172a4b22bc74457d73c78db5a0a77faf

Sharing

Copy URL

Twitter E-mail

General

Target

172a4b22bc74457d73c78db5a0a77faf
Size

148KB
MD5

172a4b22bc74457d73c78db5a0a77faf
SHA1

7e63a1195f21ced285bcb3d0f1c4c8a0c593757b
SHA256

66f6e78adae3e9fc079492df6d0449f9a7aa5bf8eb803651c7fb8bbed7340e75
SHA512

4cc44778a4513628b0d457ead7c123511ed11f9563e0c08ca0308b822c22e2e22e3cdff84bc28b0ed4d15cab11db524dfa672dfbb66f48e7b308d9c58d553c2e
SSDEEP

1536:9TyYEGVjMcKmH5wuabxLbdMeuM2dI7cQPGJDSikmWOcHcUVcSfiKC2:9TyVGVwcKmDF+cQ7ikmWO4cUCSfiKh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
172a4b22bc74457d73c78db5a0a77faf

Files

172a4b22bc74457d73c78db5a0a77faf
.exe windows:5 windows x86 arch:x86

091e6ed99d90d573a866fc48a47b3c8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

commondll

GetHookedDemodMeasurementInfoFromOpendsp
InitCommonDLL
ReadHookedDemodMeasurementInfoFromCommonDLL

hhctrl.ocx

ord14

hspmdll

?Hspmdll_GetNumUnReadEntries@@YAHHH@Z
?Hspmdll_GetLatest@@YAHHHHPAD@Z
?Hspmdll_GetAppID@@YAHXZ
?Hspmdll_Put@@YAHHHHPAD@Z
?Hspmdll_GetNext@@YAHHHHPAD@Z
?Hspmdll_ReadQInit@@YAHHH@Z
?Hspmdll_WriteQInit@@YAHHHHH_N@Z

hspmerror

ReportError

opendsp

FetchAcquisitionData
NumberOfPendingAcquisitionSamples
GetDecimationRate
SetAcquisitionPointer
GetLabel
GetLabelMeasurementIDs
PutAcquisitionData
SetSimulatorChannelRate
SetSimulatorDataSampleRate
ControlSimulatorChannel
SetSimulatorTransferStateFlag
GetLastUpdateTimestamp
GetRootLogicalChannel
GetNextLogicalChannel
GetShortLabels
GetSimulatorTransferStateFlag

xmlhelper

??1HSPMXMLHelper@@UAE@XZ
?GetPathedNodeValue@HSPMXMLHelper@@QAEJPAUIUnknown@@PA_WPAUtagVARIANT@@@Z
?GetNode@HSPMXMLHelper@@QAEJPAUIUnknown@@HPAPAU2@@Z
?GetPathedNodeCollection@HSPMXMLHelper@@QAEJPA_WPAPAUIUnknown@@PAJ@Z
?LoadDocumentFromFile@HSPMXMLHelper@@QAEJPA_W@Z
??0HSPMXMLHelper@@QAE@XZ
?GetXML@HSPMXMLHelper@@QAEJPAPA_W@Z
?SetPathedNodeValue@HSPMXMLHelper@@QAEJPAUIUnknown@@PA_WUtagVARIANT@@@Z
?AddNode@HSPMXMLHelper@@QAEJPA_WUtagVARIANT@@PAUIUnknown@@H@Z
?AddNode@HSPMXMLHelper@@QAEJPA_WUtagVARIANT@@PAUIUnknown@@@Z
?LoadDocumentFromFile@HSPMXMLHelper@@QAEJPA_WPAPAUIUnknown@@@Z

