D:\192.168.2.24-SmartECGNet\SDK\Trunk\ECGView\ECGViewerOCX\Release\ECGBrokerOCX.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5b3e011ced2f2ac35188b5488dc544704b365c58ab168fe27534ef6f09f3c0f7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5b3e011ced2f2ac35188b5488dc544704b365c58ab168fe27534ef6f09f3c0f7.dll
Resource
win10v2004-20240412-en
General
-
Target
5b3e011ced2f2ac35188b5488dc544704b365c58ab168fe27534ef6f09f3c0f7
-
Size
918KB
-
MD5
c87bbc21a8c6fdd09937ad1598f272fc
-
SHA1
19151a8efd09b02161bf516e81afa67fddfec3c6
-
SHA256
5b3e011ced2f2ac35188b5488dc544704b365c58ab168fe27534ef6f09f3c0f7
-
SHA512
08851fc85b33486f816248ccd2c06f0ebdb81c26d9a764dff9bbb36f2016685661a4e418a1752e680e51adf44a80b2f5d493182171e3ab076ca46268c6d3cf14
-
SSDEEP
24576:/VJei0ySoscQUBOeXfRuoMZQLXbRc+5ZacjXv:91fOiLXKgQcjXv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b3e011ced2f2ac35188b5488dc544704b365c58ab168fe27534ef6f09f3c0f7
Files
-
5b3e011ced2f2ac35188b5488dc544704b365c58ab168fe27534ef6f09f3c0f7.dll regsvr32 windows:5 windows x86 arch:x86
18620c2f3fa299882578644afe528c1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mfc100u
ord11123
ord10446
ord10049
ord9445
ord9113
ord4216
ord4197
ord2529
ord4956
ord981
ord423
ord11838
ord11801
ord11683
ord1476
ord1312
ord7524
ord9468
ord9351
ord11772
ord2957
ord10065
ord10229
ord12493
ord2888
ord2508
ord11017
ord4586
ord6993
ord10909
ord9519
ord9521
ord4442
ord4666
ord11681
ord7481
ord9423
ord9422
ord9776
ord9373
ord10196
ord9088
ord8628
ord9146
ord10381
ord10241
ord10246
ord10251
ord9417
ord10204
ord10203
ord9432
ord9431
ord9430
ord9369
ord9471
ord10539
ord9398
ord9359
ord8113
ord9802
ord9370
ord9346
ord9345
ord10661
ord9131
ord8152
ord8128
ord8116
ord9615
ord9617
ord9614
ord8290
ord9220
ord10443
ord8321
ord10388
ord10356
ord3541
ord5470
ord8856
ord4588
ord5558
ord12610
ord2887
ord2884
ord7385
ord2418
ord14146
ord14148
ord14147
ord14145
ord14149
ord14132
ord14059
ord14060
ord8277
ord11081
ord3400
ord10937
ord13375
ord8112
ord8347
ord6247
ord10045
ord8393
ord2853
ord12724
ord11246
ord11244
ord1501
ord1508
ord1514
ord8179
ord1519
ord4388
ord4425
ord4396
ord4408
ord4404
ord4400
ord4430
ord4421
ord4392
ord4434
ord4413
ord4379
ord4383
ord4416
ord3999
ord14067
ord3992
ord2665
ord13382
ord7109
ord13388
ord6156
ord10725
ord12557
ord5276
ord2339
ord11116
ord3491
ord3230
ord1205
ord764
ord1998
ord6829
ord6578
ord2629
ord285
ord5264
ord2614
ord13364
ord5239
ord2952
ord2951
ord2852
ord11159
ord4643
ord4924
ord13365
ord8494
ord11467
ord5138
ord5302
ord890
ord1292
ord6059
ord3484
ord2254
ord5116
ord8484
ord5128
ord4646
ord4793
ord7394
ord9330
ord12063
ord1310
ord1987
ord290
ord286
ord10271
ord3669
ord7168
ord1183
ord731
ord2011
ord1996
ord1946
ord6669
ord6667
ord6823
ord6559
ord4511
ord4290
ord902
ord296
ord266
ord265
ord1298
ord4258
ord1203
ord761
ord7624
ord7548
ord11784
ord13854
ord4744
ord2164
ord11476
ord11477
ord13381
ord7108
ord13387
ord8530
ord3684
ord3625
ord11864
ord7126
ord1739
ord14162
ord10976
ord13267
ord11469
ord7179
ord10058
ord10412
ord9549
ord3627
ord2981
ord2980
ord2756
ord5556
ord12606
ord2417
ord3402
ord13376
ord11204
ord8389
ord5139
ord1512
ord9331
ord11597
ord1604
ord11210
ord8064
ord13570
ord13567
ord908
ord2091
ord2055
ord2053
ord2080
ord1984
