3b69e895bb4cf2dd31c869bce449dbeddf0f1fb9155aa938b35c1204afdc2065

Sharing

Copy URL Twitter E-mail

General

Target

3b69e895bb4cf2dd31c869bce449dbeddf0f1fb9155aa938b35c1204afdc2065
Size

1012KB
MD5

940d3d2cc0ef81324a5bc8aa50fac745
SHA1

4a066a3b44a5a691ba65b7b4afed2be32956fbc8
SHA256

3b69e895bb4cf2dd31c869bce449dbeddf0f1fb9155aa938b35c1204afdc2065
SHA512

7b9f1d13ee16d8817440e193c1e53aa001b2e06e877aeb921b628b5142114fceb07c3eff90dc924d31ece7e8ee521be1b77f0f041497cb3668e710809566700c
SSDEEP

12288:AqjTYNNs3xLTcjh6m/Pjv0YNOOz4ZtHI2o06ZhG9sGRiMa:AqjTYNGLTcl6mHb0YNOy4Loi6Zh2pa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b69e895bb4cf2dd31c869bce449dbeddf0f1fb9155aa938b35c1204afdc2065

Files

3b69e895bb4cf2dd31c869bce449dbeddf0f1fb9155aa938b35c1204afdc2065
.exe windows:4 windows x86 arch:x86

c6205ac7e91454d9c4c19a4ebc3ef8cc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

plotter

_HP11PlotFile@20
_HP11CombinationFile@36
_HP11SplitFile@32
_HP11StackFile@32
_SetCutParameter@4
_SetPlotterParameter@4
_SetCallback@20
_GetPlottermodel@0
_GetPenCutParameter@4
_SetPenCutParameter@4
_SetComPar@8
_WritePlotParameter@4
_ConnectPlotter@4
_GetSizeY@0
_GetCurrPlotTime@0
_GetTotalLine@0
_GetCurrPlotLine@0
_GetPlotStat@0
_SetPlotterFont@4
_SetMergeSort@4
_ReadPlotParameter@4
_ReadPosHeadstart@0
_setZMOT_Forward_Time@4
_StopPlot@4
_SetPlotterConnectType@4
_ChangePlotterIPAddress@20
_SetPlotterIPAddress@12
_SetAutoPlotterType@4
_SetPlotterType@4
_SetPlotterHead@4
_SetPlotterType1@4
_SetRoate@4
_GetSizeX@0
_GetPlotterParameter@4
_SetHP11InkInterFlag@4
_SetDPI@4

