7bac2c578ac98a493d0d881554ec31b00c2feb267b09a0989ea21b0a9515d37f

Sharing

Copy URL

Twitter E-mail

General

Target

7bac2c578ac98a493d0d881554ec31b00c2feb267b09a0989ea21b0a9515d37f
Size

16KB
MD5

f8fa4ded13fb309b7cdfccb582617e82
SHA1

0a877b8632b656d232625e0b1c1b69061c3eeb70
SHA256

7bac2c578ac98a493d0d881554ec31b00c2feb267b09a0989ea21b0a9515d37f
SHA512

72470a7254653a2aad804f070465cacb577a2cf79bdc97c6f93ccc9366cb9acc8786677bede06d344220d0a5a5d83838d9dd9a17bef9082ee406e6d22c1e6d87
SSDEEP

384:rgVSrpr2Agu5kStEjA/4mvSmUFJ6TTOPvSCa7rDEG:HRySach6a70

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bac2c578ac98a493d0d881554ec31b00c2feb267b09a0989ea21b0a9515d37f

Files

7bac2c578ac98a493d0d881554ec31b00c2feb267b09a0989ea21b0a9515d37f
.exe windows:6 windows x86 arch:x86

584f83b0698775a7087149a343c1f90d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cpro

??1CProImage@@UAE@XZ
?Save@CProImage@@QBE_NPBDW4FileType@1@@Z
?SetErrorMode@CProManager@@SAXW4ErrorMode@1@@Z
??0CProImage@@QAE@HHW4Format@CProData@@PAX_N@Z

kernel32

MapViewOfFile
CreateEventW
CloseHandle
UnmapViewOfFile
WaitForSingleObject
OutputDebugStringA
SetEvent
GetLocalTime
GetTickCount
CreateMutexW
CopyFileA
OpenMutexW
GetPrivateProfileIntA
GetPrivateProfileIntW
ResetEvent
SetThreadPriority
ResumeThread
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
OpenFileMappingW
GetLastError
CreateFileMappingW
WritePrivateProfileStringA
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
GetModuleHandleW

dbghelp

MakeSureDirectoryPathExists

shlwapi

PathFileExistsA

codereaderdll_dahua

_UnIniReadCode@4
_ReadCodeID@60
_IniReadCode@12

vcruntime140

memcpy
__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
memset
_except_handler4_common
__CxxFrameHandler3
_local_unwind4

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsnprintf_s
fclose
__stdio_common_vsprintf_s
__p__commode
__stdio_common_vfprintf_s
__acrt_iob_func
fopen_s

api-ms-win-crt-runtime-l1-1-0

_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_exit
_set_app_type
__p___argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
exit
__p___argc
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

584f83b0698775a7087149a343c1f90d

Headers

DLL Characteristics

File Characteristics

Imports

cpro

kernel32

dbghelp

shlwapi

codereaderdll_dahua

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1.5MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 844B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1.5MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 844B