ord2045
ord3413
ord408
ord1953
ord2090
ord2088
ord1945
ord1873
ord323
ord1301
ord13208
ord13168
ord4478
ord13572
ord13569
ord13571
ord13568
ord3416
ord5261
ord11228
ord11236
ord7391
ord9498
ord11240
ord11209
ord7175
ord4085
ord322
ord11845
ord4642
ord4923
ord5115
ord8483
ord4901
ord5118
ord4645
ord4794
ord4623
ord5467
ord6931
ord6932
ord6922
ord4792
ord7393
ord9328
ord8346
ord6044
ord2014
ord13332
ord1934
ord2002
ord13605
ord1890
ord1889
ord1300
msvcr100
memchr
_snprintf
_access
malloc
_localtime64_s
sprintf_s
ceil
atol
printf
__iob_func
memcpy
memset
floor
_CIpow
_CxxThrowException
strtol
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__CxxFrameHandler3
wcscat_s
wcsrchr
wcsncpy_s
isalpha
tolower
isalnum
strchr
isspace
strncmp
ferror
fread
fopen_s
_vsnprintf_s
_beginthreadex
_endthreadex
fseek
ftell
fprintf
rename
_purecall
atof
isdigit
strncpy
_mktime64
fwrite
memcpy_s
_lock_file
setvbuf
fsetpos
fgetc
fflush
_fseeki64
fgetpos
ungetc
_unlock_file
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
fputc
?what@exception@std@@UBEPBDXZ
atoi
fclose
fopen
sscanf
sprintf
_localtime64
_time64
??0exception@std@@QAE@ABV01@@Z
memmove
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
kernel32
GetLocalTime
SetUnhandledExceptionFilter
WideCharToMultiByte
GetModuleFileNameW
RemoveDirectoryW
GetFileSize
FindFirstFileW
WriteFile
ReadFile
FindClose
DeleteFileW
MultiByteToWideChar
CreateDirectoryA
Sleep
WinExec
FreeLibrary
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
SetEvent
Thread32First
GetCurrentProcess
Thread32Next
GetExitCodeThread
CreateEventW
CreateToolhelp32Snapshot
ResumeThread
CreateDirectoryW
GetFileAttributesW
LocalFree
DeleteFileA
CloseHandle
LocalAlloc
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetProcAddress
LoadLibraryW
GetCurrentThreadId
GetSystemTime
IsProcessorFeaturePresent
CreateFileW
user32
EnableWindow
MsgWaitForMultipleObjects
PostMessageW
MessageBoxA
CallNextHookEx
PeekMessageW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathRemoveExtensionW
PathStripPathW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoCreateGuid
oleaut32
LoadRegTypeLi
msvcp100
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
??0_Locinfo@std@@QAE@HPBD@Z
??1_Locinfo@std@@QAE@XZ
??1_Locimp@locale@std@@MAE@XZ
??0_Locimp@locale@std@@AAE@_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_Xruntime_error@std@@YAXPBD@Z
?global@locale@std@@SA?AV12@ABV12@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
libxml2
xmlSaveFormatFileEnc
xmlNewTextChild
xmlDocSetRootElement
xmlNewNode
xmlNewDoc
xmlParseMemory
xmlKeepBlanksDefault
xmlFree
xmlNodeGetContent
xmlStrcasecmp
xmlCleanupParser
xmlStrcmp
xmlFreeDoc
xmlDocGetRootElement
xmlReadFile
xmlDocDumpFormatMemoryEnc
iconv
libiconv
libiconv_open
libiconv_close
iphlpapi
GetAdaptersInfo
Exports
Exports
AESClose
AESDecode
AESDecodeString
AESEncode
AESEncodeMemory
AESEncodeString
AESInit
Base64Decode
Base64Encode
CloseDoc
CreateDoc
CreateJson
CreateMemoryDoc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FreeMemory
GetAddr
GetCurSysTime
GetNetCardNum
InitDoc
MD5Close
MD5Encode
ParseDoc
ParseJson
ParseMemoryDoc
ReadFileEX
WriteFileEX
Sections
.text Size: 717KB - Virtual size: 716KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