492eb08cef70b8306ede74623d1eaf158489cd163f7c235497fdf2ed04e5e3fb

Sharing

Copy URL Twitter E-mail

General

Target

492eb08cef70b8306ede74623d1eaf158489cd163f7c235497fdf2ed04e5e3fb
Size

320KB
MD5

1ce52aaef7bd2b6559d39aa5f26358c1
SHA1

44fd16c6bcb17b98136e437c5bcb822653917777
SHA256

492eb08cef70b8306ede74623d1eaf158489cd163f7c235497fdf2ed04e5e3fb
SHA512

7c6f9b9ed3715428d0ac68bc9d14703f0fa4d6042a70874e301753ac5ecd4048352487659b3763e15c65597a78aa31be61d532dcad9a806b1f103ec369cc241e
SSDEEP

6144:O8sgzSvxhlY+7pRT0E9JX0Qp7XK+a4kdprKl:O8RSpJXHXK+a4tl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
492eb08cef70b8306ede74623d1eaf158489cd163f7c235497fdf2ed04e5e3fb

Files

492eb08cef70b8306ede74623d1eaf158489cd163f7c235497fdf2ed04e5e3fb
.dll windows:4 windows x86 arch:x86

c79fb778095bc13d3ff314afa7c58ed5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalReAlloc
GlobalAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
GetModuleFileNameA
lstrcpynA
MulDiv
lstrcmpA
GlobalFlags
SetLastError
GetLastError
SizeofResource
GetCurrentThread
GetProcessVersion
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
DuplicateHandle
GetCurrentProcess
CreateFileA
ReadFile
WriteFile
LeaveCriticalSection
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
MoveFileA
DeleteFileA
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
GetFileAttributesA
GetFileSize
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetFileType
RtlUnwind
GetSystemTime
GetLocalTime
SetLocalTime
GetCommandLineA
RaiseException
CreateThread
ExitThread
HeapSize
HeapReAlloc
ExitProcess
TerminateProcess
GetACP
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
IsBadWritePtr
SetStdHandle
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
SetConsoleCtrlHandler
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
CreateEventA
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
WaitForSingleObject
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalUnlock
GlobalFree
LockResource
FindResourceA
LoadResource
SetFilePointer
Sleep

user32

IsWindowVisible
EndDeferWindowPos
CopyRect
BeginDeferWindowPos
GetClientRect
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
GetFocus
DispatchMessageA
PeekMessageA
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
CharToOemA
OemToCharA
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetCursorPos
ValidateRect
TranslateMessage
GetMessageA
UnregisterClassA
GetClassNameA
PtInRect
ClientToScreen
GetDesktopWindow
ReleaseDC
GetDialogBaseUnits
GetDC
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
PostQuitMessage
LoadCursorA
GetSysColorBrush
DestroyMenu
LoadStringA
ShowOwnedPopups
SetCursor
InsertMenuA
DeleteMenu
GetMenuStringA
CharUpperA
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
GetKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
GetSystemMetrics
CreateDialogIndirectParamA
SendMessageA
GetParent
SetFocus
IsWindowEnabled
ShowWindow
SetWindowPos
MoveWindow
SetWindowLongA
GetDlgCtrlID
GetWindowTextA
SetWindowTextA
GetWindowLongA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItemInt
GetDlgItem
DestroyWindow
UpdateWindow
SetDlgItemTextA
FindWindowA
MessageBoxA
wsprintfA
CheckRadioButton
CheckDlgButton
EnableWindow
RegisterWindowMessageA
GetWindowTextLengthA

reader

ord1
ord2
ord20
ord33
ord34
ord23
ord24
ord25
ord28
ord19
ord12
ord16
ord13
ord22
ord21
ord10
ord17
ord7
ord4
ord30
ord5
ord31
ord29
ord18
ord3
ord6

sha

SHA

csinit

csVerifyHCDC
csConnectDC
csDisconnectDC
st1

comctl32

ord17

gdi32

GetTextMetricsA
SelectObject
CreateFontIndirectA
GetDeviceCaps
GetStockObject
DeleteDC
StartDocA
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
GetTextExtentPoint32A
DeleteObject
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
CreatePen
ExcludeClipRect
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
OffsetClipRgn
GetDCOrgEx
IntersectClipRect

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA

advapi32

RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA

shell32

SHGetFileInfoA
DragAcceptFiles

Exports

Exports

HCA_GNFuncCall
WriteReaderDate
csCloseCom
csDisableHCPIN
csDownloadHCApplet
csGetCardNo
csGetDateTime
csGetHOSPID
csISSetPIN
csInputHCPIN
csOpenCom
csUnGetSeqNumber
csUpdateHCContents
csUpdateHCNoReset
csUploadData
csVerifyHCPIN
csVerifySAMDC
hisDeletePredeliveryData
hisGetBasicData
hisGetCardStatus
hisGetCriticalIllness
hisGetCumulativeData
hisGetCumulativeFee
hisGetEmergentTel
hisGetInoculateData
hisGetInsurerData
hisGetLastSeqNum
hisGetOrganDonate
hisGetRegisterBasic
hisGetRegisterBasic2
hisGetRegisterPregnant
hisGetRegisterPrevent
hisGetSam0
hisGetSeqNumber
hisGetSeqNumber256
hisGetTreatmentNeedHPC
hisGetTreatmentNoNeedHPC
hisReadPrescriptAllergic
hisReadPrescriptHVE
hisReadPrescriptLongTerm
hisReadPrescriptMain
hisReadPrescription
hisWriteAllergicMedicines
hisWriteAllergicNum
hisWriteEmergentTel
hisWriteHealthInsurance
hisWriteInoculateData
hisWriteMultiPrescript
hisWriteNewBorn
hisWriteOrganDonate
hisWritePredeliveryCheckup
hisWritePrescription
hisWriteTreatmentCode
hisWriteTreatmentData
hisWriteTreatmentFee
hpcGetAllData
hpcGetHPCCNAME
hpcGetHPCENAME
hpcGetHPCSN
hpcGetHPCSSN
hpcGetHPCStatus
hpcInputHPCPIN
hpcUnlockHPC
hpcVerifyHPCPIN

Sections

.text
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c79fb778095bc13d3ff314afa7c58ed5

Headers

File Characteristics

Imports

kernel32

user32

reader

sha

csinit

comctl32

gdi32

winspool.drv

comdlg32

advapi32

shell32

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 233KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 20KB - Virtual size: 646KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 236KB - Virtual size: 233KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 20KB - Virtual size: 646KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 20KB - Virtual size: 17KB