXXZ
_fdopen
_locking
??0ifstream@@QAE@PBDHH@Z
??5istream@@QAEAAV0@PAD@Z
?close@ifstream@@QAEXXZ
exit
??1ifstream@@UAE@XZ
_setjmp3
?openprot@filebuf@@2HB
??0ofstream@@QAE@PBDHH@Z
??1ofstream@@UAE@XZ
strncmp
mktime
localtime
_mtlock
?get@istream@@IAEAAV1@PADHH@Z
_mtunlock
??0ostrstream@@QAE@XZ
??6ostream@@QAEAAV0@E@Z
??6ostream@@QAEAAV0@H@Z
??6ostream@@QAEAAV0@PBD@Z
??6ostream@@QAEAAV0@J@Z
?ends@@YAAAVostream@@AAV1@@Z
?str@strstreambuf@@QAEPADXZ
__p___mb_cur_max
??1ostrstream@@UAE@XZ
??1ios@@UAE@XZ
??2@YAPAXI@Z
strchr
strtol
strncpy
??3@YAXPAX@Z
atoi
time
__p__pctype
??6ostream@@QAEAAV0@G@Z
?get@istream@@QAEHXZ
??6ostream@@QAEAAV0@F@Z
getenv
??6ostream@@QAEAAV0@N@Z
??6ostream@@QAEAAV0@K@Z
fopen
mblen
ctime
free
fprintf
fclose
??5istream@@QAEAAV0@AAH@Z
ftell
wcslen
_wcsdup
fflush
_chsize
_close
fseek
_getpid
_open
_lseek
_write
_read
_chdir
_strdup
_rmdir
_unlink
_utime
_fileno

kernel32

CloseHandle
GetStdHandle
DuplicateHandle
HeapFree
GetProcessHeap
GetEnvironmentStrings
MultiByteToWideChar
GetVersion
GetProcAddress
GetCurrentProcess
LoadLibraryA
SetStdHandle
CreateThread
CreatePipe
ResumeThread
GetExitCodeThread
TerminateProcess
WriteFile
OpenFile
TerminateThread
lstrcmpA
lstrcpyA
ReadFile
HeapAlloc
lstrcatA
WaitForSingleObject
GetExitCodeProcess
FreeEnvironmentStringsA
lstrlenA
GetUserDefaultLCID
GetLocaleInfoA
FindFirstFileA
FindNextFileA
GetLastError
FindClose
Sleep

advapi32

LsaNtStatusToWinError
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
AllocateAndInitializeSid
LookupAccountNameW
AllocateLocallyUniqueId
LsaClose
LsaFreeMemory
GetLengthSid
IsValidSid
LsaRetrievePrivateData
LsaOpenPolicy
LookupPrivilegeNameA
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
LsaQueryInformationPolicy
CreateProcessAsUserA
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation

libcpl

cpl_gettimeofday

wsock32

ioctlsocket
gethostbyname
gethostname
inet_addr

libmrt

_any_case_default
_tmf_boolean_true
_tmf_boolean_false
adr_v_any
TC_Object
eh_throw
t_generic_stub
tmf_msg_bind
tmf_msg_destroy
tmf_msg_new
mrt_get_dispatcher
tiv_spawn
mrt_get_region
mrt_get_config_filespec
mrt_set_upcall_timeout
mrt_get_upcall_timeout
mrt_machine_id
net_send
adr_v_short
generic_create
adr_v_boolean
adr_start_struct
adr_v_long
adr_v_tc_sequence
adr_v_string
adr_v_TMF_Types_XOpenMessage
adr_end_struct
stypes_type_repository
TC_boolean
_any_bound_zero
TC__sequence_any_MsgContext
TC_TMF_Types_XOpenMessage
TC_long
TC_TMF_Types__sequence_octet_OctetList
TC_ulong
TC_null
adr_v_dummy
adr_v_unsigned_long
adr_v_Object
mg_calloc
does_file_exist
TC_void
rename_file_ex
tmf_encode
TC_TypeCode
encrypt_data
write_ex
open_ex
get_file_length_ex
read_ex
close_ex
get_hmac_md5
vaThrow
decrypt_data
tmf_decode
seq_free_buffer
seq_add
LogInit
LogSetDefault
LogQueueAlloc
type_repository_null
tc_deep_copy
net_recv
TC_string
net_close
eh_rethrow
seq_remove
mrt_get_work_dir
net_wait_for_connection
eh_catch
eh_current
net_set_timeout
eh_current_exception
mg_free
TC_ExErrorMsg
tmf_free_generic
safe_free
get_local_ip_interface
make_sock_addr
eh_push_try
net_create_remote_server
eh_catch_all
eh_again
eh_pop_try
netaddr_ntoa
mg_realloc
vaAddMsg
mg_strdup
LogMsg
TC_any
TC_char
TC_double
TC_float
TC_octet
TC_short
TC_ushort
TC_TMF_Types__sequence_string_StringList
_t_generic_copy
def_ex_bind
mg_malloc

