17b513cb9b15ceaf933c23ba8f6cd4c58ffa4e6933527409029c78f188e0970a

Sharing

Copy URL

Twitter E-mail

General

Target

17b513cb9b15ceaf933c23ba8f6cd4c58ffa4e6933527409029c78f188e0970a
Size

901KB
MD5

2beda704bdd8588db278053ef17022ef
SHA1

18994df2a7834428a9d047fff7dee8295b5997a6
SHA256

17b513cb9b15ceaf933c23ba8f6cd4c58ffa4e6933527409029c78f188e0970a
SHA512

7453cdc0d448f6c3ca97dd479fe09ea5094b94d080e907708dc99acbecf04c0077235bc497e6801acc110c24f739dace7fddfbd8fd716e5d3706f3860e6c72f8
SSDEEP

24576:w04TtH1uwV81tHL0ADxmvJCLr0MWS9H6KrsFoNenp:Y81tHD8sL2S93sFoNenp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17b513cb9b15ceaf933c23ba8f6cd4c58ffa4e6933527409029c78f188e0970a

Files

17b513cb9b15ceaf933c23ba8f6cd4c58ffa4e6933527409029c78f188e0970a
.dll windows:6 windows x86 arch:x86

06e2f9409f961c05d73d44eee4f777fe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\GIGE_VC\千兆网扫描式 2021-09-24-自适应分辨率\Release\BetterPrinter.pdb

Imports

kernel32

GetFileSize
DeleteFileA
SetFilePointer
WriteFile
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
MultiByteToWideChar
WideCharToMultiByte
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
ReadFile
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
CreateFileA
DecodePointer
GetModuleHandleA
Sleep
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
SetEndOfFile
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
WritePrivateProfileStringA
GetTickCount
GetLocalTime
GetPrivateProfileStringA
GetModuleFileNameA
FindNextFileW
FindFirstFileExW
FindClose
GetConsoleCP
FlushFileBuffers
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetLastError
CreateEventA
HeapAlloc
CloseHandle
EncodePointer
EnterCriticalSection
LeaveCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetFileAttributesExW
SetFilePointerEx
WriteConsoleW

user32

RegisterDeviceNotificationA
GetMessageA
PostThreadMessageA
CreateWindowExA
RegisterClassA
DefWindowProcA
TranslateMessage
DispatchMessageA

driveinface

DestroyDeviceObject
CreateDeviceObject

eclosionproc

CreateObject_PRINTECLOSIONVIRTUAL
DeleteObject_PRINTECLOSIONVIRTUAL

qrcodeencode

?QRCodeGetStr@@YA_NPADII@Z
?QRCodeEncodeFree@@YAXPAUEncodeInof@@@Z
?QRCodeEncodePrnData@@YA_NPAUEncodeInof@@HHU_YCDZ_PRN_IMAGE_INFO@@PAE@Z
?QRCodeEncodeReadPrnFile@@YA_NPAPAEPAU_YCDZ_PRN_IMAGE_INFO@@PBD@Z
?QRCodeGetStrCount@@YAIPAUEncodeInof@@@Z

zlib

uncompress
compress

language

?GetLanguageString@@YAPBDPBD@Z

actionexecution

?AE_CleanInitParam@@YAXAAUBP_CLEAN_PARAM@@@Z
?AE_PrintWorkRead@@YAPAV?$vector@UtagBP_PRINTER_WORK@@V?$allocator@UtagBP_PRINTER_WORK@@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?AE_CleanRead@@YAPBUBP_CLEAN_PARAM@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

Exports

Exports

bpAddInkPause
bpAddInkStart
bpAddInkStop
bpBackupCfgPara
bpCleanContinue
bpCleanPause
bpCleanStart
bpCleanStop
bpClose
bpCloseAll
bpDampness
bpFlash
bpGetActionStatus
bpGetActionStop
bpGetBoardRunState
bpGetBoardTestState
bpGetCommPort
bpGetDevice
bpGetDeviceCount
bpGetErrorInfo
bpGetFlashId
bpGetFunctionStatus
bpGetHbInfor
bpGetKeyEvent
bpGetMB24vOut
bpGetMbInfor
bpGetMotorState
bpGetPrintImagePara
bpGetPrintImageStatus
bpGetTryInfo
bpGetXPos
bpGetYPos
bpGetZPos
bpHBGetIOState
bpInit
bpIsValid
bpMB24vOut
bpMBGetIOState
bpMotorMove
bpMotorStop
bpOpen
bpOpenAll
bpPrintContinue
bpPrintPause
bpPrintSendTask
bpPrintStart
bpPrintStop
bpReInitStart
bpReInitStop
bpReadCfgPara
bpReadRegMulData
bpReadUint
bpReadUint16
bpRestoreCfgPara
bpSaveCfgPara
bpSendImage
bpSetBoardTestEn
bpSetErrorInfoVaule
bpSetKeyEvent
bpSetPrnImageData
bpSetTryInfoVaule
bpSetWave
bpSetXMotoCodeGear
bpSpiFlash
bpStopSpiFlash
bpWriteRegMulData
bpWriteUint
bpWriteUint16
bpXMotorGearRate
bpXMotorMoveToLeft
bpXMotorMoveToRight
bpXMotorReset
bpYMotorGearRate
bpYMotorMoveToBack
bpYMotorMoveToHead
bpYMotorReset
bpZAltimetry
bpZMotorGearRate
bpZMotorMoveToDown
bpZMotorMoveToUp
bpZMotorReset

Sections

.text
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 163KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06e2f9409f961c05d73d44eee4f777fe

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

driveinface

eclosionproc

qrcodeencode

zlib

language

actionexecution

Exports

Exports

Sections

.text Size: 585KB - Virtual size: 584KB

.rdata Size: 121KB - Virtual size: 121KB

.data Size: 163KB - Virtual size: 3.1MB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 585KB - Virtual size: 584KB

.rdata
Size: 121KB - Virtual size: 121KB

.data
Size: 163KB - Virtual size: 3.1MB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 29KB - Virtual size: 28KB