be198863a492f22cf88e6ceb0ae0af76262be466824353c6ad4be38697e8a386

Sharing

Copy URL Twitter E-mail

General

Target

be198863a492f22cf88e6ceb0ae0af76262be466824353c6ad4be38697e8a386
Size

452KB
MD5

63b38e228810f1bcd6f0cbe30e72e66d
SHA1

f313701784218289f90eceb3a3e41cba1e1582f5
SHA256

be198863a492f22cf88e6ceb0ae0af76262be466824353c6ad4be38697e8a386
SHA512

c766f50ada3b8cffc55cde6b0342fd4843fb48b6a43f71c61291237875cb0c859c092076026cbbd46ae4a777c0764aaf8df3e883b573bdccaf12adc0ec6fcce5
SSDEEP

12288:iro/cVP14sGJD7VjSSPRybjOs6vntIYE:J/cVP1kxpjlPRybis6vt1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be198863a492f22cf88e6ceb0ae0af76262be466824353c6ad4be38697e8a386

Files

be198863a492f22cf88e6ceb0ae0af76262be466824353c6ad4be38697e8a386
.dll windows:4 windows x86 arch:x86

eb56eea3461293f39de9b2d1e72290e4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
HeapAlloc
GetLastError
HeapReAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CloseHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
CreateFileA

ippcore-5.3

ownGetNumThreads

libguide40

ord150
ord136
ord148
ord145
ord141
ord135
ord138
ord126

Exports

Exports

ippiAdd128_JPEG_16s8u_C1R
ippiBGR555ToYCbCr411LS_MCU_16u16s_C3P3R
ippiBGR555ToYCbCr422LS_MCU_16u16s_C3P3R
ippiBGR555ToYCbCr444LS_MCU_16u16s_C3P3R
ippiBGR555ToYCbCr_JPEG_16u8u_C3P3R
ippiBGR565ToYCbCr411LS_MCU_16u16s_C3P3R
ippiBGR565ToYCbCr422LS_MCU_16u16s_C3P3R
ippiBGR565ToYCbCr444LS_MCU_16u16s_C3P3R
ippiBGR565ToYCbCr_JPEG_16u8u_C3P3R
ippiBGRToYCbCr411LS_MCU_8u16s_C3P3R
ippiBGRToYCbCr422LS_MCU_8u16s_C3P3R
ippiBGRToYCbCr444LS_MCU_8u16s_C3P3R
ippiBGRToYCbCr_JPEG_8u_C3P3R
ippiBGRToY_JPEG_8u_C3C1R
ippiCMYKToYCCK411LS_MCU_8u16s_C4P4R
ippiCMYKToYCCK422LS_MCU_8u16s_C4P4R
ippiCMYKToYCCK444LS_MCU_8u16s_C4P4R
ippiCMYKToYCCK_JPEG_8u_C4P4R
ippiCMYKToYCCK_JPEG_8u_P4R
ippiDCTQuantFwd8x8LS_JPEG_16u16s_C1R
ippiDCTQuantFwd8x8LS_JPEG_8u16s_C1R
ippiDCTQuantFwd8x8_JPEG_16s_C1
ippiDCTQuantFwd8x8_JPEG_16s_C1I
ippiDCTQuantInv8x8LS_1x1_JPEG_16s8u_C1R
ippiDCTQuantInv8x8LS_2x2_JPEG_16s8u_C1R
ippiDCTQuantInv8x8LS_4x4_JPEG_16s8u_C1R
ippiDCTQuantInv8x8LS_JPEG_16s16u_C1R
ippiDCTQuantInv8x8LS_JPEG_16s8u_C1R
ippiDCTQuantInv8x8To2x2LS_JPEG_16s8u_C1R
ippiDCTQuantInv8x8To4x4LS_JPEG_16s8u_C1R
ippiDCTQuantInv8x8_JPEG_16s_C1
ippiDCTQuantInv8x8_JPEG_16s_C1I
ippiDecodeCBProgrAttach_JPEG2K_32s_C1R
ippiDecodeCBProgrFree_JPEG2K
ippiDecodeCBProgrGetCurBitPlaneNum_JPEG2K
ippiDecodeCBProgrGetPassCounter_JPEG2K
ippiDecodeCBProgrGetStateSize_JPEG2K
ippiDecodeCBProgrInitAlloc_JPEG2K
ippiDecodeCBProgrInit_JPEG2K
ippiDecodeCBProgrSetPassCounter_JPEG2K
ippiDecodeCBProgrStep_JPEG2K
ippiDecodeCodeBlock_JPEG2K_1u32s_C1R
ippiDecodeGetBufSize_JPEG2K
ippiDecodeHuffman8x8_ACFirst_JPEG_1u16s_C1
ippiDecodeHuffman8x8_ACRefine_JPEG_1u16s_C1
ippiDecodeHuffman8x8_DCFirst_JPEG_1u16s_C1
ippiDecodeHuffman8x8_DCRefine_JPEG_1u16s_C1
ippiDecodeHuffman8x8_Direct_JPEG_1u16s_C1
ippiDecodeHuffman8x8_JPEG_1u16s_C1
ippiDecodeHuffmanOne_JPEG_1u16s_C1
ippiDecodeHuffmanRow_JPEG_1u16s_C1P4
ippiDecodeHuffmanSpecFree_JPEG_8u
ippiDecodeHuffmanSpecGetBufSize_JPEG_8u
ippiDecodeHuffmanSpecInitAlloc_JPEG_8u
ippiDecodeHuffmanSpecInit_JPEG_8u
ippiDecodeHuffmanStateFree_JPEG_8u
ippiDecodeHuffmanStateGetBufSize_JPEG_8u
ippiDecodeHuffmanStateInitAlloc_JPEG_8u
ippiDecodeHuffmanStateInit_JPEG_8u
ippiDiffPredFirstRow_JPEG_16s_C1
ippiDiffPredRow_JPEG_16s_C1
ippiEncodeFree_JPEG2K
ippiEncodeGetDist_JPEG2K
ippiEncodeGetRate_JPEG2K
ippiEncodeGetTermPassLen_JPEG2K
ippiEncodeHuffman8x8_ACFirst_JPEG_16s1u_C1
ippiEncodeHuffman8x8_ACRefine_JPEG_16s1u_C1
ippiEncodeHuffman8x8_DCFirst_JPEG_16s1u_C1
ippiEncodeHuffman8x8_DCRefine_JPEG_16s1u_C1
ippiEncodeHuffman8x8_Direct_JPEG_16s1u_C1
ippiEncodeHuffman8x8_JPEG_16s1u_C1
