4267603acd30e381a438f9a6b7483e3090f46a2045c0a5c6aaf28a20941bee7e

Sharing

Copy URL Twitter E-mail

General

Target

4267603acd30e381a438f9a6b7483e3090f46a2045c0a5c6aaf28a20941bee7e
Size

1.9MB
MD5

26e8e86a2b8a1924e6bc37af5dadaf23
SHA1

773b2972258580bf9af3168783d56b59244b98d5
SHA256

4267603acd30e381a438f9a6b7483e3090f46a2045c0a5c6aaf28a20941bee7e
SHA512

7976e116767ae69b38bd0ad9d335e7ab92a1cf50e82a6b11a76eedf01bdbb4426f116d21c60a5f109f8b93cd376deac1729c612208ad15a97fc686098c3a6f44
SSDEEP

49152:kjxIQyUsCTplffffff6ffuffyffffffffffffffffffffffffffffffffffffffX:4xIQFlffffff6ffuffyffffffffffffg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4267603acd30e381a438f9a6b7483e3090f46a2045c0a5c6aaf28a20941bee7e

Files

4267603acd30e381a438f9a6b7483e3090f46a2045c0a5c6aaf28a20941bee7e
.exe windows:5 windows x86 arch:x86

b59c8bb17a97edc1120983ff5827f355

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

argobl1

?MakeCounter@@YAPADPADHH@Z

barplus

?DrawBarcodeToBMP@@YGHHPBD0HHHHHHHPA_WH@Z
?SetBarFontPath@@YGXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?BuildQRCodeData@@YGHHHHHHHHPA_W0K@Z
?BuildDataMatrixData@@YGHHHHPA_W0K@Z
?GetBarSize@@YGKXZ
?ShowBarcodeToHDC@@YGHHPAUHDC__@@AAVCPoint@@PBD2HHHHHHHH@Z

bclw32

_DrawBarCodeToHDC@28
_DrawBarCodeToFile@28
_GetBarCodeSize@16
_BuildMaxicodeShippingData@64
_CreateBarCodeIndirect@4
_DeleteBarCode@4

dbtable

?On_GetData@CDynamicBulkSet@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HHH@Z
?GetData@CDBF@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HHH@Z
?GetTableByID@CODBCDBase@@QAEPAUODBCTABLE@@HH@Z
?GetFieldName@CODBCDBase@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@H@Z
?GetFieldCount@CODBCDBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetHRText@CDynamicBulkSet@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?IsOpen@CDBF@@QAEHXZ
?AccountTableUsed@CODBCDBase@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?On_GetTotalSelect@CDynamicBulkSet@@QAEHXZ
?FetchData@CDBF@@QAEPA_WHHH@Z
?On_FetchData@CDynamicBulkSet@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HHH@Z
?GetTotalSelect@CDBF@@QAEHXZ
?GetRowsFetched@CDBF@@QAEHXZ
?TablesFilter@CODBCDBase@@QAEXPAVCArgoBarDoc@@@Z
?GetLeastRecords@CODBCDBase@@QAEHXZ
?CleanUsed@CODBCDBase@@QAEXXZ
?GetSelectedODBCType@CODBCDBase@@QAEHXZ
?GetRowBeginString@CDBTDlg@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
??1CDBTDlg@@UAE@XZ
??0CDBTDlg@@QAE@HV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCDynamicBulkSet@@PAVCDBF@@H0H00PAVCWnd@@@Z
?GetFieldName@CDBF@@QAEPA_WH@Z
?DisconnectODBCDatabase@CODBCDBase@@QAEHXZ
?AccessRecord@CODBCDBase@@QAEHH@Z
?Serialize@CODBCDBase@@QAEXAAVCArchive@@H@Z
??0CODBCDBase@@QAE@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetHRText@CDBF@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?ConnectToODBCDatabase@CODBCDBase@@QAEHXZ
?SetSelectedODBCType@CODBCDBase@@QAEXH@Z
?SetSelectedODBCFile@CODBCDBase@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?WriteOutSchemaIniForCSV@CODBCDBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H0H@Z
?GetSelectedCount@CODBCDBase@@QAEHXZ
?GetFirstSelectedPosition@CODBCDBase@@QAEHXZ
?CreateTable@CODBCDBase@@QAEPAUODBCTABLE@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?GetNextSelectedFieldData@CODBCDBase@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HAAH@Z
?GetCheckDBFileExistResult@CODBCDBase@@QAEHXZ
?CheckDBPathExist@CODBCDBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??1CODBCDBase@@UAE@XZ