mfc71

ord784
ord1084
ord3210
ord1934
ord2368
ord3287
ord1280
ord3204
ord3161
ord1279
ord5637
ord2367
ord1903
ord1308
ord2176
ord2527
ord5611
ord6060
ord5608
ord6054
ord4161
ord6057
ord6037
ord5727
ord5642
ord5647
ord5523
ord5588
ord5414
ord5401
ord5921
ord5719
ord3180
ord602
ord2264
ord6062
ord5888
ord347
ord5396
ord3255
ord2131
ord5676
ord3254
ord443
ord676
ord1192
ord1160
ord6120
ord709
ord501
ord4951
ord4908
ord5759
ord3348
ord5985
ord4001
ord4123
ord4164
ord4035
ord5731
ord1917
ord1452
ord6310
ord744
ord5097
ord556
ord2346
ord265
ord1294
ord1188
ord5189
ord3350
ord5987
ord713
ord1966
ord510
ord2034
ord508
ord1564
ord416
ord5641
ord502
ord326
ord5833
ord5622
ord5976
ord1340
ord458
ord734
ord1977
ord2907
ord6292
ord546
ord2011
ord1291
ord457
ord1580
ord5331
ord6297
ord5320
ord6286
ord6208
ord6180
ord6174
ord3997
ord4108
ord2272
ord4048
ord5326
ord667
ord433
ord2787
ord3916
ord5448
ord5442
ord1425
ord760
ord755
ord1092
ord564
ord3635
ord4400
ord2853
ord4481
ord3169
ord468
ord694
ord5377
ord3952
ord5531
ord6006
ord5715
ord745
ord557
ord1489
ord299
ord2933
ord2451
ord3864
ord4125
ord758
ord567
ord630
ord3088
ord2021
ord385
ord1614
ord5946
ord3908
ord2475
ord1066
ord1565
ord651
ord4320
ord5807
ord876
ord785
ord4109
ord4541
ord3683
ord757
ord723
ord2248
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2838
ord3333
ord566
ord5975
ord1054
ord3830
ord6281
ord6065
ord6283
ord3605
ord5716
ord1091
ord4100
ord2094
ord3244
ord1955
ord1283
ord2371
ord1063
ord3057
ord1544
ord5491
ord3182
ord531
ord1003
ord5445
ord4749
ord5529
ord2657
ord5459
ord5490
ord2938
ord1486
ord4085
ord629
ord1439
ord6144
ord5437
ord3079
ord3989
ord3038
ord3056
ord4081
ord2910
ord631
ord1440
ord2280
ord386
ord2325
ord1024
ord5497
ord3077
ord442
ord675
ord3302
ord5323
ord5625
ord5089
ord384
ord908
ord6168
ord1550
ord3178
ord599
ord6042
ord3686
ord1230
ord782
ord783
ord3337
ord589
ord6282
ord330
ord5613
ord3572
ord5231
ord4655
ord5666
ord5366
ord1495
ord4289
ord4166
ord4745
ord4866
ord5650
ord5363
ord1450
ord926
ord549
ord737
ord4813
ord4248
ord4353
ord3584
ord6014
ord3929
ord5355
ord3987
ord1912
ord2081
ord2077
ord2039
ord1352
ord5145
ord6269
ord5202
ord5161
ord1962
ord2160
ord3163
ord4385
ord2942
ord4380
ord4118
ord2075
ord2719
ord2234
ord4115
ord1043
ord1716
ord3591
ord5705
ord3466
ord3423
ord3286
ord1635
ord1543
ord3157
ord583
ord1930
ord3401
ord5644
ord5640
ord3503
ord590
ord4157
ord4155
ord1286
ord4156
ord1053
ord4095
ord2852
ord467
ord5273
ord3764
ord4201
ord3696
ord1161
ord1929
ord584
ord1970
ord1434
ord317
ord432
ord298
ord1971
ord2477
ord865
ord300
ord4888
ord2292
ord3944
ord2305
ord3891
ord2003
ord2668
ord2263
ord362
ord3499
ord1470
ord6237
ord2478
ord2479
ord4634
ord1346
ord1728
ord2553
ord3085
ord6081
ord2665
ord6107
ord610
ord2079
ord2790
ord1384
ord6136
ord2004
ord1153
ord1657
ord3653
ord3654
ord3500
ord3514
ord5714
ord2246
ord1913
ord2615
ord5009
ord5012
ord4309
ord4135
ord2939
ord4904
ord943
ord5356
ord2992
ord2425
ord2424
ord4019
ord1557
ord3945
ord5148
ord5205
ord2173
ord1306
ord4277
ord4265
ord635
ord4342
ord3694
ord3757
ord1604
ord1914
ord4310
ord4021
ord5169
ord4345
ord2002
ord2666
ord3505
ord4194
ord2430
ord1029
ord6239
ord4267
ord1028
ord4284
ord3982
ord4168
ord2936
ord4646
ord4676
ord4659
ord1169
ord3548
ord5368
ord4692
ord1071
ord722
ord530
ord431
ord1905
ord1122
ord1199
ord1096
ord4196
ord1343
ord5713
ord5010
ord2940
ord4020
ord1904
ord5168
ord430
ord1140
ord1124
ord1459
ord3788
ord4952
ord866
ord3233
ord423
ord660
ord4063
ord5466
ord2882
ord2873
ord2375
ord361
ord609
ord4929
ord4339
ord305
ord4296
ord3651
ord3489
ord5658
ord1641
ord1571
ord4238
ord658
ord2370
ord6290
ord5324
ord5866
ord3879
ord5873
ord2866
ord3637
ord3432
ord595
ord336
ord1108
ord3444
ord2277
ord5477
ord5450
ord3851
ord5725
ord1647
ord1589
ord3315
ord739

msvcr71

??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
__security_error_handler
memset
_strdup
_ltoa
_itoa
vsprintf
_mbscmp
_mbsnbcmp
_c_exit
_exit
_ismbblead
_purecall
_mbschr
_gcvt
rename
_CIasin
memmove
isdigit
strstr
strncpy
fopen
fwrite
fclose
floor
ceil
atol
atof
sprintf
_time64
strtoul
_localtime64
strftime
_mbstok
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
atoi
__CxxFrameHandler
_except_handler3
_resetstkoflw
free
malloc
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_XcptFilter
_ultoa
wcslen
_setmbcp
_controlfp

kernel32

GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
IsBadWritePtr
ExitProcess
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FindNextFileA
FindFirstFileA
lstrcpyA
MulDiv
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalSize
lstrcmpA
GetProfileStringA
WriteProfileStringA
FreeLibrary
CloseHandle
ReleaseMutex
LoadLibraryA
CreateMutexA
EnterCriticalSection
Process32Next
Process32First
CreateToolhelp32Snapshot
ReadFile
GetFileSize
CreateFileA
WriteFile
DeleteFileA
WritePrivateProfileStringA
CreateDirectoryA
CopyFileA
SetFileAttributesA
FileTimeToSystemTime
GetFileTime
WaitForSingleObject
GetSystemDefaultLangID
GetExitCodeThread
lstrcpynA
LocalAlloc
FormatMessageA
InterlockedDecrement
GlobalFree
GlobalAlloc
LockResource
SizeofResource
LoadResource
FindResourceA
GetTickCount
GetCurrentThreadId
EnumCalendarInfoA
lstrlenA
FindClose
GetModuleFileNameA
Sleep
LeaveCriticalSection
GetFileAttributesA
LocalFree
GetProcAddress
GetModuleHandleA

user32

GetMessageA
CallWindowProcA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetMessagePos
GetWindowLongA
SetWindowLongA
LockWindowUpdate
LoadBitmapA
PeekMessageA
TranslateMessage
DispatchMessageA
GetDCEx
TranslateMDISysAccel
TranslateAcceleratorA
GetDlgCtrlID
GetDesktopWindow
GetSystemMenu
DestroyIcon
GetIconInfo
CreateIconIndirect
DrawFocusRect
DrawFrameControl
FrameRect
EqualRect
UnionRect
SetRectEmpty
DrawStateA
SetParent
IsChild
WindowFromPoint
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
BringWindowToTop
RegisterWindowMessageA
GetActiveWindow
GetMenuState
SetFocus
GetAsyncKeyState
CheckMenuItem
ShowWindow
MoveWindow
RegisterClipboardFormatA
GetKeyboardState
GetClassNameA
GetDoubleClickTime
ChildWindowFromPointEx
LoadStringA
GetDlgItem
GetWindow
EnableWindow
SendMessageA
MessageBoxA
PtInRect
SetRect
InflateRect
OffsetRect
IntersectRect
FillRect
InvertRect
DrawEdge
PostMessageA
GetClientRect
ScreenToClient
GetDC
ReleaseDC
IsWindowVisible
ClientToScreen
IsRectEmpty
CopyRect
GetSystemMetrics
LoadIconA
RedrawWindow
UpdateWindow
GetWindowDC
GetWindowRect
IsIconic
GetMenu
ModifyMenuA
GetSubMenu
GetMenuItemID
GetMenuItemCount
AppendMenuA
DeleteMenu
CreatePopupMenu
DrawIcon
FindWindowA
wsprintfA
SystemParametersInfoA
ReleaseCapture
ClipCursor
GetCursorPos
IsClipboardFormatAvailable
SetCursor
GetSysColor
GetKeyState
IsWindow
GetClassInfoA
DefWindowProcA
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetParent
GetFocus
SetCapture
GetCapture
KillTimer
SetTimer
InvalidateRect

gdi32

DPtoLP
GetMapMode
GetBkColor
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
CreateFontA
CreateSolidBrush
CreatePalette
RealizePalette
Ellipse
CreateDIBitmap
GetCharWidthA
CreatePatternBrush
CreateBitmap
LPtoDP
GetPixel
SetPixelV
SetBkMode
SetPixel
LineTo
MoveToEx
SetTextColor
ExtCreatePen
Rectangle
BitBlt
GetTextExtentPoint32A
GetTextMetricsA
CreateRectRgnIndirect
GetStockObject
CreateDIBSection
StretchBlt
GetDIBColorTable
SetDIBColorTable
SelectObject
DeleteDC
DeleteObject
Escape
ExtTextOutA
StartDocA
StartPage
EndPage
AbortDoc
EndDoc
TextOutA
RectVisible
PtVisible
CreatePen
Polygon
GetCurrentObject
CreateFontIndirectA

msimg32

TransparentBlt
AlphaBlend

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegQueryValueExA

shell32

Shell_NotifyIconA
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteExA

comctl32

ImageList_Add
ImageList_BeginDrag
ImageList_ReplaceIcon
ImageList_GetImageCount
ord17
ImageList_GetImageInfo
ImageList_Draw
ImageList_AddMasked
ImageList_EndDrag
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_DragLeave
ImageList_GetIcon
ImageList_SetBkColor

ole32

OleUninitialize
CoUninitialize
OleRun
OleInitialize
CoCreateInstance
CoInitialize

oleaut32

SysStringByteLen
VarBstrFromDate
VariantInit
SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantTimeToSystemTime
VarDateFromStr
VariantClear
VariantCopy
VarUdateFromDate
SystemTimeToVariantTime
SysFreeString
GetErrorInfo

ws2_32

listen
shutdown

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipFree
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipAlloc
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipCloneImage
GdipCreateBitmapFromScan0
GdipGetImageHeight

msvcp71

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 744KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6205ac7e91454d9c4c19a4ebc3ef8cc

Headers

File Characteristics

Imports

plotter

mfc71

msvcr71

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

ole32

oleaut32

ws2_32

gdiplus

msvcp71

Sections

.text Size: 744KB - Virtual size: 740KB

.rdata Size: 108KB - Virtual size: 105KB

.data Size: 4KB - Virtual size: 22KB

.rsrc Size: 152KB - Virtual size: 149KB

.text
Size: 744KB - Virtual size: 740KB

.rdata
Size: 108KB - Virtual size: 105KB

.data
Size: 4KB - Virtual size: 22KB

.rsrc
Size: 152KB - Virtual size: 149KB