ippiEncodeHuffmanOne_JPEG_16s1u_C1
ippiEncodeHuffmanRawTableInit_JPEG_8u
ippiEncodeHuffmanRow_JPEG_16s1u_P4C1
ippiEncodeHuffmanSpecFree_JPEG_8u
ippiEncodeHuffmanSpecGetBufSize_JPEG_8u
ippiEncodeHuffmanSpecInitAlloc_JPEG_8u
ippiEncodeHuffmanSpecInit_JPEG_8u
ippiEncodeHuffmanStateFree_JPEG_8u
ippiEncodeHuffmanStateGetBufSize_JPEG_8u
ippiEncodeHuffmanStateInitAlloc_JPEG_8u
ippiEncodeHuffmanStateInit_JPEG_8u
ippiEncodeInitAlloc_JPEG2K
ippiEncodeLoadCodeBlock_JPEG2K_32s_C1R
ippiEncodeStoreBits_JPEG2K_1u
ippiGetHuffmanStatistics8x8_ACFirst_JPEG_16s_C1
ippiGetHuffmanStatistics8x8_ACRefine_JPEG_16s_C1
ippiGetHuffmanStatistics8x8_DCFirst_JPEG_16s_C1
ippiGetHuffmanStatistics8x8_JPEG_16s_C1
ippiGetHuffmanStatisticsOne_JPEG_16s_C1
ippiICTFwd_JPEG2K_16s_P3IR
ippiICTFwd_JPEG2K_32f_C3P3R
ippiICTFwd_JPEG2K_32f_P3IR
ippiICTFwd_JPEG2K_32s_P3IR
ippiICTInv_JPEG2K_16s_P3IR
ippiICTInv_JPEG2K_32f_P3C3R
ippiICTInv_JPEG2K_32f_P3IR
ippiICTInv_JPEG2K_32s_P3IR
ippiJoin422LS_MCU_16s8u_P3C2R
ippiJoinRow_TIFF_8u16u_C1
ippiPackBitsRow_TIFF_8u_C1
ippiQuantFwd8x8_JPEG_16s_C1I
ippiQuantFwdRawTableInit_JPEG_8u
ippiQuantFwdTableInit_JPEG_8u16u
ippiQuantInv8x8_JPEG_16s_C1I
ippiQuantInvTableInit_JPEG_8u16u
ippiRCTFwd_JPEG2K_16s_C3P3R
ippiRCTFwd_JPEG2K_16s_P3IR
ippiRCTFwd_JPEG2K_32s_C3P3R
ippiRCTFwd_JPEG2K_32s_P3IR
ippiRCTInv_JPEG2K_16s_P3C3R
ippiRCTInv_JPEG2K_16s_P3IR
ippiRCTInv_JPEG2K_32s_P3C3R
ippiRCTInv_JPEG2K_32s_P3IR
ippiRGB555ToYCbCr_JPEG_16u8u_C3P3R
ippiRGB565ToYCbCr_JPEG_16u8u_C3P3R
ippiRGBToYCbCr411LS_MCU_8u16s_C3P3R
ippiRGBToYCbCr422LS_MCU_8u16s_C3P3R
ippiRGBToYCbCr444LS_MCU_8u16s_C3P3R
ippiRGBToYCbCr_JPEG_8u_C3P3R
ippiRGBToYCbCr_JPEG_8u_P3R
ippiRGBToY_JPEG_8u_C3C1R
ippiRGBToY_JPEG_8u_P3C1R
ippiReconstructPredFirstRow_JPEG_16s_C1
ippiReconstructPredRow_JPEG_16s_C1
ippiSampleDown411LS_MCU_8u16s_C3P3R
ippiSampleDown422LS_MCU_8u16s_C3P3R
ippiSampleDown444LS_MCU_8u16s_C3P3R
ippiSampleDownH2V1_JPEG_8u_C1R
ippiSampleDownH2V2_JPEG_8u_C1R
ippiSampleDownRowH2V1_Box_JPEG_8u_C1
ippiSampleDownRowH2V2_Box_JPEG_8u_C1
ippiSampleUp411LS_MCU_16s8u_P3C3R
ippiSampleUp422LS_MCU_16s8u_P3C3R
ippiSampleUp444LS_MCU_16s8u_P3C3R
ippiSampleUpH2V1_JPEG_8u_C1R
ippiSampleUpH2V2_JPEG_8u_C1R
ippiSampleUpRowH2V1_Triangle_JPEG_8u_C1
ippiSampleUpRowH2V2_Triangle_JPEG_8u_C1
ippiSplit422LS_MCU_8u16s_C2P3R
ippiSplitRow_TIFF_16u8u_C1
ippiSub128_JPEG_8u16s_C1R
ippiUnpackBitsRow_TIFF_8u_C1
ippiWTFwdColLift_B53_JPEG2K_16s_C1
ippiWTFwdColLift_B53_JPEG2K_32s_C1
ippiWTFwdColLift_D97_JPEG2K_16s_C1
ippiWTFwdColLift_D97_JPEG2K_32f_C1
ippiWTFwdColLift_D97_JPEG2K_32s_C1
ippiWTFwdCol_B53_JPEG2K_16s_C1R
ippiWTFwdCol_B53_JPEG2K_32s_C1R
ippiWTFwdCol_D97_JPEG2K_32f_C1R
ippiWTFwdRow_B53_JPEG2K_16s_C1R
ippiWTFwdRow_B53_JPEG2K_32s_C1R
