53993779f40b39043c8515b11a316c50b028b0883343f56a1d50bd1e6e685602

Sharing

Copy URL Twitter E-mail

General

Target

53993779f40b39043c8515b11a316c50b028b0883343f56a1d50bd1e6e685602
Size

110KB
MD5

f4c1415f5ae4f1e3c4cf37493d9099b2
SHA1

a41797b483f9c3cae0e10889db5c53a95a82a443
SHA256

53993779f40b39043c8515b11a316c50b028b0883343f56a1d50bd1e6e685602
SHA512

8a15f4c8c9b82a1073bed92270a1364b3fd7aaf1ce60e34dbc4f23035a49779ed829dd594e3abfe95880e254c952786b7377c58b463a88c4460d668ef50328fc
SSDEEP

1536:0ZXrOLTIc/0hC7MSMh3G9rfScjP0r63muOfhBM/e:0ZCHV0huMSMh3G9rfSc/TOfhBM/e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53993779f40b39043c8515b11a316c50b028b0883343f56a1d50bd1e6e685602

Files

53993779f40b39043c8515b11a316c50b028b0883343f56a1d50bd1e6e685602
.dll windows:5 windows x86 arch:x86

10242c40e8e4ba7a21f799113de3f078

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\192.168.2.24-SmartECGNet\SDK\Trunk\ECGView\ECGViewerOCX\Release\3DViewer.pdb

Imports

gdiplus

GdipAlloc
GdipDrawImageRectI
GdipLoadImageFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipDisposeImage
GdipCreateFromHDC
GdipCloneImage
GdiplusShutdown
GdipFree
GdiplusStartup

opengl32

glListBase
glRasterPos3f
glCallLists
glPopMatrix
glVertex4f
wglCreateContext
glClearColor
glClear
glShadeModel
glEnable
glBlendFunc
glClearDepth
glPolygonMode
wglUseFontBitmapsW
glRotatef
glVertex2d
glEnd
glVertex3f
glColor3f
glBegin
glLineWidth
wglDeleteContext
wglMakeCurrent
wglGetCurrentContext
glFinish
glOrtho
glPushMatrix
glTranslatef
wglGetCurrentDC
glViewport
glMatrixMode
glLoadIdentity
glPointSize

