c445d2a4cc2a7a3dbbde9b91a5da2f15

Sharing

Copy URL Twitter E-mail

General

Target

c445d2a4cc2a7a3dbbde9b91a5da2f15
Size

34KB
MD5

c445d2a4cc2a7a3dbbde9b91a5da2f15
SHA1

53ef738248e25c2a9ffa6e158a9d91575d4f05d0
SHA256

dca5ae14a19bb5802925e9976447ff1a63ffc05ad58aa708dbb5be9caa4e29a0
SHA512

1c3d31bc5a8f5a0b61ae91d81cc2803e1f15aa5694b0cfaa5e375be771ce7f3ed31f17735f4044d419660eee73dd43edcb59590d9500b753ec970acad3d69069
SSDEEP

768:uKW66Gz+Tfw+T41ynzDOWbKKSZT9+g2+KKWXODihdMLn:S3Gz+Tfwp62d9C+0ODihdML

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c445d2a4cc2a7a3dbbde9b91a5da2f15

Files

c445d2a4cc2a7a3dbbde9b91a5da2f15
.dll windows:4 windows x86 arch:x86

298eaa18eeefeac2b489ed05b884683d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mirmicrosoftexceladvancedimport

getMIRMicrosoftExcelAdvancedImportInterface
?BP_DATA_STREAM_MERGING_STRATEGY_USE_METAMAP_VALUE@MBI_EXCL@@2VMIRBridgeEnumValueLiteral@@A
?BP_ETL_DATA_STREAM_MERGING_STRATEGY@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A
?BP_PRINT_WARNINGS_IF_ROWS_ARE_SKIPPED@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A
?BP_MERGE_OBJECTS_WITH_SAME_NAMES@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A
?BP_TRI_BOOLEAN_ENUM_USE_METAMAP_VALUE@MBI_EXCL@@2VMIRBridgeEnumValueLiteral@@A
?BP_COMPARE_NAMES_IGNORING_CASE@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A
?BP_ENVIRONMENT_VARIABLE_FILE@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A
?BP_METADATA_MAPPING_SPREADSHEET@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A
?BP_FILE@MBI_EXCL@@2VMIRBridgeOptionLiteral@@A

mirstd

?init@MIRTextLiteralsCollection@@QAEXXZ
??1MIRException@@UAE@XZ
??0MIRException@@QAE@ABV0@@Z
??0MIRException@@QAE@HABVMIRString@@@Z
??0MIRTextLiteralsCollection@@QAE@XZ
??4MIRMessageLiteral@@QAEAAV0@ABV0@@Z
??0MIRMessageLiteral@@QAE@ABV0@@Z
??1MIRMessageLiteral@@UAE@XZ
??4MIRParameterizedTextLiteral@@QAEAAV0@ABV0@@Z
?update@MIRParameterizedTextLiteral@@UAEXABVMIRString@@PBVMIRDOMElement@@@Z
??0MIRLogEvent@@QAE@ABVMIRString@@0H0@Z
??1MIRLogEvent@@QAE@XZ
?prapareForParameters@MIRParameterizedTextLiteral@@QBEPAXXZ
?setParameterValue@MIRParameterizedTextLiteral@@QBEXPAXHABVMIRString@@@Z
?createParametrizedText@MIRParameterizedTextLiteral@@QBE?AVMIRString@@PAX@Z
??0MIRMessageLiteral@@QAE@ABVMIRString@@00@Z
?mid@MIRString@@QBE?AV1@II@Z
??0MIRString@@QAE@XZ
??H@YA?AVMIRString@@ABV0@0@Z
??0MIRParameterizedTextLiteral@@QAE@ABVMIRString@@0@Z
??1MIROption@@UAE@XZ
??_7MIROptionList@@6B@
??0MIROptionVector@@QAE@XZ
?get@MIROptionList@@QBEPAVMIROption@@ABVMIRString@@@Z
?getValue@MIROption@@QBEABVMIRString@@XZ
??0MIRString@@QAE@ABV0@@Z
?removeAll@MIROptionList@@QAEXXZ
?getEmptyString@MIRString@@SAAAV1@XZ
?add@MIROptionList@@QAE_NPAVMIROption@@@Z
??4MIRString@@QAEXABV0@@Z
??0MIROption@@QAE@ABVMIRString@@@Z
?isDirectory@MIRFile@@QBE_NXZ
??_DMIROptionVector@@QAEXXZ
??1MIROptionList@@UAE@XZ
??1MIRFile@@QAE@XZ
?exists@MIRFile@@QBE_NXZ
??0MIRFile@@QAE@ABVMIRString@@@Z
??1MIRString@@QAE@XZ
?init@MIRString@@AAEXPBDH@Z
??1MIRParameterizedTextLiteral@@UAE@XZ
??0MIRParameterizedTextLiteral@@QAE@ABV0@@Z

mir

??0MIRModel@@QAE@XZ
??1MIRModel@@UAE@XZ

mirbridgelib

?checkIfFilesChanged@@YA_NAAVMIRModel@@AAVMIRLog@@AAVMIROptionList@@@Z
?BP_ONLY_UPDATED_SINCE_DATE@BLIB@@2VMIRBridgeOptionLiteral@@A