mfc100

ord13219
ord12868
ord4785
ord1313
ord11781
ord1483
ord9475
ord6835
ord9399
ord888
ord6112
ord9281
ord5098
ord11787
ord11153
ord11184
ord9449
ord7355
ord4078
ord11180
ord11172
ord5238
ord3409
ord13481
ord13484
ord13482
ord13485
ord13480
ord13483
ord7144
ord11413
ord13181
ord10922
ord14075
ord1732
ord7091
ord11806
ord305
ord3676
ord8486
ord13299
ord7073
ord13301
ord11421
ord11420
ord2163
ord4724
ord13767
ord11726
ord7510
ord7584
ord1288
ord915
ord1011
ord1890
ord1981
ord2067
ord2063
ord1294
ord4344
ord4345
ord5777
ord8222
ord2742
ord3738
ord5857
ord8227
ord2776
ord3743
ord7862
ord2614
ord3431
ord13280
ord2409
ord2741
ord266
ord1892
ord310
ord3365
ord3362
ord3254
ord7871
ord10030
ord1210
ord788
ord3839
ord2364
ord3970
ord4498
ord306
ord420
ord2617
ord265
ord1854
ord5628
ord2628
ord12962
ord4144
ord7581
ord860
ord6086
ord1499
ord2536
ord11375
ord11952
ord10287
ord10023
ord2633
ord11378
ord11969
ord11185
ord1258
ord7999
ord8268
ord8360
ord10176
ord9750
ord2626
ord6678
ord2611
ord11067
ord8137
ord10007
ord10360
ord3620
ord2974
ord2973
ord2752
ord5532
ord12531
ord2416
ord11107
ord8305
ord5803
ord381
ord1316
ord946
ord1900
ord1929
ord6836
ord8554
ord968
ord5534
ord12535
ord2881
ord2878
ord7349
ord2417
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord11025
ord3395
ord10883
ord13294
ord8070
ord11154
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord4622
ord4903
ord5095
ord8439
ord4881
ord5123
ord4625
ord4774
ord4606
ord5444
ord6897
ord6898
ord6888
ord4772
ord7357
ord9286
ord8304
ord5821
ord895
ord3390
ord5774
ord5830
ord4341
ord2184
ord5776
ord3439
ord316
ord4283
ord1982
ord901
ord5837
ord1296
ord1485
ord3373
ord5242
ord3618
ord2088

msvcr100

__CxxFrameHandler3
fclose
vsprintf_s
wcstombs_s
calloc
_recalloc
fread
fopen_s
fseek
memset
_access
_itoa_s
fprintf_s
atoi
_stricmp
_strdup
mbstowcs_s
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
exit
free
strcpy_s
sprintf_s
_fsopen
strcat_s
_strdate_s
_strtime_s
_CxxThrowException
_setmbcp
fflush
fwrite
memcpy

kernel32

MultiByteToWideChar
GetPrivateProfileStringA
GetPrivateProfileIntA
GetSystemTime
WritePrivateProfileStringA
CreateDirectoryA
WideCharToMultiByte
lstrlenW
LocalAlloc
ReleaseMutex
GetCommandLineA
SetFileAttributesA
SetPriorityClass
GetCurrentProcess
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InterlockedDecrement
LocalFree
Sleep
GetLastError
GetDriveTypeA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

PeekMessageA
RegisterWindowMessageA
PostMessageA
GetSystemMetrics
IsIconic
SendMessageA
InvalidateRect
RedrawWindow
SetTimer
KillTimer
EnableWindow
GetSysColor
IsWindow
UpdateWindow
LoadIconW
SetWindowPlacement
GetWindowPlacement
SetForegroundWindow
FindWindowA
DrawIcon
AppendMenuA
CheckMenuItem
EnableMenuItem
GetMenuItemCount
GetMenuState
GetSubMenu
GetSystemMenu
GetClientRect

gdi32

CreateSolidBrush
CreateFontIndirectA
GetObjectA
GetStockObject

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleRun

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SystemTimeToVariantTime
SysAllocString
VariantClear
VariantInit
SysFreeString

wsock32

gethostbyname
getsockopt
WSAStartup
gethostname
setsockopt
inet_addr
listen

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

091e6ed99d90d573a866fc48a47b3c8c

Headers

DLL Characteristics

File Characteristics

Imports

commondll

hhctrl.ocx

hspmdll

hspmerror

opendsp

xmlhelper

mfc100

msvcr100

kernel32

user32

gdi32

advapi32

ole32

oleaut32

wsock32

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 37KB - Virtual size: 139KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 37KB - Virtual size: 139KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 9KB - Virtual size: 9KB