66f3eb38a9f2d50af3d5e60f935087c6

Sharing

Copy URL

Twitter E-mail

General

Target

66f3eb38a9f2d50af3d5e60f935087c6
Size

32KB
MD5

66f3eb38a9f2d50af3d5e60f935087c6
SHA1

5f99a4045b97df001c26d8260be135dd990199f9
SHA256

f337d92c2da6c67ab019ed686f14c9e73dc4f13e3b4fb101ed3028f30bfc9ba7
SHA512

7eea0aa2a25be09ae5792790fb7a7ca792db2c2ad133ea77add45ee1f7d069b1ebeceea848286b1b24eb26051ea7c471896cc8f84e20ec3e331d1c98798205e7
SSDEEP

384:n7NpE1BCFq8ESGIjsYbxsTQP37kK00QsiFVil6JYM8ODe69XTkMD/d+uL:7gL8RLjxbxsTQP37s0Q7U6JYXODddJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66f3eb38a9f2d50af3d5e60f935087c6

Files

66f3eb38a9f2d50af3d5e60f935087c6
.dll windows:4 windows x86 arch:x86

550a4617f2a43e55c1d4c1224fa863d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mirstd

?MIR_STDERR@@3VMIRXmlLog@@A
?exists@MIRFile@@QBE_NXZ
??0MIRFile@@QAE@ABVMIRString@@@Z
??1MIRVector@@UAE@XZ
??_7_MIRContainer@@6B@
??1MIRStringHashtable@@UAE@XZ
??_DMIRSimpleStringHashtable@@QAEXXZ
??0MIRSimpleStringHashtable@@QAE@_N0H@Z
??1MIRSimpleHashtable@@UAE@XZ
?mid@MIRString@@QBE?AV1@II@Z
??0MIRMessageLiteral@@QAE@ABVMIRString@@00@Z
?createParametrizedText@MIRParameterizedTextLiteral@@QBE?AVMIRString@@PAX@Z
?setParameterValue@MIRParameterizedTextLiteral@@QBEXPAXHABVMIRString@@@Z
?prapareForParameters@MIRParameterizedTextLiteral@@QBEPAXXZ
??1MIRLogEvent@@QAE@XZ
??0MIRLogEvent@@QAE@ABVMIRString@@0H0@Z
?getEmptyString@MIRString@@SAAAV1@XZ
?init@MIRTextLiteralsCollection@@QAEXXZ
??1MIRException@@UAE@XZ
??0MIRException@@QAE@ABV0@@Z
??0MIRException@@QAE@HABVMIRString@@@Z
??4MIRString@@QAEXABV0@@Z
?add@MIRSimpleStringHashtable@@QAE_NABVMIRString@@PAX@Z
??1MIRFile@@QAE@XZ
??H@YA?AVMIRString@@ABV0@0@Z
?findFirst@MIRSimpleHashtable@@UBEPAXPBXPAVIterator@MIRContainer@@@Z
??0MIRString@@QAE@ABV0@@Z
??0MIRStringHashtable@@QAE@H@Z
??_DMIRVector@@QAEXXZ
??0MIRStringHashtable@@QAE@ABV0@@Z
??0MIRVector@@QAE@ABV0@@Z
??4MIRHashtable@@UAEAAV0@ABV0@@Z
??1MIRMessageLiteral@@UAE@XZ
??0MIRMessageLiteral@@QAE@ABV0@@Z
??_DMIRStringHashtable@@QAEXXZ
?update@MIRParameterizedTextLiteral@@UAEXABVMIRString@@PBVMIRDOMElement@@@Z
??4MIRMessageLiteral@@QAEAAV0@ABV0@@Z
??0MIRTextLiteralsCollection@@QAE@XZ
??1MIRString@@QAE@XZ
??0MIRVector@@QAE@XZ
??0MIRString@@QAE@XZ
?getMIRFunctionMappingPath@@YA?AVMIRString@@XZ
?init@MIRString@@AAEXPBDH@Z

mirdom

??0MIRDOM@@QAE@PAVMIRLog@@@Z
?parseFile@MIRDOM@@QAEPAVMIRDOMElement@@ABVMIRFile@@@Z
?getElementCount@MIRDOMElement@@QBEHABVMIRString@@@Z
?getElement@MIRDOMElement@@QBEPAV1@ABVMIRString@@H@Z
?getAttribute@MIRDOMElement@@QBEABVMIRString@@ABV2@@Z
??1MIRDOM@@QAE@XZ

msvcr80

_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_CxxThrowException
sprintf
??2@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CxxFrameHandler3
?terminate@@YAXXZ

