c05537402d870edf0de739a6bb685924da71a2886636a5ca1ec5c16be183b671

Sharing

Copy URL

Twitter E-mail

General

Target

c05537402d870edf0de739a6bb685924da71a2886636a5ca1ec5c16be183b671
Size

850KB
MD5

dbf2725aeb0a45ae653f3a29cfde66cf
SHA1

49a9cb18894729b8f6eecc0a553ffe9902efa973
SHA256

c05537402d870edf0de739a6bb685924da71a2886636a5ca1ec5c16be183b671
SHA512

3b89cdcc431b46a12db3b871640b32db277fcb8a03831af51f803e2b1dbebc042a3d860cb457c1eb94ee85b3e6782977a9f7e2fff91f1fd33f9a0257605c59ae
SSDEEP

12288:Oe/qKO5ZcOC7DqNeMr5p04Y9Dx6/24t+tQMIG9PqTAZjI5s5:OeyZ2GlUD8/24t+tQMIRTAZjms5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
c05537402d870edf0de739a6bb685924da71a2886636a5ca1ec5c16be183b671

Files

c05537402d870edf0de739a6bb685924da71a2886636a5ca1ec5c16be183b671
.dll windows:6 windows x86 arch:x86

36fe71555df7543c6172911fb5ce6c34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

commondatasetbase

?GetModuleDir@Environment@common@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAX@Z
?IsDirectory@File@common@@QBE_NXZ
?IsExist@File@common@@QBE_NXZ
??1File@common@@UAE@XZ
??0File@common@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CopyLen@StringHelper@common@@YA_NPADIPBDZZ
?TryStringToGUID@GUIDHelper@common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAUtag_GUID@2@@Z
?FromUTCTime@TimeStamp@common@@SA?AV12@_J@Z
??1TimeStamp@common@@QAE@XZ
??0TimeStamp@common@@QAE@_J@Z
?TryStrToDateTime@DateFormatter@common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_J@Z
??1DateTime@common@@QAE@XZ
??0DateTime@common@@QAE@ABVTimeStamp@1@@Z
??0DateTime@common@@QAE@HHHHHHHH@Z
??0DateTime@common@@QAE@ABUDateTimeVal@01@@Z
?GetSize@BinaryReader@common@@UAE_JXZ
?Read@BinaryReader@common@@UAE_NPAEIPAI@Z
?Open@BinaryReader@common@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1@Z
??1BinaryReader@common@@UAE@XZ
??0BinaryReader@common@@QAE@XZ
??0TextReader@common@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?IsValid@DateTime@common@@SA_NHHHHHHHH@Z
?GetSize@TextStream@common@@UAE_JXZ
?Seek@TextStream@common@@UAE_J_JW4SeekMode@2@@Z
?GetPos@TextStream@common@@UAE_JXZ
?Append@TextStream@common@@UAE_JPBEI@Z
?Close@TextStream@common@@UAE_NXZ
?Open@TextStream@common@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1@Z
?GetSize@TextReader@common@@UAE_JXZ
?GetPos@TextReader@common@@UAE_JXZ
?Seek@TextReader@common@@UAE_J_JW4SeekMode@2@@Z
?ReadLine@TextReader@common@@UAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Close@TextReader@common@@UAE_NXZ
?Open@TextReader@common@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1@Z
?AnsiToWideString@StringHelper@common@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?GetInstance@BugChecker@common@@SAAAV12@XZ
?Throw@BugChecker@common@@QAEAAV12@XZ
?SetDumpMark@BugChecker@common@@QAEAAV12@_N@Z
?Assertion@BugChecker@common@@QAEAAV12@PBD00H@Z
?AnsiToUtf8@StringHelper@common@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z

sqlitedingli

sqlite3_column_int64
sqlite3_errmsg
sqlite3_column_int
sqlite3_column_blob
sqlite3_column_text
sqlite3_column_count
sqlite3_exec
sqlite3_close
sqlite3_free
sqlite3_column_bytes
sqlite3_finalize
sqlite3_step
sqlite3_column_double
sqlite3_open_v2
sqlite3_prepare_v2

kernel32

DisableThreadLibraryCalls
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
LoadLibraryA
FreeLibrary
MultiByteToWideChar
FileTimeToLocalFileTime
FindClose
FindFirstFileW
FileTimeToDosDateTime
GetProcAddress

msvcp110

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?eof@ios_base@std@@QBE_NXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0id@locale@std@@QAE@I@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_BADOFF@std@@3_JB
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

msvcr110

wcstol
memcpy
memcmp
floor
__RTDynamicCast
__CxxFrameHandler3
_CxxThrowException
__clean_type_info_names_internal
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_initterm
_malloc_crt
memmove
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memchr
free
malloc
realloc
_wmkdir
_wremove
_waccess
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
tolower
isdigit
toupper
strtod
sprintf
ceil
_strtoi64
strtol
memset
wcstod
_wcstoi64
??_V@YAXPAX@Z
_wassert
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_vsnprintf
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit

