48ec0d705459c56e703398bbed6beaa8ccd689023eb00a16059a2322c03cd2bd

Sharing

Copy URL Twitter E-mail

General

Target

48ec0d705459c56e703398bbed6beaa8ccd689023eb00a16059a2322c03cd2bd
Size

986KB
MD5

bbf17cb15ad5d8a5117059b038cc19fd
SHA1

96c3cc106fd21e98150766fd92006139b8c835cc
SHA256

48ec0d705459c56e703398bbed6beaa8ccd689023eb00a16059a2322c03cd2bd
SHA512

cd3b0494c7dd7aae6d283c4813ad0b31ccdfff88d3b07181b67ef714439434e7b5eb0f19752b1c6acfe972e568caca5e49d8eae87bf1ddeb1f2b8c1a341beb14
SSDEEP

24576:fdqDMyuQheECo+5gGG7nDzhzCFjSamTxbz/r:zFWCCH5CRSzTl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48ec0d705459c56e703398bbed6beaa8ccd689023eb00a16059a2322c03cd2bd

Files

48ec0d705459c56e703398bbed6beaa8ccd689023eb00a16059a2322c03cd2bd
.dll windows:5 windows x86 arch:x86

f33eaf5e7e0dedc13ca0ac78a3c50268

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
ExpandEnvironmentStringsA
GetFullPathNameA
SetEndOfFile
FlushViewOfFile
MapViewOfFileEx
CreateFileA
GetFileSize
SetFilePointer
WriteFile
CreateFileMappingA
MapViewOfFile
ReadFile
UnmapViewOfFile
FormatMessageA
LocalFree
CloseHandle
MoveFileExA
CopyFileA
DeleteFileA
GetTempPathA
GetSystemDirectoryA
GetLastError
GetComputerNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
IsProcessorFeaturePresent

user32

MessageBoxA

msvcr100

strpbrk
_errno
fopen
_putenv
atoi
printf
fgets
fputs
bsearch
qsort
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
strncmp
sscanf
memcpy
strspn
strtod
strtol
setlocale
isspace
isdigit
isxdigit
memmove
strncpy
islower
isupper
tolower
_getcwd
_chdir
_fullpath
_strupr
remove
_getpid
isalnum
strrchr
strerror
_findclose
_findfirst64i32
rand
srand
strstr
_fdopen
_open
toupper
_access
_splitpath
_makepath
_stat64i32
calloc
fseek
fread
fclose
isprint
sprintf_s
_localtime64_s
strchr
vsprintf
getenv
exit
_time64
_localtime64
realloc
malloc
free
sprintf
strncpy_s
fprintf
__iob_func
_strdup
_CIfmod
_CItan
_CIacos
_CIatan
_ftime64
fwrite
ferror
_unlink
_findnext64i32
_finite
_CIsqrt
_CIatan2
_CIpow
_CIsin
_CIcos
_CIlog10
_ctime64
ftell
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_purecall
_CxxThrowException
fflush
fputc
feof
abort
_setjmp3
longjmp
floor
_CIexp
_CIlog
ceil
fscanf
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memset

advapi32

GetUserNameA

gdi32

CreateCompatibleDC
DeleteObject
DeleteDC
GetBitmapBits
StretchDIBits
GetDeviceCaps
CreateBitmap
SelectObject
SetStretchBltMode

Exports

Exports

bas_expandenv
bas_getenv
bas_getmsghandler
bas_putenv
bas_resetmsghandler
bas_setmsghandler
clg_applysaff
clg_applyslintraf
clg_getrotatematrix
clg_invsaff
clg_minibox
clg_multsaff
etk_getimginfo
etk_inqpickmasktyp
etk_resizhspcirc
etka_infxfr
ibld_box
icol_create
icol_delete
icol_findasc
icol_inq_nrentries
icol_next
icol_reset
icol_sequkey
icol_sginsertisn
icol_userkey
igma_pickelem
igma_travsupgeo
igsl_getelliarccoo2d
igsl_getgeo1endids
igsl_getpolylinecoo2d
igsl_inqdispopt
igsl_inqext
igsl_inqpos2d
igsl_inqtextcontents
igsl_inqtextlineopt
igsl_inqtextscale
igsl_inqtypdiscrim
imis_clc2lasso
imis_cvt2lasso
imis_enddispopts
imis_freecvtlassos
imis_freelassohdl
imis_getdrawingname
imis_getlasloopnrv
imis_getlasloopvtx
imis_getshdl
imis_initdisopts
imis_inqdispopts
imis_inqtextjoker
imis_relshdl
imis_textjoker
mrci_close
mrci_inqAll
mrci_isopen
mrci_open
mrci_queryInstance
qt_close
qt_ifopen
qt_inqall
qt_open
qt_queryinstance
qt_tobm
raco_bmfreecache
raco_inqbmsize
raco_inqcachstatist
raco_mrciarea2bm
raco_mrcicache2bm
sgd_close
sgd_gzcompress
sgd_gzuncompress
sgd_inqbmst
sgd_inqboxes
sgd_open

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f33eaf5e7e0dedc13ca0ac78a3c50268

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcr100

advapi32

gdi32

Exports

Exports

Sections

.text Size: 815KB - Virtual size: 814KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 55KB - Virtual size: 82KB

.rsrc Size: 512B - Virtual size: 504B

.reloc Size: 52KB - Virtual size: 52KB

.text
Size: 815KB - Virtual size: 814KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 55KB - Virtual size: 82KB

.rsrc
Size: 512B - Virtual size: 504B

.reloc
Size: 52KB - Virtual size: 52KB