mirmodelbridge

??1MIRBridgeOptionLiteral@@UAE@XZ
??0MIRBridgeOptionLiteral@@QAE@ABVMIRString@@0W4OptionType@@0PBVMIRBridgeOptionEnumerationLiteral@@PBVMIRTextLiteral@@@Z
?getBridgeSpecification@@YAPBVMIRBridgeSpecificationLiteral@@ABVMIRString@@@Z
?BRIDGE_SPEC_MICROSOFTEXCEL_IMPORT@MBLST@@2VMIRBridgeSpecificationLiteral@@A
?getInternalCode_DescriptionLiteralId@MIRBridgeSpecificationLiteral@@QBEABVMIRString@@XZ
?getMethodology_Summary@MIRBridgeSpecificationLiteral@@QBEABVMIRString@@XZ
?getTool_Versions@MIRBridgeSpecificationLiteral@@QBEABVMIRString@@XZ
?getTool_Name@MIRBridgeSpecificationLiteral@@QBEABVMIRString@@XZ
?getVendor_Name@MIRBridgeSpecificationLiteral@@QBEABVMIRString@@XZ
?getTool_Web@MIRBridgeSpecificationLiteral@@QBEABVMIRString@@XZ
?initialize@MIRBridgeSpecification@@QAEXABVMIRString@@0000PAPAD00_N22@Z
?generateOption@MIRBridgeOptionLiteral@@QAEPAVMIROption@@_NPAPBDW4OpenMode@@0@Z
?generateOption@MIRBridgeOptionLiteral@@QAEPAVMIROption@@_N@Z
?UNSUPPORTED_BRIDGE_OPERATION@MBCM@@2VMessageInstance_String_String@1@A
?throwException@MessageInstance_String_String@MBCM@@QAEXABVMIRString@@0@Z

msvcr80

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
?terminate@@YAXXZ
_CxxThrowException
??2@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_unlock

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

??0MBI_SEXCL@@QAE@ABV0@@Z
??0MBI_SEXCL@@QAE@XZ
??0MIRMicrosoftExcelImportDllInterface@@QAE@ABV0@@Z
??0MIRMicrosoftExcelImportDllInterface@@QAE@XZ
??0MessageInstance_String@MBI_SEXCL@@QAE@ABV01@@Z
??0MessageInstance_String@MBI_SEXCL@@QAE@ABVMIRString@@00@Z
??0TextInstance@MBI_SEXCL@@QAE@ABV01@@Z
??0TextInstance@MBI_SEXCL@@QAE@ABVMIRString@@0@Z
??1MessageInstance_String@MBI_SEXCL@@UAE@XZ
??1TextInstance@MBI_SEXCL@@UAE@XZ
??4MBI_SEXCL@@QAEAAV0@ABV0@@Z
??4MIRMicrosoftExcelImportDllInterface@@QAEAAV0@ABV0@@Z
??4MessageInstance_String@MBI_SEXCL@@QAEAAV01@ABV01@@Z
??4TextInstance@MBI_SEXCL@@QAEAAV01@ABV01@@Z
??_7MBI_SEXCL@@6B@
??_7MIRMicrosoftExcelImportDllInterface@@6B@
??_7MessageInstance_String@MBI_SEXCL@@6B@
??_7TextInstance@MBI_SEXCL@@6B@
?BP_FILE@MBI_SEXCL@@2VMIRBridgeOptionLiteral@@A
?BRIDGE_SPEC_MICROSOFTEXCEL_IMPORT_DESCRIPTION@MBI_SEXCL@@2VTextInstance@1@A
?DOCUMENT_ID@MBI_SEXCL@@0VMIRString@@A
?ERR_FILE_ISADR@MBI_SEXCL@@2VMessageInstance_String@1@A
?ERR_FILE_NOT_FOUND@MBI_SEXCL@@2VMessageInstance_String@1@A
?PREFIX@MBI_SEXCL@@0VMIRString@@A
?browse@MIRMicrosoftExcelImportDllInterface@@UAEPAVMIRDirectoryStructure@@ABVMIRString@@0AAVMIROptionList@@AAVMIRLog@@@Z
?findTextLiteral@MBI_SEXCL@@SAPBVMIRTextLiteral@@ABVMIRString@@@Z
?getAllLiterals@MBI_SEXCL@@SAPAPBVMIRTextLiteral@@XZ
?getDocumentId@MBI_SEXCL@@MBEABVMIRString@@XZ
?getMappingSpecificationXmlFile@MIRMicrosoftExcelImportDllInterface@@UAE?AVMIRString@@XZ
?getMessage@MessageInstance_String@MBI_SEXCL@@QAE?AVMIRString@@ABV3@@Z
?getOptionList@MIRMicrosoftExcelImportDllInterface@@UAEXAAVMIROptionList@@@Z
?getSpecification@MIRMicrosoftExcelImportDllInterface@@UAEXABVMIRString@@AAVMIRBridgeSpecification@@@Z
?listAllLiterals@MBI_SEXCL@@MBEPAPAVMIRTextLiteral@@XZ
?log@MessageInstance_String@MBI_SEXCL@@QAEXAAVMIRLog@@ABVMIRString@@@Z
?run@MIRMicrosoftExcelImportDllInterface@@UAE_NABVMIRString@@AAVMIRFile@@AAVMIROptionList@@0AAVMIRLog@@@Z
?run@MIRMicrosoftExcelImportDllInterface@@UAE_NABVMIRString@@AAVMIRModel@@AAVMIROptionList@@0AAVMIRLog@@@Z
?test@MIRMicrosoftExcelImportDllInterface@@UAE_NABVMIRString@@AAVMIROptionList@@AAVMIRLog@@@Z
?textLiterals@MBI_SEXCL@@0PAPAVMIRTextLiteral@@A
?throwException@MessageInstance_String@MBI_SEXCL@@QAEXABVMIRString@@@Z
?toString@MessageInstance_String@MBI_SEXCL@@QAE?AVMIRString@@ABV3@@Z
?toString@TextInstance@MBI_SEXCL@@QAE?AVMIRString@@XZ
getMIRMicrosoftExcelImportInterface

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

298eaa18eeefeac2b489ed05b884683d

Headers

File Characteristics

Imports

mirmicrosoftexceladvancedimport

mirstd

mir

mirbridgelib

mirmodelbridge

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB