03c1b667cc510b25498a6fda31c29432f224374b3962b3f80071a422bc8890bf

Sharing

Copy URL Twitter E-mail

General

Target

03c1b667cc510b25498a6fda31c29432f224374b3962b3f80071a422bc8890bf
Size

57KB
MD5

6df4b15ac718c7a38002608a05fb572e
SHA1

121d38f7a5287d3ae890faa6c100ac9ff7c8fe29
SHA256

03c1b667cc510b25498a6fda31c29432f224374b3962b3f80071a422bc8890bf
SHA512

646fc70329453c6cf80d6bb790a9f6c17be672f0f270668be991c5151ea90a056b4c958d621d8db7d8b9a86b9e8e25dc3fcd3fb8979400a319da6ca8fb7d1ad5
SSDEEP

1536:AtNi+zdSgat7Cq0XGIqmjrL0ThF8n0I4OnChgI4N:AXiufE7Cq0XGI8dF8n0vOnChg5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03c1b667cc510b25498a6fda31c29432f224374b3962b3f80071a422bc8890bf

Files

03c1b667cc510b25498a6fda31c29432f224374b3962b3f80071a422bc8890bf
.dll windows:5 windows x86 arch:x86

e8007bb66cab591cd7e13f2003d19610

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

pmcommon

PMC_GetABBYYFineReader
PMC_GetLexOCR
PMC_IsExistLexOCR
PMC_IsPageViewerCall
PMC_IsPDFCanOCR
PMC_PMAfxMessageBox
PMC_GetNoExtName
PMC_IsSupportFormat
PMC_GetFileExtName
PMC_GetUniqueFileName
PMC_GetPMINIFileName
PMC_IsForLexmark
PMC_GetPMINIFileNameEx
PMC_GetWindowsVersion
PMC_GetNoPathName
PMC_GetPMFilePath
PMC_ExtToFormat
PMC_IsFileExist
PMC_LoadStringFromFile
PMC_GetPathName
PMC_LoadLibrary

ism

?ConvertImage@PIsm@@QAEHPAV1@HHHP6GHHHH@ZHH@Z
?GetBI@PIsm@@QAEPAUtagBITMAPINFO@@XZ
?CreateImage@PIsm@@QAEHPAUtagBITMAPINFO@@JJHHHH@Z
??1PIsm@@UAE@XZ
?InitialUpdate@PIsm@@UAEXXZ
??2PIsm@@SAPAXI@Z
??0PIsm@@QAE@XZ
?GetImageType@PIsm@@QAEHXZ
?GetImageHeight@PIsm@@QAEJXZ
?GetImageWidth@PIsm@@QAEJXZ
?CreateImage@PIsm@@QAEHHJJHPAUtagRGBQUAD@@KKHHH@Z
??3PIsm@@SAXPAX@Z
?DeleteImage@PIsm@@QAEXH@Z
?GenerateImageW@PIsm@@QAEHPAV1@HHH@Z

pmism

ISM_CreateThumbnailFromFile
ISM_SAVEISM
ISM_OpenMultiff2ISM
ISM_IsValidMultiTiffFile
ISM_GetImagePageCount
ISM_CreateThumbnailFromISM
ISM_DrawDib

phookdlg

?GetRuntimeClass@CLongFileException@@UBEPAUCRuntimeClass@@XZ
??0CLongFileException@@QAE@W4ERROR_CODE@@@Z
?ReportError@CLongFileException@@UAEHII@Z
??1CLongFileException@@UAE@XZ

pdfviewerdl_x

?SaveAsIMGW@CPDFWindow@@QAEJPB_W0JPAPA_WAAH0HJJJJH@Z
?CreatePDFObj@CPDFWindow@@SAPAV1@J@Z
?IsImagePDFW@CPDFWindow@@QAEJPB_W0J@Z
?DeletePDFObj@CPDFWindow@@SAXPAX@Z
?DumpImageW@CPDFWindow@@QAEJPB_W00PAPA_WAAHJ@Z
?GetPageNumW@CPDFWindow@@QAEJPB_W0@Z
GetPDFTypeW

pmset

GetOpenPDFPasswordDLg

mfc100u

ord12610
ord5558
ord2746
ord3746
ord917
ord3261
ord11997
ord337
ord902
ord981
ord4197
ord1450
ord423
ord4290
ord296
ord11940
ord12948
ord12951
ord4805
ord1310
ord286
ord9525
ord1212
ord788
ord3978
ord13305
ord6036
ord2057
ord11330
ord13396
ord2823
ord4421
ord1312
ord381
ord5828
ord8347
ord11163
ord8277
ord2417
ord12606
ord5556
ord2756
ord2980
ord2981
ord3627
ord10412
ord8179
ord11123
ord6711
ord11353
ord13415
ord6869
ord890
ord6140
ord9328
ord5118
ord11845
ord11209
ord11240
ord9498
ord7391
ord11236
ord11228
ord5261
ord3416
ord13568
ord13571
ord13569
ord13572
ord13567
ord13570
ord7179
ord11469
ord13267
ord10976
ord14162
ord1739
ord7126
ord11864
ord3625
ord3684
ord8530
ord13387
ord7108
ord13381
ord11477
ord2887
ord2164
ord4744
ord13854
ord11784
ord7548
ord7624
ord1292
ord11838
ord5229
ord7524
ord11801
ord280
ord11494
ord4511
ord7357
ord7176
ord1987
ord2629
ord285
ord5264
ord13127
ord1934
ord1944
ord4086
ord1479
ord261
ord1271
ord1721
ord870
ord4888
ord4889
ord7876
ord1861
ord2407
ord4392
ord4434
ord4413
ord4379
ord4383
ord4416
ord3999
ord14067
ord3992
ord2665
ord13382
ord7109
ord13388
ord6156
ord10725
ord12557
ord5276
ord2339
ord11116
ord3491
ord2952
ord2951
ord2852
ord11159
ord4642
ord4923
ord5115
ord8483
ord4901
ord5143
ord4645
ord4794
ord4623
ord5468
ord6931
ord6932
ord6922
ord4792
ord7393
ord9333
ord8346
ord5802
ord897
ord3397
ord4360
ord4355
ord1298
ord4331
ord2062
ord10058
ord1300
ord2884
ord7385
ord2418
ord14146
ord14148
ord14147
ord14145
ord14149
ord14132
ord14059
ord4388
ord14060
ord8264
ord11081
ord3402
ord10937
ord13380
ord8112
ord11210
ord6247
ord10045
ord8393
ord2853
ord12724
ord11246
ord11244
ord1501
ord1508
ord1514
ord1519
ord1512
ord4425
ord4396
ord4408
ord4404
ord4400
ord11476
ord4430
ord948
ord908
ord13605
ord2091
ord322
ord2055
ord2053
ord2080
ord1984
ord2045
ord3413
ord408
ord1953
ord2090
ord2088
ord1945
ord1873
ord323
ord1301

msvcr100

__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_wcsnicmp
_CxxThrowException
wcscpy_s
wcscat_s
memset
wcsrchr
__CxxFrameHandler3

kernel32

InterlockedCompareExchange
LoadLibraryW
Sleep
InterlockedExchange
DecodePointer
EncodePointer
LocalAlloc
LocalFree
GetShortPathNameW
GetTempPathW
GetTempFileNameW
GetStartupInfoW
CopyFileW
lstrlenW
GetPrivateProfileStringW
GetPrivateProfileIntW
TerminateProcess
WaitForSingleObject
CreateProcessW
CloseHandle
IsProcessorFeaturePresent
DeleteFileW
GetModuleFileNameW
GetCurrentProcess
GlobalFree
ResumeThread
SuspendThread
FreeLibrary
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetProcAddress

user32

GetDesktopWindow
KillTimer
SetTimer
InvalidateRect
EnableWindow
ReleaseDC
GetDC
GetWindowRect
SetRect
PostMessageW
SendMessageW
CopyRect
wsprintfW
FindWindowW
IsIconic
WaitForInputIdle
IsWindow
UpdateWindow
SetWindowPos

gdi32

PatBlt

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

Exports

Exports

OCR_CheckRecognizeStatus
OCR_DumpRecognitionResultToTextBuffer
OCR_GetEngineType
OCR_RecogByBrother
OCR_RecogByFineReader
OCR_RecogByLegend
PMOCR_BeginRcgOneIsm
PMOCR_BeginRecognise
PMOCR_CloseView
PMOCR_Initialize
PMOCR_IsReady
PMOCR_OpenView
PMOCR_RecogniseFileLists
PMOCR_SaveRecognitionResult
PMOCR_Uninitialize

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8007bb66cab591cd7e13f2003d19610

Headers

DLL Characteristics

File Characteristics

Imports

pmcommon

ism

pmism

phookdlg

pdfviewerdl_x

pmset

mfc100u

msvcr100

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB