18565425607cbe01aa368799b7c513815c8aa2b1f01e343d1436559d7153946d

Sharing

Copy URL Twitter E-mail

General

Target

18565425607cbe01aa368799b7c513815c8aa2b1f01e343d1436559d7153946d
Size

2.5MB
MD5

714ceb6631d61f6878266a7215852550
SHA1

e11031ce6186067ce218202b187480e6b2086762
SHA256

18565425607cbe01aa368799b7c513815c8aa2b1f01e343d1436559d7153946d
SHA512

26eae0d3790cd8e80d5e1013a23ec12d51c1ee21ca2d3ddda5ec6767bcc39e244cddb0763c555a71a676e39b2840b632ce72f50a274fde0a1ec0cd60fea84a34
SSDEEP

49152:LpUtU7Xy6vH5u+zOhtl5y/wsDLc4OJqQWxLGlo33iiAK:qtUXyoI+zOtl5y/wsDLcRJqQWxLGlo3x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18565425607cbe01aa368799b7c513815c8aa2b1f01e343d1436559d7153946d

Files

18565425607cbe01aa368799b7c513815c8aa2b1f01e343d1436559d7153946d
.dll windows:6 windows x86 arch:x86

e6fc6c2d2d28a704fdfd4a2a9ec73b8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Users\tangrongkang251\Desktop\PosCode\SPOS\bin\ManageView.pdb

Imports

kernel32

TerminateProcess
GetModuleFileNameA
OutputDebugStringA
SizeofResource
LockResource
GetCurrentProcess
LoadResource
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreateDirectoryW
MoveFileExW
DeleteFileW
GetFileAttributesExW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
EnumSystemLocalesW
CloseHandle
GetTimeFormatW
GetDateFormatW
GetStdHandle
QueryPerformanceFrequency
HeapQueryInformation
GetCommandLineW
GetCommandLineA
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
lstrlenA
WritePrivateProfileStringA
ExitProcess
GetProcAddress
LoadLibraryA
WaitForSingleObject
WideCharToMultiByte
IsValidLocale
FreeLibrary
FindResourceW
EncodePointer
SetLastError
GetCurrentThreadId
GetSystemDirectoryW
FreeResource
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
LoadLibraryW
GlobalDeleteAtom
lstrcmpW
FindResourceA
GlobalAddAtomA
GlobalFindAtomA
GlobalGetAtomNameA
CompareStringA
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
LocalFree
MulDiv
FormatMessageA
CopyFileA
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThread
GetVersionExA
lstrcmpA
SetThreadPriority
ResumeThread
GetPrivateProfileIntA
GetPrivateProfileStringA
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
SetErrorMode
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
VirtualProtect
GetOEMCP
GetCPInfo
FileTimeToSystemTime
GetACP
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FlushFileBuffers
GetFileSize
GetFullPathNameA
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
lstrcmpiA
GetVolumeInformationA
FileTimeToLocalFileTime
GetFileAttributesA
GetFileAttributesExA
GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
lstrcpyA
GetCurrentDirectoryA
FindResourceExW
GetWindowsDirectoryA
VerSetConditionMask
VerifyVersionInfoA
GetTempPathA
GetTickCount
GetProfileIntA
SearchPathA
Sleep
GetTempFileNameA
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
SwitchToThread
CompareStringW
LCMapStringW
GetStringTypeW
RtlUnwind
InterlockedFlushSList
CreateFileW
GetFileType
MultiByteToWideChar

user32

UpdateWindow
SetActiveWindow
GetForegroundWindow
BeginPaint
EndPaint
ValidateRect
RedrawWindow
ScrollWindow
IsMenu
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetWindowTextLengthA
AdjustWindowRectEx
ScreenToClient
MapWindowPoints
EqualRect
GetClassLongA
GetClassNameA
GetTopWindow
GetLastActivePopup
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
LoadIconA
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpA
MonitorFromWindow
GetMonitorInfoA
ShowWindow
MoveWindow
CheckDlgButton
SendDlgItemMessageA
IsWindowEnabled
SetWindowTextA
IsDialogMessageA
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
GetMenuStringA
GetMenuState
InsertMenuA
AppendMenuA
RemoveMenu
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetDC
ClientToScreen
GetWindowThreadProcessId
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetKeyNameTextA
MapVirtualKeyA
SetRectEmpty
PostQuitMessage
GetMessageA
TranslateMessage
GetCursorPos
ShowOwnedPopups
SetCursor
InflateRect
IntersectRect
DestroyMenu
GetMenuItemInfoA
CopyImage
GetSysColorBrush
LoadCursorA
RealChildWindowFromPoint
GetAsyncKeyState
MapDialogRect
CharUpperA
TrackMouseEvent
DestroyIcon
LoadImageW
DeleteMenu
CreatePopupMenu
GetMenuDefaultItem
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
LoadImageA
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongA
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawEdge
DrawFrameControl
IsZoomed
LoadMenuW
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageA
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
CopyAcceleratorTableA
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
RegisterClipboardFormatA
CharUpperBuffA
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
PostMessageA
GetMessageTime
GetMessagePos
PeekMessageA
DispatchMessageA
RegisterWindowMessageA
EnableWindow
GetSysColor
CopyRect
GetWindowLongA
GetActiveWindow
InvalidateRect
LoadBitmapW
SendMessageA
GetClientRect
FillRect
ReleaseDC
GetWindowDC
GetWindowRect
SetRect
GetSystemMetrics
PtInRect
SystemParametersInfoA
GetWindow
GetDlgCtrlID
IsWindow
OffsetRect
SetWindowRgn
SetTimer
SetForegroundWindow
GetDesktopWindow
KillTimer
SetWindowLongA
MessageBoxA
GetParent
FrameRect
SetScrollPos
DrawStateA
UnregisterClassA
FindWindowA
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
LoadCursorW
IsChild

