5b83b4ed4361144394272fe65c5db3c5

Sharing

Copy URL Twitter E-mail

General

Target

5b83b4ed4361144394272fe65c5db3c5
Size

14.9MB
MD5

5b83b4ed4361144394272fe65c5db3c5
SHA1

ca560d6e8c223be06a977e36121538e97f468333
SHA256

02de21722eef249f6324687c3bd45ceec53b60a0f1e4155bc11e5036cdec7aa2
SHA512

7b0899d6ff11ac74d419799c4688eb02b25742a5c7581fb030831b7f13e949ee4a3029b04de061eb823c54d15be858f3c757e5f99c41a5a154f81523dcdf89c1
SSDEEP

98304:Ys5K3w82LSvc5B3GSAq+aMQpPfB5i2nHLMoQ0P9P7nhxwBmaUMqB9rNVV/iSfP2n:YeGk5B3GSAYwE/e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b83b4ed4361144394272fe65c5db3c5

Files

5b83b4ed4361144394272fe65c5db3c5
.exe windows:4 windows x86 arch:x86

f2cc935673ee1db44937e544bd35dcd1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

f3biprct

ord67
ord18
ord39
ord19
ord54
ord20
ord27
ord25
ord31
ord3
ord26
ord1

f3biio

ord38
ord22

f3binuc

ord9

f3bilpio

ord8
ord1
ord9

f3biflte

ord8

f3bicblr

ord10
ord11
ord13

f5ddfcb4

XPOW_SET_COBOL_PARAM
?sCanClearCobolRuntime@OFjCobCmpScr@@SGHXZ
XPOW_RELEASE_DISPATCH
XPOW_CPY_COBOL_PARAM
XPOW_INVOKE_BY_ID_2
?sMarkPowerCobolMain@OFjCobCmpScr@@SGXXZ
?sLoadCobolCount@OFjCobCmpScr@@SGXXZ
?sUnloadCobolCount@OFjCobCmpScr@@SGXXZ

f5ddcy41

?sExeEntry@OCfModule@@SGKPAUHINSTANCE__@@PADHPAPAUICfModule@@PAX@Z

f5ddgadp

XPOWCFCONTROLSETFOCUS

f5ddcadp

XPOWLISTITEMGETNUMERIC
XPOWLISTITEMGETTEXT_8192
XPOWLISTITEMSETNUMERIC
XPOWLISTITEMSETTEXT_8192

kernel32

LCMapStringW
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetEnvironmentStrings
LoadLibraryA
GetProcAddress
IsBadWritePtr
HeapReAlloc
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc

Exports

Exports

FRM-CHIFLET
FRM-CRECLI
FRM-CREEMPL
FRM-CREFONC
FRM-CREGRPLV
FRM-CREIMPT
FRM-CREMOIS
FRM-CREPERS
FRM-CRERUBQ
FRM-CRESRV
FRM-CRESTE
FRM-CRETRIM
FRM-FCHSECT
FRM-HLPCLI
FRM-HLPEMPL
FRM-HLPEXER
FRM-HLPFNC
FRM-HLPGRP
FRM-HLPIMPT
FRM-HLPMOIS
FRM-HLPMOISG
FRM-HLPNCRT
FRM-HLPPERS
FRM-HLPPERSX
FRM-HLPPROD
FRM-HLPPRSG
FRM-HLPRUBQ
FRM-HLPSECT
FRM-HLPSRV
FRM-HLPSTE
FRM-HLPTRIM
FRM-MTPAIE
FRM-NATCRT
FRM-STPAIE
FRM-TABCONV
PAI-ACTM
PAI-BULL
PAI-BULL1
PAI-BULLBCH
PAI-BULLBCH2
PAI-BULLBCH3
PAI-BULLDBL
PAI-CALC
PAI-CNSS
PAI-CNSSR
PAI-DEMP
PAI-DEMPR
PAI-EXERCICE
PAI-FIND
PAI-FIND1
PAI-INFO
PAI-LIVC
PAI-LIVP
PAI-LIVPG
PAI-LIVT
PAI-LIVV
PAI-LIVV1
PAI-LIVVX
PAI-MOISTE
PAI-MVTS
PAI-PERS
PAI-PRSM
PAI-REACTIV
PAI-TRANSFERT
SETTINGPROPERTY
SETTINGPROPERTY-R

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2cc935673ee1db44937e544bd35dcd1

Headers

File Characteristics

Imports

f3biprct

f3biio

f3binuc

f3bilpio

f3biflte

f3bicblr

f5ddfcb4

f5ddcy41

f5ddgadp

f5ddcadp

kernel32

Exports

Exports

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 5.7MB - Virtual size: 5.7MB

.rodata Size: 248KB - Virtual size: 247KB

.rsrc Size: 4.1MB - Virtual size: 4.1MB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 5.7MB - Virtual size: 5.7MB

.rodata
Size: 248KB - Virtual size: 247KB

.rsrc
Size: 4.1MB - Virtual size: 4.1MB