ntdll

NtClose
RtlInitUnicodeString
ZwRequestWaitReplyPort
NtWaitForSingleObject
NtOpenEvent
ZwConnectPort
ZwFreeVirtualMemory
atol
_stricmp
_strnicmp

Exports

Exports

TC_LcfSysAdminException_ExInvalid
TC_LcfSysAdminException_ExNotFound
TC_LcfSysAdminException_ExStdlib
TC_LcfSysAdminException_ExSystem
TC_TMF_Task_ArgLayout
TC_TMF_Task_ArgLayoutType
TC_TMF_Task_ChoiceSource
TC_TMF_Task_ChoiceSourceType
TC_TMF_Task_ExTaskNoInterp
TC_TMF_Task_ExplicitChoice
TC_TMF_Task_ImplType
TC_TMF_Task_MultiSep
TC_TMF_Task_Task
TC_TMF_Task_TaskArg
TC_TMF_Task_TaskAttr
TC_TMF_Task_TaskCode
TC_TMF_Task_TaskEndpoint
TC_TMF_Task_TaskEndpoint_TaskCode
TC_TMF_Task_TaskEndpoint__sequence_binaries_t_binaries_list_t
TC_TMF_Task_TaskEndpoint_binaries_t
TC_TMF_Task_TaskEndpoint_code_type
TC_TMF_Task_TaskEndpoint_output_t
TC_TMF_Task_TaskExtra
TC_TMF_Task_TaskImpl
TC_TMF_Task_TaskImplPlus
TC_TMF_Task_TaskLib
TC_TMF_Task__sequence_ArgLayout_ArgLayoutList
TC_TMF_Task__sequence_ExplicitChoice_ExplicitChoiceList
TC_TMF_Task__sequence_TaskArg_TaskArgList
TC_TMF_Task__sequence_TaskAttr_TaskAttrList
TC_TMF_Task__sequence_TaskExtra_TaskExtraList
TC_TMF_Task__sequence_TaskImpl_TaskImplList
TC_TMF_Task__sequence_Task_TaskList
TC_TMF_Task__sequence_task_output_t_task_output_list_t
TC_TMF_Task__sequence_task_t_task_t_list_t
TC_TMF_Task_job_t
TC_TMF_Task_task_library_t
TC_TMF_Task_task_output_t
TC_TMF_Task_task_t
task_type_repository

Sections

.text
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2d72bbdeb652c428c0ae8cfbc44fe16d

Headers

File Characteristics

Imports

msvcrt40

kernel32

advapi32

libcpl

wsock32

libmrt

ntdll

Exports

Exports

Sections

.text Size: 157KB - Virtual size: 157KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 67KB - Virtual size: 72KB

.idata Size: 7KB - Virtual size: 7KB

.reloc Size: 43KB - Virtual size: 43KB

.text
Size: 157KB - Virtual size: 157KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 67KB - Virtual size: 72KB

.idata
Size: 7KB - Virtual size: 7KB

.reloc
Size: 43KB - Virtual size: 43KB