gdi32

GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetBkColor
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
GetObjectType
GetClipBox
MoveToEx
TextOutA
ExtTextOutA
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
CreateFontA
GetStockObject
CreateCompatibleDC
GetObjectA
StretchBlt
CreateSolidBrush
BitBlt
CreatePen
SelectObject
Rectangle
CreateRoundRectRgn
GetTextExtentPoint32A
CreateCompatibleBitmap
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
PatBlt
CombineRgn
CreateFontIndirectA
SetRectRgn
DPtoLP
GetTextMetricsA
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateRectRgn
CreatePatternBrush
CreateHatchBrush
GetDeviceCaps
CreateDCA
CopyMetaFileA
CreateBitmap
SetTextColor
GetTextFaceA
EnumFontFamiliesExA
CreatePalette
GetNearestPaletteIndex
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
LPtoDP
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
SetPixel
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries

winspool.drv

OpenPrinterA
ClosePrinter
EnumPrintersA
DocumentPropertiesA

shell32

SHAppBarMessage
DragFinish
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
SHBrowseForFolderA
DragQueryFileA

msimg32

AlphaBlend
TransparentBlt

comctl32

_TrackMouseEvent

shlwapi

StrFormatKBSizeA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathRemoveFileSpecW
PathIsUNCA

uxtheme

GetThemeSysColor
IsAppThemed
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
GetThemePartSize

iphlpapi

GetAdaptersInfo

libcrypto-1_1

EC_POINT_mul
BN_is_zero
BN_rand_range
EC_POINT_new
EC_GROUP_get0_order
EC_GROUP_new_by_curve_name
BN_CTX_get
BN_CTX_start
BN_CTX_secure_new
BN_mod_sub
BN_mod_mul
EC_POINT_add
BN_bn2binpad
EVP_sm4_ecb
EVP_sm4_cbc
EVP_sm4_cfb128
EC_POINT_get_affine_coordinates_GFp
BN_CTX_end
BN_CTX_free
EC_GROUP_free
EC_POINT_free
BN_CTX_new
EVP_MD_CTX_new
BN_bin2bn
EC_GROUP_get0_generator
EC_POINT_set_affine_coordinates_GFp
EVP_sm3
EVP_CIPHER_CTX_new
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_DigestFinal_ex
EVP_MD_CTX_free
BN_set_word
BN_mod_add
BN_add
BN_cmp
BN_mod_inverse
BN_mul
EVP_CIPHER_CTX_free
EVP_DecryptFinal_ex
EVP_DecryptUpdate
EVP_DecryptInit_ex
EVP_EncryptFinal_ex
EVP_EncryptUpdate
EVP_CIPHER_CTX_set_padding
EVP_EncryptInit_ex

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

gdiplus

GdiplusShutdown
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegEnumKeyA
RegQueryValueA
RegEnumValueA
RegEnumKeyExA

ole32

OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleCreateMenuDescriptor
OleGetClipboard
DoDragDrop
CoInitializeEx
CreateStreamOnHGlobal
CoDisconnectObject
CoInitialize
CoCreateInstance
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize

oleaut32

VarBstrFromDate
VariantCopy
LoadTypeLi
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringByteLen
SysFreeString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen

Exports

Exports

ShowCasherMngDlg
ShowConfigDlg
ShowMercInfoDlg
ShowVersionDlg

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 409KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 113KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e6fc6c2d2d28a704fdfd4a2a9ec73b8d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

shell32

msimg32

comctl32

shlwapi

uxtheme

iphlpapi

libcrypto-1_1

oleacc

gdiplus

imm32

winmm

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 409KB - Virtual size: 408KB

.data Size: 23KB - Virtual size: 54KB

.rsrc Size: 249KB - Virtual size: 248KB

.reloc Size: 145KB - Virtual size: 144KB

.rmnet Size: 113KB - Virtual size: 116KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 409KB - Virtual size: 408KB

.data
Size: 23KB - Virtual size: 54KB

.rsrc
Size: 249KB - Virtual size: 248KB

.reloc
Size: 145KB - Virtual size: 144KB

.rmnet
Size: 113KB - Virtual size: 116KB