Exports

Exports

CheckOriginalFileType
CommonOriginalFileReaderVersion
ConfigExtentProperty
ConfigIntProperty
ConfigOriginalFileDeviceInfo
ConfigStringProperty
CreateOriDataReader
CreateOriginalFileReader
DecompressOriginalFile
FreeFileHandle
GetCurOriginalDataInfo
GetCurrentOriginalDataPacketDetailCount
GetCurrentOriginalDataPacketDetails
GetDecoderVersion
GetExceptionOriginalDataInfoCount
GetFileAppointStringProperty
GetFileCompressPackageContent
GetFileCompressPackageContentCheckValue
GetFileCompressPackageContentPosition
GetFileCompressPackageCount
GetFileStringProperty
GetFileStringPropertyCount
GetFileStringPropertyID
GetLastErrorDescribe
GetOriginalDataFileHeader
GetOriginalDataInfoByIndex
GetOriginalDataInfoByIndexEx
GetOriginalDataInfoCount
GetOriginalDataPacketCountByFlag
GetOriginalDataPacketCountBySubCode
GetOriginalDataPacketFlagCount
GetOriginalDataPacketFlags
GetOriginalDataPacketPosOffsetsByFlag
GetOriginalDataPacketSubCodeCountByFlag
GetOriginalDataPacketSubCodesByFlag
GetOriginalDataPacketsByFlag
GetOriginalDataPacketsByFlagEx
GetOriginalDataPacketsBySubCode
GetOriginalFileDeviceInfoCount
GetOriginalFileDeviceModelName
GetOriginalFileDevicePortID
GetOriginalFileExecuteRate
GetOriginalFilePropertyValue
GetOriginalFileRcuID
GetOriginalFileType
GetOriginalPackageHeaderInfoByIndex
GetOriginalPackageInfoByIndex
GetParseDataHeaderBuffer
GetSecretKeyVerifyBuffer
GetShareFormatBookmarkBuffer
GetShareFormatEventInfo
GetShareFormatEventTypeCount
GetShareFormatExtendedInfoFlagCount
GetShareFormatExtendedInfoFlags
GetShareFormatNetTypeCount
GetShareFormatNetTypeInfo
GetShareFormatNotStorageSpecificFieldGroupInfo
GetShareFormatNotStorageSpecificFieldGroupInfoCount
GetShareFormatOperatorCount
GetShareFormatOperatorInfo
GetShareFormatParamInfo
GetShareFormatParamTypeCount
GetShareFormatProductDetailInfo
GetShareFormatProductDetailInfoByID
GetShareFormatProductDetailInfoCount
GetShareFormatStructInfo
GetShareFormatStructTypeCount
GetShareFormatTestDescribeInfo
GetShareFormatTestDescribeInfoCount
GetShareFormatTestInfo
GetShareFormatTestInfoByID
GetShareFormatTestInfoCount
GetShareFormatVoiceSPInfo
GetStreamForIndex
GetStreamNum
InputOneOriDataPackInfo
IsOriginFileUseUTCTime
IsOriginalFileEncrypted
OriginalFileReaderFirst
OriginalFileReaderIsEnd
OriginalFileReaderNext

Sections

.text
Size: 538KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36fe71555df7543c6172911fb5ce6c34

Headers

DLL Characteristics

File Characteristics

Imports

commondatasetbase

sqlitedingli

kernel32

msvcp110

msvcr110

Exports

Exports

Sections

.text Size: 538KB - Virtual size: 537KB

.rdata Size: 263KB - Virtual size: 262KB

.data Size: 10KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 872B

.reloc Size: 37KB - Virtual size: 36KB

.text
Size: 538KB - Virtual size: 537KB

.rdata
Size: 263KB - Virtual size: 262KB

.data
Size: 10KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 872B

.reloc
Size: 37KB - Virtual size: 36KB