3b892a9e001a62bae5e9fa7acdedd5af

Sharing

Copy URL Twitter E-mail

General

Target

3b892a9e001a62bae5e9fa7acdedd5af
Size

378KB
MD5

3b892a9e001a62bae5e9fa7acdedd5af
SHA1

ddafc641efb521c4af7f9faab7ac521750543b74
SHA256

407b7862833405935b624fdf230505511d60b95c7c116e07a72b2eb628ed45f9
SHA512

231bd98d4f02f74f78537ac3862e7888fb5d02deabce1fc7c3e202ff86ccd8af160a38bfc84ad672bd555c6a6fb760d556ccfa25d053b45d4ac3b989ea4c1cdf
SSDEEP

6144:GPpUU1w8bltvqXLokLc7+nN7DEfEGvX11fEbTfE9:QpUUu02b/c7+nN7DCvX1o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b892a9e001a62bae5e9fa7acdedd5af

Files

3b892a9e001a62bae5e9fa7acdedd5af
.exe windows:1 windows x86 arch:x86

834cdc7a6af17d5a5485d5cc2f950fca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

bfiles

$DELOPTS
$DELOPTS::Used
$DTrade
$DTrade::Used
$Dunits
$Dunits::Used
$ePrintForm
$eRptFields
$Glo:BillingFile
$Glo:BoatDocs
$Glo:BOptionsFile
$Glo:bOrderFile
$Glo:CNotesFile
$Glo:CommissionFile
$Glo:ConsignFile
$Glo:CustBFile
$Glo:CustDocs
$Glo:CustFile
$Glo:CustLocation
$Glo:CustPFile
$Glo:ERptFld
$GLO:ERptNam
$GLO:EventFileName
$Glo:FeaturesFile
$Glo:FloorFile
$Glo:HMemoFile
$Glo:HulDocs
$Glo:HullFile
$Glo:HulPics
$Glo:Insurahfile
$Glo:InsurCoFile
$Glo:LendorsFile
$Glo:MajorUnitLocation
$Glo:MakesFile
$Glo:ModelsFile
$Glo:MotorFile
$Glo:MtNamesFile
$Glo:MultiPath
$Glo:OlistFile
$Glo:OptionsFile
$Glo:PackageFile
$Glo:PlanFile
$Glo:Popadfile
$Glo:PorderFile
$Glo:PorderItemFile
$Glo:PrintFormFile
$Glo:ProductsFile
$Glo:RepairsFile
$Glo:ReportFieldsFile
$Glo:SavePath
$Glo:SecondStockLocation
$Glo:sFeturesFile
$Glo:ShellFile
$Glo:sHullFile
$Glo:sOptionsFile
$Glo:SpecOptsFile
$Glo:SpecUnitFile
$Glo:SpersonFile
$Glo:StkAdjFile
$Glo:StockFile
$Glo:TrailerFile
$Glo:TypeFile
$Glo:UnitsFile
$Glo:UsedFile
$Glo:wLabor
$Glo:wSublet
$Glo:wWarranty
$Glo:wWonotes
$Glo:wWorder
$Glo:wWsales
$GlobalRequest
$GlobalResponse
$HULL
$HULL::Used
$LENDORS
$LENDORS::Used
$MASTER
$MASTER::Used
$PrintForm
$PrintForm::Used
$RptFields
$RptFields::Used
$SETUP
$SETUP::Used
$Shell
$Shell::Used
$VCRRequest
DELOPTS$DEL:RECORD
DELOPTS$TYPE$DEL:RECORD
DTrade$DTR:DEAL_KEY
DTrade$DTR:RECORD
DTrade$TYPE$DTR:RECORD
Dunits$DUN:Deal_Key
Dunits$DUN:RECORD
Dunits$TYPE$DUN:RECORD
ePrintForm$ePRI:RECORD
ePrintForm$TYPE$ePRI:RECORD
eRptFields$eRF:RECORD
eRptFields$TYPE$eRF:RECORD
HULL$HUL:RECORD
HULL$HUL:STOCK
HULL$TYPE$HUL:RECORD
LENDORS$LEN:RECORD
LENDORS$TYPE$LEN:RECORD
MASTER$MAS:RECORD
MASTER$TYPE$MAS:RECORD
PrintForm$PRI:Desc_Key
PrintForm$PRI:RECORD
PrintForm$PRI:SysID_Key
PrintForm$TYPE$PRI:RECORD
RptFields$RF:Fields_Key
RptFields$RF:RECORD
RptFields$RF:UserEdit_Key
RptFields$RF:UserRpt_Key
RptFields$TYPE$RF:RECORD
SETUP$SET:RECORD
SETUP$TYPE$SET:RECORD
Shell$She:RECORD
Shell$She:SysID_Key
Shell$TYPE$She:RECORD