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

??0FMPNG@@QAE@ABV0@@Z
??0FMPNG@@QAE@XZ
??0MIRFunctionMapping@@QAE@ABV0@@Z
??0MIRFunctionMapping@@QAE@PAVMIRLog@@@Z
??0MessageInstance_String@FMPNG@@QAE@ABV01@@Z
??0MessageInstance_String@FMPNG@@QAE@ABVMIRString@@00@Z
??0MessageInstance_String_String@FMPNG@@QAE@ABV01@@Z
??0MessageInstance_String_String@FMPNG@@QAE@ABVMIRString@@00@Z
??1MIRFunctionMapping@@UAE@XZ
??1MessageInstance_String@FMPNG@@UAE@XZ
??1MessageInstance_String_String@FMPNG@@UAE@XZ
??4FMPNG@@QAEAAV0@ABV0@@Z
??4MIRFunctionMapping@@QAEAAV0@ABV0@@Z
??4MessageInstance_String@FMPNG@@QAEAAV01@ABV01@@Z
??4MessageInstance_String_String@FMPNG@@QAEAAV01@ABV01@@Z
??_7FMPNG@@6B@
??_7MIRFunctionMapping@@6B@
??_7MessageInstance_String@FMPNG@@6B@
??_7MessageInstance_String_String@FMPNG@@6B@
?DOCUMENT_ID@FMPNG@@0VMIRString@@A
?FUNCTION_MAPPING_FILE_NOT_FOUND@FMPNG@@2VMessageInstance_String_String@1@A
?FUNCTION_MAPPING_FUNC_NOT_FOUND@FMPNG@@2VMessageInstance_String@1@A
?FUNCTION_MAPPING_IMPL_NOT_FOUND@FMPNG@@2VMessageInstance_String@1@A
?PREFIX@FMPNG@@0VMIRString@@A
?addTargetImplementations@MIRFunctionMapping@@MAEXPAVMIRString@@@Z
?cleanTargetImplementations@MIRFunctionMapping@@MAEXXZ
?findTextLiteral@FMPNG@@SAPBVMIRTextLiteral@@ABVMIRString@@@Z
?getAllLiterals@FMPNG@@SAPAPBVMIRTextLiteral@@XZ
?getDocumentId@FMPNG@@MBEABVMIRString@@XZ
?getFunction@MIRFunctionMapping@@IAEPAVFunction@1@ABVMIRString@@H@Z
?getImplementation@MIRFunctionMapping@@IAEPAVImplementation@1@ABVMIRString@@@Z
?getMessage@MessageInstance_String@FMPNG@@QAE?AVMIRString@@ABV3@@Z
?getMessage@MessageInstance_String_String@FMPNG@@QAE?AVMIRString@@ABV3@0@Z
?listAllLiterals@FMPNG@@MBEPAPAVMIRTextLiteral@@XZ
?log@MessageInstance_String@FMPNG@@QAEXAAVMIRLog@@ABVMIRString@@@Z
?log@MessageInstance_String_String@FMPNG@@QAEXAAVMIRLog@@ABVMIRString@@1@Z
?textLiterals@FMPNG@@0PAPAVMIRTextLiteral@@A
?throwException@MessageInstance_String@FMPNG@@QAEXABVMIRString@@@Z
?throwException@MessageInstance_String_String@FMPNG@@QAEXABVMIRString@@0@Z
?toString@MessageInstance_String@FMPNG@@QAE?AVMIRString@@ABV3@@Z
?toString@MessageInstance_String_String@FMPNG@@QAE?AVMIRString@@ABV3@0@Z

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

550a4617f2a43e55c1d4c1224fa863d0

Headers

File Characteristics

Imports

mirstd

mirdom

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB