212ccc3e0dfc81f912cda7d5ad256859f86dce593d3a840867a42e7ab0674c30

Sharing

Copy URL Twitter E-mail

General

Target

212ccc3e0dfc81f912cda7d5ad256859f86dce593d3a840867a42e7ab0674c30
Size

3.0MB
MD5

1c21e2d39257184cf56a5bc5b18dcbf9
SHA1

d00c3145fc85b736e358c0f3e96994d6e8e6aa88
SHA256

212ccc3e0dfc81f912cda7d5ad256859f86dce593d3a840867a42e7ab0674c30
SHA512

7fb4fd1693d11222d8d30390b94536ba7218d8764dae9008fcf3b89f383b39502279960b6253c9e4cb0e08ddc3327c0275394bad55ff038176da1d169b56d41e
SSDEEP

6144:LxuNhZHtzia5Vj18pjIAZyZj6vLk/HUY5Ri8CtVfmgmzB57WOuAYp3WG5rY:0iaXaNyZj6Ds0YPY3fmg0M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
212ccc3e0dfc81f912cda7d5ad256859f86dce593d3a840867a42e7ab0674c30

Files

212ccc3e0dfc81f912cda7d5ad256859f86dce593d3a840867a42e7ab0674c30
.exe windows:4 windows x86 arch:x86

7342336f3597e4d3fc5406c8d3b5a5c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord5856
ord5572
ord2915
ord2764
ord5981
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord2614
ord561
ord815
ord773
ord5943
ord2621
ord1134
ord2725
ord501
ord2086
ord4160
ord2863
ord1083
ord5600
ord2864
ord6270
ord1644
ord3797
ord6605
ord3654
ord4220
ord2584
ord2438
ord2754
ord2380
ord1576
ord5683
ord3097
ord2302
ord692
ord656
ord3639
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord3610
ord1200
ord860
ord6877
ord4129
ord5710
ord858
ord4278
ord535
ord1949
ord818
ord2135
ord567
ord4424
ord3402
ord5290
ord1776
ord6055
ord6157
ord6172
ord5785
ord4376
ord686
ord3571
ord939
ord4476
ord5875
ord5953
ord6334
ord1641
ord4299
ord6199
ord2642
ord2414
ord3663
ord3626
ord3573
ord470
ord755
ord2753
ord540
ord2818
ord2379
ord6453
ord2405
ord1640
ord4710
ord2859
ord3092
ord6215
ord823
ord4234
ord640
ord324
ord323
ord641
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord5265
ord2408
ord825
ord384
ord2097
ord1168
ord1146
ord537
ord800
ord3738

msvcrt

_mbsicmp
printf
_except_handler3
strstr
__dllonexit
_onexit
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
strtoul
atoi
_mbscmp
_setmbcp
_purecall
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
free
_ftol
__CxxFrameHandler

kernel32

WaitForSingleObject
CloseHandle
GetTickCount
WritePrivateProfileStringA
GetLocalTime
GetSystemDefaultLCID
GetPrivateProfileIntA
GetLongPathNameA
GetModuleFileNameA
GetModuleHandleA
Sleep
CreateThread
GetPrivateProfileStringA
CreateFileMappingA
UnmapViewOfFile
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
CreateMutexA
GetStartupInfoA
MapViewOfFile
lstrcpynA

user32

PeekMessageA
SetWindowLongA
AppendMenuA
GetSystemMenu
InvalidateRect
PostMessageA
ReleaseDC
GetSystemMetrics
TranslateMessage
DispatchMessageA
LoadBitmapA
SetTimer
DestroyIcon
SendMessageA
GetClientRect
GetDC
EnableWindow
DrawIcon
IsIconic
mouse_event
GetWindowTextA
GetForegroundWindow
SetForegroundWindow
LoadIconA
SetActiveWindow
GetCursorPos
CreatePopupMenu
GetParent
CopyRect
InflateRect
DrawIconEx
OffsetRect
KillTimer

gdi32

DeleteDC
LineTo
MoveToEx
CreatePen
Rectangle
DeleteObject
CreateSolidBrush
BitBlt
SelectObject
CreateDIBSection
GetObjectA
StretchBlt
SetDIBitsToDevice
CreateCompatibleBitmap
Ellipse
CreateCompatibleDC

advapi32

InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid

shell32

ShellExecuteA
Shell_NotifyIconA

comctl32

ImageList_GetImageCount
ImageList_SetBkColor

ole32

CoInitialize
CoUninitialize

winmm

timeGetTime

dev

?DevGetFrame@@YAHPAUHDEVCTR__@@PAEAAJ@Z
?DevGetCaptureNum@@YAJW4ECapType@@@Z
?DevGetCaptureInfo@@YAJW4ECapType@@PAUSInfoParam@@@Z
?DevCreate@@YAPAUHDEVCTR__@@PAUSCapParam@@@Z
?DevInitCapture@@YAHPAUHDEVCTR__@@@Z
?DevStop@@YAXPAUHDEVCTR__@@@Z
?DevPlay@@YAHPAUHDEVCTR__@@H@Z
?DevDestroy@@YAXPAUHDEVCTR__@@@Z
?DevSetControl@@YAHPAUHDEVCTR__@@PAUSCapControl@@@Z

gdiplus

GdiplusShutdown
GdiplusStartup

multiirlight

?IRLFindMostLight@@YAHPAUHMULTIIRLIGHT__@@PAUSCapFrame@@PAU_SDetectPoint@@@Z
?IRLFindWinPointOne@@YAHPAUHMULTIIRLIGHT__@@PAUSCapFrame@@PAU_SDetectPoint@@@Z
?IRLFindWinPoint@@YAKPAUHMULTIIRLIGHT__@@PAUSCapFrame@@PAU_SDetectPoint@@K@Z
?IRLSetConfig@@YAXPAUHMULTIIRLIGHT__@@PAU_SCalibration@@@Z
?IRLSetImgConfig@@YAXPAUHMULTIIRLIGHT__@@PAU_SImgPara@@@Z
?GreyValue@@YAXPAUHMULTIIRLIGHT__@@H@Z
?IRLResetAutoEnroll@@YAXPAUHMULTIIRLIGHT__@@@Z
?IRLResetEnroll@@YAXPAUHMULTIIRLIGHT__@@@Z
?IRLCreate@@YAPAUHMULTIIRLIGHT__@@XZ
?IRLInit@@YAHPAUHMULTIIRLIGHT__@@@Z
?IRLSetCmpPara@@YAXPAUHMULTIIRLIGHT__@@K@Z
?IRLUninit@@YAXPAUHMULTIIRLIGHT__@@@Z

find_center_point

Calibration_Point

acamdll

ALC_ReadFlash
ALC_WriteFlash
ALC_SetWriteProtect
ALC_SetFlashSize
ALC_Initialize
ALC_UnInitialize

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7342336f3597e4d3fc5406c8d3b5a5c2

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

winmm

dev

gdiplus

multiirlight

find_center_point

acamdll

Sections

.text Size: 60KB - Virtual size: 56KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 2.9MB - Virtual size: 2.9MB

.text
Size: 60KB - Virtual size: 56KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2.9MB - Virtual size: 2.9MB