c60ascx

ASCII

c60clax

CLARION

c60dosx

DOS

c60runx

Cla$ACCEPTED
Cla$ADDqueue
Cla$ADDqueuekey
Cla$ADDqueueptr
Cla$ASK
Cla$BEEP
Cla$BindG
Cla$BindV
Cla$BLANK
Cla$BOX
Cla$CHOICE
Cla$CLEAR
Cla$CLEARqueue
Cla$clearstr
Cla$CLOCK
Cla$CLOSEwindow
Cla$code
Cla$comparestr
Cla$CREATE
Cla$DATE
Cla$DAY
Cla$DecAdd
Cla$DecDistinct
Cla$DecDistinctR
Cla$DecDivide
Cla$DecMul
Cla$DecSub
Cla$DecSubR
Cla$DeepAssign
Cla$DELETEqueue
Cla$DESTROY
Cla$DIRECTORY
Cla$DISABLE
Cla$DISPLAY
Cla$DISPOSEqueue
Cla$DISPOSEvref
Cla$DPopLong
Cla$DPopReal
Cla$DPushDec
Cla$DPushLong
Cla$DStack2Stack
Cla$ENABLE
Cla$EndEventLoop
Cla$EndEventLoops
Cla$ENDPAGE
Cla$ERRORCODE
Cla$Evaluate
Cla$EVENT
Cla$FIELD
Cla$FILEERRORCODE
Cla$FILEERRORMSG
Cla$FILE_ADDf
Cla$FILE_BUILDf
Cla$FILE_BYTES
Cla$FILE_CLOSE
Cla$FILE_CREATE
Cla$FILE_DELETE
CLA$FILE_DESTROY
Cla$FILE_DUPLICATEk
Cla$FILE_FLUSH
Cla$FILE_GETfk
Cla$FILE_GETfl
Cla$FILE_GET_PROPERTY
Cla$FILE_NAME
Cla$FILE_NEXT
Cla$FILE_OPEN
Cla$FILE_POSITIONf
Cla$FILE_POSITIONk
Cla$FILE_PREV
Cla$FILE_PUTf
Cla$FILE_RECORDSf
Cla$FILE_REGETf
Cla$FILE_REGETk
Cla$FILE_RESETf
Cla$FILE_RESETk
Cla$FILE_SEND
Cla$FILE_SETf
Cla$FILE_SETk
Cla$FILE_SETkk
Cla$FILE_SET_PROPERTY
Cla$FILE_STREAM
Cla$FILE_WATCH
Cla$FIRSTFIELD
Cla$FOCUS
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$FreeUfo
Cla$freewindow
Cla$GETINI
Cla$GETPOSITION
Cla$GetPropS
Cla$GETqueuekey
Cla$GETqueueptr
Cla$Group2Ufo
Cla$HALT
Cla$init
Cla$KEYBOARD
Cla$KEYCHAR
Cla$KEYCODE
Cla$LASTFIELD
Cla$LINE
Cla$loaddec
Cla$Locale
Cla$longtostr
Cla$Mem2Ufo
Cla$MessageBox
Cla$modulus
Cla$MONTH
Cla$NewCriticalSection
Cla$NewMemB
Cla$NewMemT
Cla$NEWqueue
Cla$OPENwindow
Cla$paopen
Cla$PENCOLOR
Cla$pmopen
Cla$PopBind
Cla$PopCString
Cla$PopReal
Cla$PopString
Cla$PopTemp
Cla$POPUP
Cla$POST
Cla$PRESSKEY
Cla$PRINTreport
Cla$propen
Cla$PushBind
Cla$PushCString
Cla$PushLong
Cla$PushPictDec
Cla$PushPictLong
Cla$PushString
Cla$PushUfo
Cla$PUTINI
Cla$PUTqueue
Cla$pwopen
Cla$RECORDSqueue
Cla$ROLLBACK
Cla$rterr
Cla$SELECT
Cla$SELECTED
Cla$SETCURSOR
Cla$SETFONT
Cla$SETKEYCODE
Cla$SETPATH
Cla$SETPENCOLOR
Cla$SETPENWIDTH
Cla$SETPOSITION
Cla$SetPropF
Cla$SetPropS
Cla$SetPropV
Cla$SETTARGET
Cla$SHORTPATH
Cla$SHOW
Cla$SizeUfo
Cla$SORTqueuekey
Cla$Stack2DStack
Cla$StackCLIP
Cla$StackCompare
Cla$StackCompareN
Cla$StackCompareNEQ
Cla$StackConcat
Cla$StackConcatR
Cla$StackErrstr
Cla$StackFORMAT2
Cla$StackHeap
Cla$StackINSTRING
Cla$StackLEFT
Cla$StackLen
Cla$StackLOWER
Cla$STACKpop
Cla$StackPRESS
Cla$StackRIGHT
Cla$StackRotate
Cla$StackSUB
Cla$StackUPPER
Cla$START
Cla$StartEventLoop
Cla$StashBP
Cla$storecstr
Cla$storestr
Cla$THREAD
Cla$THREAD_FILE
Cla$TODAY
Cla$Ufo2Real
Cla$UNHIDE
Cla$UPDATE
Cla$VIEW_SETvl
Cla$WHATqueue
Cla$YEAR
Cla$YIELD
THR$GetInstance
VIEWDRIVER
Wsl$CloseDown
_exit
_free
_longjmp
_malloc
_memcpy
_setjmp
__sysinit
__sysstart

