d2923d3c88d815bdef8c74cd27cf5d73d58c25d12dd1e099d41daeef3041f11b

Sharing

Copy URL Twitter E-mail

General

Target

d2923d3c88d815bdef8c74cd27cf5d73d58c25d12dd1e099d41daeef3041f11b
Size

1.1MB
MD5

4bdad16b10cffb676c94d8732de9b79c
SHA1

34bd1699ab5d37ecf6df93468d086dcac51e7228
SHA256

d2923d3c88d815bdef8c74cd27cf5d73d58c25d12dd1e099d41daeef3041f11b
SHA512

7c183f7367bedf07f461e72b3e0e429a3426fd8b9e6797389348f67bead36b7cb91915fd90ea236989a84c05b3a11610501cbfbcc3bd89966d3e9596656cb9df
SSDEEP

24576:nsgxw55g9xOthlL61wxpTIWxVoeI+LnwtYb8PLPoMjTrSvmWc+s:Rxw5b5LVpxVPtwtYb8TnTWvmWc+s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2923d3c88d815bdef8c74cd27cf5d73d58c25d12dd1e099d41daeef3041f11b

Files

d2923d3c88d815bdef8c74cd27cf5d73d58c25d12dd1e099d41daeef3041f11b
.dll windows:5 windows x86 arch:x86

6a820e689fd500aa9f115d73abcf9645

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\svn\midware\trunk\PC\latest-release\Win32\HebcaSKFMobile.pdb

Imports

kernel32

GetFileAttributesA
GetFileSizeEx
GetFileTime
GetCPInfo
GetOEMCP
HeapAlloc
HeapFree
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
RtlUnwind
RaiseException
VirtualAlloc
HeapSize
VirtualFree
HeapCreate
HeapDestroy
SetHandleCount
GetStartupInfoA
GetConsoleCP
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
CreateFileW
GetProcessHeap
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DeleteFileA
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
FreeResource
InterlockedDecrement
GetModuleFileNameW
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
lstrlenA
SetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
LoadLibraryExA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
FlushConsoleInputBuffer
ExitProcess
GetCurrentProcessId
GetVersionExW
LoadLibraryW
QueryPerformanceCounter
GlobalMemoryStatus
GetVersion
GetCurrentThreadId
GetFileType
GetLastError
GetStdHandle
GetModuleHandleW
CloseHandle
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
WaitForMultipleObjects
ResetEvent
CreateEventA
WaitForSingleObject
TerminateThread
Sleep
OutputDebugStringA
CreateThread
GetModuleHandleA
SetEvent
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
GetVersionExA
SetStdHandle
GetTickCount

user32

SetMenu
SetForegroundWindow
GetClientRect
GetClassInfoExA
GetClassInfoA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
CallWindowProcA
GetMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindowTextA
SetWindowPos
SetFocus
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
EndDialog
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostQuitMessage
GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
EnableWindow
SetTimer
KillTimer
SendMessageA
PostMessageA
PostThreadMessageA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
DefWindowProcA
GetNextDlgTabItem
DestroyMenu
CharUpperA
GetSysColorBrush
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
RegisterWindowMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
IsWindow
MapWindowPoints

gdi32

SaveDC
RestoreDC
SetMapMode
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
GetObjectA
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetTextColor
SetBkColor
GetClipBox
CreateBitmap
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
SetViewportExtEx
GetStockObject

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ReportEventW
DeregisterEventSource
RegisterEventSourceW

shell32

SHGetSpecialFolderPathA
SHGetDesktopFolder

shlwapi

PathFindExtensionA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFileExistsA
PathFindFileNameA

oleaut32

VariantInit
VariantChangeType
VariantClear

wininet

HttpOpenRequestA
InternetOpenUrlA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetSetOptionExA
InternetQueryDataAvailable
HttpAddRequestHeadersA

Exports

Exports

SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCExportSessionKey
SKF_ECCExportSessionKeyByHandle
SKF_ECCSignData
SKF_ECCVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_GenECCKeyPair
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKey
SKF_GenerateKeyWithECC
SKF_GetConProperty
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_OpenApplication
SKF_OpenContainer
SKF_PrvKeyDecrypt
SKF_RSADecrypt
SKF_RSAExportSessionKey
SKF_RSAExportSessionKeyByHandle
SKF_RSAPrvKeyDecrypt
SKF_RSASignData
SKF_RSAVerify
SKF_ReadFile
SKF_SetLabel
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteFile

Sections

.text
Size: 821KB - Virtual size: 821KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a820e689fd500aa9f115d73abcf9645

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

wininet

Exports

Exports

Sections

.text Size: 821KB - Virtual size: 821KB

.rdata Size: 244KB - Virtual size: 243KB

.data Size: 14KB - Virtual size: 40KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 64KB - Virtual size: 64KB

.text
Size: 821KB - Virtual size: 821KB

.rdata
Size: 244KB - Virtual size: 243KB

.data
Size: 14KB - Virtual size: 40KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 64KB - Virtual size: 64KB