7a20e2d7c4a1a3ef28cce99df09223b6

Sharing

Copy URL Twitter E-mail

General

Target

7a20e2d7c4a1a3ef28cce99df09223b6
Size

428KB
MD5

7a20e2d7c4a1a3ef28cce99df09223b6
SHA1

c62f8b64e6413d837b5502a5ff19a84c8044295f
SHA256

553a752035e51c01ee8738f1622735942a54e5182680b4e18c8025f54856bb7e
SHA512

b0510cf661814e21a9ed37732127fb9e45a1e56097aaf483d88e728123b3918198dc21ab1602e105bc0f6f122a48a3d8247be615a092bff3f4c821bd257a1728
SSDEEP

6144:ZqzATg0hb4G9Ig8i+kUViNm5riXdVXElT2iEmIfRyTo5XCxjasC1e:ZqIkgl1NmcdVaTGmIfQToBSj8e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a20e2d7c4a1a3ef28cce99df09223b6

Files

7a20e2d7c4a1a3ef28cce99df09223b6
.dll windows:4 windows x86 arch:x86

a6c4a78446196bfc7d1bc794c5d47eae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\code\General CMS\LocalRecord\LocalRecord\Release\LocalRecord.pdb

Imports

kernel32

TlsFree
GetCurrentThreadId
SetErrorMode
GlobalGetAtomNameA
InterlockedIncrement
GetCurrentProcessId
GetFileAttributesA
GetFileTime
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalReAlloc
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
CreateDirectoryA
HeapAlloc
HeapFree
VirtualAlloc
HeapReAlloc
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
HeapSize
ExitProcess
GetACP
IsValidCodePage
GetTimeZoneInformation
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
InterlockedCompareExchange
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
lstrcmpA
GetProcAddress
GetModuleFileNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
LoadLibraryA
GetThreadLocale
DeleteFileA
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
GetLogicalDrives
ReadFile
CreateFileA
MultiByteToWideChar
GetLastError
CompareStringW
lstrlenA
InterlockedExchange
CreateFileW
CompareStringA
GetVersion
CreateThread
TerminateThread
WaitForSingleObject
CloseHandle
GetDriveTypeA
GetDiskFreeSpaceExA
Sleep
OutputDebugStringA
GetTickCount
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
IsDebuggerPresent
InitializeCriticalSection

user32

MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuA
CheckMenuItem
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
SendMessageA
GetKeyState
PeekMessageA
ValidateRect
UnhookWindowsHookEx
GetSystemMetrics
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
PostQuitMessage
DestroyMenu
EnableMenuItem
CharUpperA
GetWindowThreadProcessId
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
LoadBitmapA
GetMessagePos
PtInRect

shlwapi

PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathIsUNCA

oleacc

CreateStdAccessibleObject
LresultFromObject

gdi32

SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

comdlg32

GetFileTitleA

oleaut32

VariantClear
VariantInit
VariantChangeType

Exports

Exports

RecordPlan_AlarmLaunch
RecordPlan_DelPlan
RecordPlan_FindFileByTime
RecordPlan_Init
RecordPlan_InitDisk
RecordPlan_InsertPlan
RecordPlan_ModPlan
RecordPlan_SearchFile
RecordPlan_Start
RecordPlan_Stop
RecordPlan_UnInit

Sections

.text
Size: 320KB - Virtual size: 318KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6c4a78446196bfc7d1bc794c5d47eae

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

oleacc

gdi32

winspool.drv

comdlg32

oleaut32

Exports

Exports

Sections

.text Size: 320KB - Virtual size: 318KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 32KB - Virtual size: 30KB

.text
Size: 320KB - Virtual size: 318KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 32KB - Virtual size: 30KB