0282625667f6d106bbdf78e08fa03952

Sharing

Copy URL

Twitter E-mail

General

Target

0282625667f6d106bbdf78e08fa03952
Size

485KB
MD5

0282625667f6d106bbdf78e08fa03952
SHA1

b005a04980874bb9e21910899b307198be02ec37
SHA256

e3499add127233eee8b25bc986580086ee9a87e8b59bab8b58582d8bcf3b8d7b
SHA512

45ce96c656dd91d553fba9f525d6865bea08f859fe53512813c562c4ba3f9dc462c994248feef6a4047d549674885fd691c400fe0bca8e56e037a37d87718a48
SSDEEP

6144:cHv1bboDPI9y+IjJTSpI9Xxd0y7qrqc39oS+z2HLu/HBweUEssb0614AdqwS:Kv1bIPcyrjdSpRr3CyHKweUE/06

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0282625667f6d106bbdf78e08fa03952

Files

0282625667f6d106bbdf78e08fa03952
.dll windows:1 windows x86 arch:x86

ca447064eb7596787a53e0b3f5fd929f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
GetFileSize
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStringTypeA
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalReAlloc
LoadLibraryA
MultiByteToWideChar
OutputDebugStringA
ReadFile
SetEndOfFile
SetErrorMode
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
WriteFile

ole32

CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID

oleaut32

GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy

user32

CharLowerBuffA
CharNextA
CharUpperBuffA
MessageBoxA

\drake09\ft\layout

LAYOUT
SCRNEXIST
CSZ
OVRSTR
OVRNUM

\drake09\ft\daycount

JULIANDATE

\drake09\ft\fileio

SETSTATEREFERENCE

\drake09\ft\statek1

GETAK1PSCREEN
GETAK1SSCREEN
GETAK1FSCREEN

\drake09\ft\fdst

FDSTCALC

\drake09\ft\miscitem

FDST_SGR
FDST_DIS
FDST_MILITARY
FDST_NATIONALGUARD
FDST_RRTIER1
FDST_RRTIER2
FDST_RRTIER1_TAXABLE
FDST_OTHERSEINC
FDST_USINTDIV

\drake09\ft\msrra

MSRRACALC

Exports

Exports

MOI2A
READ1099G
READ1099M
READ1099R
READ2119
READ4684
READ4797
READ4835
READ6252
READ8611
READ8824
READFD4562
READFD4562PT1
READFD4562PT3
READINC
READPIN
READRRB
READSCHC
READSCHD
READSCHE
READSCHE2
READSCHF
READSSA
READTRAC
READW2
READW2G

Sections

.text
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.link
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca447064eb7596787a53e0b3f5fd929f

Headers

File Characteristics

Imports

kernel32

ole32

oleaut32

user32

\drake09\ft\layout

\drake09\ft\daycount

\drake09\ft\fileio

\drake09\ft\statek1

\drake09\ft\fdst

\drake09\ft\miscitem

\drake09\ft\msrra

Exports

Exports

Sections

.text Size: 455KB - Virtual size: 455KB

.data Size: 12KB - Virtual size: 26KB

.link Size: 3KB - Virtual size: 2KB

.rloc Size: 13KB - Virtual size: 13KB

.text
Size: 455KB - Virtual size: 455KB

.data
Size: 12KB - Virtual size: 26KB

.link
Size: 3KB - Virtual size: 2KB

.rloc
Size: 13KB - Virtual size: 13KB