c60tpsx

TOPSPEED

cpc63p32

ASSGNPGOFPG
HANDLECOPIES
PRINTPREVIEW
SUPPORTED

ctsqw10c63

$CTSQWTRN
$TCQW:FileName
QWINIT@FOsbOsbllllRg
QWTRANSLATESTRING@Fsb
TC_SETQWDISPLAYTEXT@Flsb

ctsrw10c63

$CTSRWTRN
REPWIZINIT@FOsbOsbOlllRgRg

ctssw10c63

$CTSSWTRN
SSWIZINIT@FOsbOsbOlllRg

ctsvw10c63

$CTSVWTRN
VIEWWIZINIT@FOsbOsblllRg
VIEWWIZSETROWCOLORGROUP@FRgOl

kernel32

SleepEx

user32

keybd_event
SystemParametersInfoA

we60x

ds_SetEndSessionHandler
ds_SetOkToEndSessionHandler
ds_VisibleOnDesktop
WinAlert

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cwtls
Size: 1KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

834cdc7a6af17d5a5485d5cc2f950fca

Headers

File Characteristics

Imports

bfiles

c60ascx

c60clax

c60dosx

c60runx

c60tpsx

cpc63p32

ctsqw10c63

ctsrw10c63

ctssw10c63

ctsvw10c63

kernel32

user32

we60x

Sections

.text Size: 136KB - Virtual size: 136KB

.data Size: 34KB - Virtual size: 41KB

.cwtls Size: 1KB - Virtual size: 78KB

.idata Size: 10KB - Virtual size: 10KB

.rsrc Size: 175KB - Virtual size: 174KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 136KB - Virtual size: 136KB

.data
Size: 34KB - Virtual size: 41KB

.cwtls
Size: 1KB - Virtual size: 78KB

.idata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 175KB - Virtual size: 174KB

.reloc
Size: 19KB - Virtual size: 18KB