11180686a046a9345cd61bf371bc8f32

Sharing

Copy URL Twitter E-mail

General

Target

11180686a046a9345cd61bf371bc8f32
Size

108KB
MD5

11180686a046a9345cd61bf371bc8f32
SHA1

0ee99a90ba3d65ac689d53aca64b9ff410fb9100
SHA256

e77c669245d3443c793679cb189a7cf2f728c839d5a7ada3c59c08124dcd9918
SHA512

8ae51a265982a18ba2b9bf1d4ce196d8f40f36cbd6f438649303190f9eb65f8710765e952b1cbcd76ac83e4db104fce4c501ec8a99c93a824eabe54974d8f7ab
SSDEEP

1536:jVV+/I3wV7HUqTiDNI2FSGFDdxJAB8Lg8oCOrGiiNVG:5V+MG7Hm5wGFvJy8oCOrsNVG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11180686a046a9345cd61bf371bc8f32

Files

11180686a046a9345cd61bf371bc8f32
.dll windows:4 windows x86 arch:x86

4661460e08d8101af15fc9820513d6bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gtools

?stop@GThread@@QAE_NXZ
?fileInfo@GLog@@QAEPAV1@PADH@Z
?getLog@GLog@@SAPAV1@XZ
?logWarning@GLog@@QAAXV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@ZZ
?unlock@GLock@@QAEXXZ
?lock@GLock@@QAE_NXZ
?buildString@@YA?AV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@V12@ZZ
??1GLock@@QAE@XZ
??0GLock@@QAE@XZ
??1GEvent@@QAE@XZ
??0GEvent@@QAE@XZ
?wait@GEvent@@QAE_NJ@Z
?reset@GEvent@@QAEXXZ
?set@GEvent@@QAEXXZ
?deallocate@GMemoryHandler@@SAXPAX@Z
?allocate@GMemoryHandler@@SAPAXI@Z
??0GLock@@QAE@ABV0@@Z
??4GLock@@QAEAAV0@ABV0@@Z
??0GEvent@@QAE@ABV0@@Z
??4GEvent@@QAEAAV0@ABV0@@Z
??0GEvent@@QAE@ABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
?start@GThread@@QAE_NXZ
??0GThread@@QAE@PBDP6AJPAX@Z1W4enumComSupport@0@@Z
?logInfo@GLog@@QAAXV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@ZZ
?getThreadHandle@GThread@@QBEPAXXZ
??1GThread@@QAE@XZ
??1CSharedMemory@@UAE@XZ
?isThreadActive@GThread@@QAE_NJ@Z
?Close@CSharedMemory@@QAEXXZ
?Read@CSharedMemory@@QAEHPAXKPAK@Z
?Open@CSharedMemory@@QAE_NPBDHH@Z
?heartbeat@GThread@@QAEXK@Z
??0CSharedMemory@@QAE@XZ
?logError@GLog@@QAAXV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@ZZ
??1GXMLParser@@UAE@XZ
?getInnerSource@GXMLTree@@QAE?AV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@XZ
?getBranch@GXMLParser@@QAEPAVGXMLTree@@ABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@0@Z
?WriteToQueue@CSharedMemory@@QAEHPAXH@Z
?getValue@GXMLParser@@QAE?AV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@ABV23@@Z
?initSource@GXMLParser@@UAEXABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
??0GXMLParser@@QAE@XZ
?getValue@GXMLTree@@QAE?AV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@ABV23@HPA_N@Z

kernel32

GetCurrentThreadId
WaitForSingleObject
DisableThreadLibraryCalls
GetModuleHandleA
RtlUnwind
RaiseException
IsBadReadPtr
GetCommandLineA
GetVersion
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
WriteFile
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapFree
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
LoadLibraryA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringW
IsBadWritePtr
IsBadCodePtr
VirtualAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LCMapStringA
InterlockedDecrement
InterlockedIncrement
GetCurrentProcessId

Exports

Exports

??0GIoclBus@@AAE@XZ
??0GIoclBus@@QAE@ABV0@@Z
??0GIoclHook@@AAE@XZ
??0GIoclHook@@QAE@ABV0@@Z
??1GIoclBus@@AAE@XZ
??1GIoclHook@@UAE@XZ
??4GIoclBus@@QAEAAV0@ABV0@@Z
??4GIoclHook@@QAEAAV0@ABV0@@Z
??_7GIoclHook@@6B@
?forwardMsg@GIoclHook@@UAE_NAAVGIoclMsg@@@Z
?forwardMsg@GIoclHook@@UAE_NAAVGIoclMsg@@ABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
?forwardMsg@GIoclHook@@UAE_NAAVGIoclMsg@@J@Z
?getHookID@GIoclHook@@UAEJXZ
?getMsg@GIoclHook@@UAE_NAAVGIoclMsg@@J@Z
?getObjName@GIoclHook@@UBEABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@XZ
?getReference@GIoclBus@@SAPAV1@XZ
?isSubscribed@GIoclHook@@UAE_NJ@Z
?lock@GIoclHook@@AAE_NXZ
?peekMsg@GIoclHook@@UAE_NAAVGIoclMsg@@J@Z
?purgeMsgs@GIoclHook@@UAEXXZ
?putMsg@GIoclHook@@AAE_NABVGIoclMsg@@@Z
?reg@GIoclBus@@QAEPBVGIoclHook@@ABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
?reg@GIoclBus@@QAEPBVGIoclHook@@XZ
?respMsg@GIoclBus@@QAE_NABVGIoclMsg@@V?$vector@JV?$GAllocator@J@@@std@@@Z
?sendMsg@GIoclBus@@QAE_NABVGIoclMsg@@@Z
?sendMsg@GIoclBus@@QAE_NABVGIoclMsg@@ABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
?sendMsg@GIoclBus@@QAE_NABVGIoclMsg@@J@Z
?sendMsg@GIoclHook@@UAE_NAAVGIoclMsg@@@Z
?sendMsg@GIoclHook@@UAE_NAAVGIoclMsg@@ABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
?sendMsg@GIoclHook@@UAE_NAAVGIoclMsg@@J@Z
?setClientEvent@GIoclHook@@UAEXPAVGEvent@@@Z
?setHookID@GIoclHook@@AAEXJ@Z
?setObjName@GIoclHook@@AAEXABV?$basic_string@DU?$Gchar_traits@D@@V?$GAllocator@D@@@std@@@Z
?shutdown@GIoclBus@@QAE_NXZ
?subscribe@GIoclHook@@UAEXJ@Z
?unlock@GIoclHook@@AAEXXZ
?unreg@GIoclBus@@QAEXJ@Z
?unreg@GIoclBus@@QAEXPAVGIoclHook@@@Z
?unsubscribe@GIoclHook@@UAEXJ@Z
deleteHook
getHookClass
isIoclInProcess

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4661460e08d8101af15fc9820513d6bc

Headers

File Characteristics

Imports

gtools

kernel32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 60KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 16KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 872B

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 64KB - Virtual size: 60KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 872B

.reloc
Size: 8KB - Virtual size: 5KB