glu32

gluPerspective

mfc100u

ord9470
ord4511
ord5229
ord286
ord265
ord6655
ord886
ord1288
ord6865
ord9562
ord12005
ord8598
ord4355
ord5855
ord3174
ord3397
ord1310
ord423
ord981
ord4197
ord7911
ord10160
ord2338
ord10305
ord10308
ord8073
ord8063
ord10164
ord1479
ord4512
ord6869
ord890
ord1292
ord7176
ord5261
ord1944
ord322
ord13605
ord13047
ord7929
ord6140
ord9328
ord5118
ord11845
ord11209
ord11240
ord9498
ord7391
ord11236
ord11228
ord3416
ord13568
ord13571
ord13569
ord13572
ord13567
ord13570
ord7179
ord11469
ord13267
ord10976
ord14162
ord1739
ord7126
ord11864
ord3625
ord3684
ord10511
ord13387
ord7108
ord13381
ord11477
ord11476
ord2164
ord4744
ord13854
ord11784
ord7548
ord7624
ord11494
ord280
ord341
ord863
ord1264
ord6854
ord6116
ord8391
ord10044
ord2843
ord3194
ord3208
ord11426
ord9013
ord9580
ord14066
ord3188
ord3466
ord13074
ord13072
ord3452
ord3420
ord4449
ord12127
ord2349
ord1535
ord3624
ord3672
ord3673
ord7093
ord5111
ord5045
ord13183
ord13176
ord3705
ord12810
ord13085
ord13097
ord2614
ord1312
ord6080
ord5799
ord2184
ord11982
ord945
ord374
ord919
ord7529
ord7967
ord11998
ord12871
ord11999
ord7006
ord8599
ord3428
ord293
ord5264
ord11940
ord6870
ord6318
ord1212
ord7357
ord788
ord4084
ord3407
ord4756
ord10799
ord10804
ord7986
ord5296
ord10447
ord5279
ord12561
ord5280
ord12563
ord1529
ord11404
ord5469
ord4445
ord4444
ord7559
ord2766
ord7384
ord11073
ord11168
ord3993
ord2216
ord8374
ord12554
ord5275
ord8350
ord8313
ord6598
ord7399
ord4450
ord11094
ord12135
ord12951
ord8435
ord1893
ord5600
ord6723
ord266
ord1280
ord879
ord987
ord433
ord6374
ord6975
ord9140
ord9139
ord8151
ord8659
ord10750
ord8062
ord8070
ord10159
ord8657
ord9080
ord9075
ord8645
ord8655
ord8640
ord10307
ord10304
ord7474
ord5557
ord12608
ord8277
ord11080
ord11167
ord4437
ord4438
ord4441
ord4439
ord4440
ord6155
ord2337
ord11115
ord2765
ord8363
ord12186
ord8509
ord11997
ord337
ord10185
ord3663
ord2185
ord1934
ord9557
ord6722
ord9238
ord9237
ord3261
ord5862
ord3446
ord4290
ord1987
ord5801
ord917
ord897
ord5802
ord8346
ord9333
ord7393
ord4792
ord6922
ord6932
ord6931
ord5468
ord4623
ord4794
ord4645
ord5143
ord4901
ord8483
ord5115
ord4923
ord4642
ord11159
ord2852
ord2951
ord2952
ord3491
ord11116
ord2339
ord5276
ord12557
ord10725
ord6156
ord13388
ord7109
ord13382
ord2665
ord3992
ord14067
ord3999
ord4416
ord4383
ord4379
ord4413
ord4434
ord4392
ord4421
ord4430
ord4400
ord4404
ord1300
ord296
ord4408
ord4396
ord4425
ord4388
ord1519
ord1512
ord1514
ord1508
ord1501
ord11244
ord11246
ord12724
ord2853
ord8393
ord10045
ord6247
ord11210
ord8112
ord908
ord2091
ord2055
ord2053
ord2080
ord1984
ord2045
ord3413
ord408
ord1953
ord2090
ord2088
ord1945
ord1873
ord323
ord1301
ord13380
ord10937
ord3402
ord11081
ord8264
ord14060
ord14059
ord14132
ord14149
ord14145
ord14147
ord14148
ord14146
ord2418
ord7385
ord2884
ord2887
ord12610
ord5558
ord2746
ord3746
ord985
ord430
ord6373
ord1298
ord1450
ord902
ord8530

msvcr100

strncpy
memset
_CIcos
_CIsin
_CIasin
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
_CIacos
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
memcpy
__CxxFrameHandler3
wcscpy_s
wcscat_s
wcsncpy_s
_waccess
wcsrchr
_swprintf
_localtime64
wcsftime
_time64

kernel32

FreeResource
GetCurrentThreadId
SizeofResource
DeleteCriticalSection
CreateFileW
EnterCriticalSection
LoadResource
FindResourceW
LocalFree
LocalAlloc
EncodePointer
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
MulDiv
LeaveCriticalSection
GetFileAttributesW
GetPrivateProfileStringW
GetModuleFileNameW
lstrlenW
GlobalUnlock
WriteFile
FlushFileBuffers
InitializeCriticalSection
GetLocalTime
CreateDirectoryW
CloseHandle
GlobalAlloc
GlobalFree
GlobalLock

user32

GetCursorPos
GetCapture
ReleaseCapture
SetCursor
GetSysColor
ReleaseDC
KillTimer
SetTimer
GetWindowRect
FillRect
PtInRect
DestroyIcon
DrawStateW
wsprintfW
EnumChildWindows
GetDlgCtrlID
SetWindowTextW
UpdateWindow
GetSystemMetrics
IsRectEmpty
EnableWindow
SendMessageW
InvalidateRect
GetClientRect
GetDC

gdi32

CreateCompatibleDC
CreatePen
GetTextExtentPoint32W
CreateFontW
StretchDIBits
CreateDIBSection
SetPixelFormat
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
DeleteObject
CreateCompatibleBitmap
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetDeviceCaps
CreateDCW
SwapBuffers
GetObjectW
SelectObject
BitBlt
DeleteDC
CreateSolidBrush
PatBlt

winspool.drv

OpenPrinterW
ClosePrinter
GetPrinterW

ole32

CreateStreamOnHGlobal

Exports

Exports

Close3DViewer
Open3DViewer

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10242c40e8e4ba7a21f799113de3f078

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

opengl32

glu32

mfc100u

msvcr100

kernel32

user32

gdi32

winspool.drv

ole32

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 37KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 38KB - Virtual size: 37KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 10KB - Virtual size: 9KB