ippiWTFwdRow_D97_JPEG2K_16s_C1R
ippiWTFwdRow_D97_JPEG2K_32f_C1R
ippiWTFwdRow_D97_JPEG2K_32s_C1R
ippiWTFwd_B53_JPEG2K_16s_C1IR
ippiWTFwd_B53_JPEG2K_16s_C1R
ippiWTFwd_B53_JPEG2K_32s_C1IR
ippiWTFwd_B53_JPEG2K_32s_C1R
ippiWTFwd_D97_JPEG2K_16s_C1IR
ippiWTFwd_D97_JPEG2K_16s_C1R
ippiWTFwd_D97_JPEG2K_32s_C1IR
ippiWTFwd_D97_JPEG2K_32s_C1R
ippiWTGetBufSize_B53_JPEG2K_16s_C1IR
ippiWTGetBufSize_B53_JPEG2K_16s_C1R
ippiWTGetBufSize_B53_JPEG2K_32s_C1IR
ippiWTGetBufSize_B53_JPEG2K_32s_C1R
ippiWTGetBufSize_D97_JPEG2K_16s_C1IR
ippiWTGetBufSize_D97_JPEG2K_16s_C1R
ippiWTGetBufSize_D97_JPEG2K_32s_C1IR
ippiWTGetBufSize_D97_JPEG2K_32s_C1R
ippiWTInvColLift_B53_JPEG2K_16s_C1
ippiWTInvColLift_B53_JPEG2K_32s_C1
ippiWTInvColLift_D97_JPEG2K_16s_C1
ippiWTInvColLift_D97_JPEG2K_32f_C1
ippiWTInvColLift_D97_JPEG2K_32s_C1
ippiWTInvCol_B53_JPEG2K_16s_C1R
ippiWTInvCol_B53_JPEG2K_32s_C1R
ippiWTInvCol_D97_JPEG2K_32f_C1R
ippiWTInvRow_B53_JPEG2K_16s_C1R
ippiWTInvRow_B53_JPEG2K_32s_C1R
ippiWTInvRow_D97_JPEG2K_16s_C1R
ippiWTInvRow_D97_JPEG2K_32f_C1R
ippiWTInvRow_D97_JPEG2K_32s_C1R
ippiWTInv_B53_JPEG2K_16s_C1IR
ippiWTInv_B53_JPEG2K_16s_C1R
ippiWTInv_B53_JPEG2K_32s_C1IR
ippiWTInv_B53_JPEG2K_32s_C1R
ippiWTInv_D97_JPEG2K_16s_C1IR
ippiWTInv_D97_JPEG2K_16s_C1R
ippiWTInv_D97_JPEG2K_32s_C1IR
ippiWTInv_D97_JPEG2K_32s_C1R
ippiYCCK411ToCMYKLS_MCU_16s8u_P4C4R
ippiYCCK422ToCMYKLS_MCU_16s8u_P4C4R
ippiYCCK444ToCMYKLS_MCU_16s8u_P4C4R
ippiYCCKToCMYK_JPEG_8u_P4C4R
ippiYCCKToCMYK_JPEG_8u_P4R
ippiYCbCr411ToBGR555LS_MCU_16s16u_P3C3R
ippiYCbCr411ToBGR565LS_MCU_16s16u_P3C3R
ippiYCbCr411ToBGRLS_MCU_16s8u_P3C3R
ippiYCbCr411ToRGBLS_MCU_16s8u_P3C3R
ippiYCbCr422ToBGR555LS_MCU_16s16u_P3C3R
ippiYCbCr422ToBGR565LS_MCU_16s16u_P3C3R
ippiYCbCr422ToBGRLS_MCU_16s8u_P3C3R
ippiYCbCr422ToRGBLS_MCU_16s8u_P3C3R
ippiYCbCr422ToRGB_JPEG_8u_C2C3R
ippiYCbCr444ToBGR555LS_MCU_16s16u_P3C3R
ippiYCbCr444ToBGR565LS_MCU_16s16u_P3C3R
ippiYCbCr444ToBGRLS_MCU_16s8u_P3C3R
ippiYCbCr444ToRGBLS_MCU_16s8u_P3C3R
ippiYCbCrToBGR555_JPEG_8u16u_P3C3R
ippiYCbCrToBGR565_JPEG_8u16u_P3C3R
ippiYCbCrToBGR_JPEG_8u_P3C3R
ippiYCbCrToRGB555_JPEG_8u16u_P3C3R
ippiYCbCrToRGB565_JPEG_8u16u_P3C3R
ippiYCbCrToRGB_JPEG_8u_P3C3R
ippiYCbCrToRGB_JPEG_8u_P3R
ippjGetLibVersion

Sections

.text
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eb56eea3461293f39de9b2d1e72290e4

Headers

File Characteristics

Imports

kernel32

ippcore-5.3

libguide40

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 300KB

.rdata Size: 56KB - Virtual size: 52KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 304KB - Virtual size: 300KB

.rdata
Size: 56KB - Virtual size: 52KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB

.rmnet
Size: 60KB - Virtual size: 60KB