pfgenerater

??0CPFG@@QAE@XZ
?SetFont@CPFG@@QAEHHHHHHHH@Z
?SetPath@CPFG@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??1CPFG@@UAE@XZ
?GetBmpFile@CPFG@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?SetInvert@CPFG@@QAEHH@Z
?GetStringSize@CPFG@@QAE?AVCSize@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z

properties

??1CVariable@@UAE@XZ
?HasFocus@CLocalComboBox@@QAEHXZ
?LimitText@CLocalComboBox@@QAEHH@Z
??0CSizeComboBox@@QAE@XZ
??0CVariable@@QAE@PAVCArgoBarDoc@@HHHHPAVCWnd@@@Z
_ModifyObj_BCODEHR@32
GetAppend
GetReference
Set_DateTime
?GetObjectData@CProperty2DBcode@@QAEXPAVCDrawObj@@@Z
??1CProperty2DBcode@@UAE@XZ
??0CProperty2DBcode@@QAE@PAVCDrawObj@@PAU_InfoData@@PAVCArgoBarDoc@@IPAVCWnd@@I@Z
?GetObjectData@CPropertyBcode@@QAEXPAVCDrawObj@@@Z
??1CPropertyBcode@@UAE@XZ
??0CPropertyBcode@@QAE@PAVCDrawObj@@PAU_InfoData@@PAVCArgoBarDoc@@IPAVCWnd@@I@Z
?GetObjectData@CPropertyText@@QAEXPAVCDrawObj@@@Z
??1CPropertyText@@UAE@XZ
??0CPropertyText@@QAE@PAVCDrawObj@@PAU_InfoData@@PAVCArgoBarDoc@@IPAVCWnd@@I@Z
??1CSizeComboBox@@UAE@XZ

winport

ord15
ord16

winppla

ord30
ord24
ord25
ord65
ord54
ord2
ord51
ord9
ord17
ord12
ord10
ord7
ord6
ord23
ord36
ord42
ord73
ord44
ord38
ord48
ord40
ord41
ord32
ord34
ord45
ord50
ord35
ord46
ord53
ord11
ord47
ord26

winpplb

ord76
ord12
ord36
ord64
ord65
ord62
ord1
ord3
ord133
ord26
ord39
ord55
ord43
ord41
ord49
?B_Set_Labgap_BlackLine@@YGHHH@Z
ord50
ord45
ord48
ord46
ord54
ord83
ord52
ord44
ord4
ord5
ord7
ord6
ord11
ord13
ord17
ord10
ord63

winpplz

ord6
ord71
ord7
ord15
ord13
ord20
ord16
ord74
ord75
ord41
ord49
ord48
ord36
ord35
ord51
ord55
ord40
ord72
ord43
ord42
ord45
ord73
ord46
ord37
ord26
ord9
ord50
ord10
ord38
ord14
ord28
ord27
ord29

mfc90u

ord6352
ord2061
ord4773
ord1464
ord4306
ord1365
ord480
ord5825
ord4727
ord3054
ord4165
ord2879
ord6088
ord4278
ord4990
ord5495
ord3688
ord1005
ord4258
ord4239
ord768
ord729
ord4693
ord1440
ord3681
ord5664
ord5601
ord1493
ord6411
ord3355
ord5293
ord4823
ord4807
ord4590
ord4866
ord4109
ord5296
ord4410
ord4541
ord6187
ord770
ord6218
ord2749
ord1420
ord2152
ord481
ord569
ord6666
ord491
ord567
ord5209
ord5371
ord731
ord2372
ord2085
ord3701
ord6766
ord1250
ord1815
ord1383
ord2216
ord493
ord4031
ord4895
ord1882
ord1801
ord601
ord5852
ord2697
ord300
ord821
ord316
ord1070
ord3873
ord5788
ord468
ord3235
ord3124
ord4300
ord6278
ord5843
ord2245
ord4935
ord1644
ord976
ord5295
ord4779
ord4754
ord5353
ord4937
ord1445
ord4594
ord4752
ord4963
ord5032
ord5329
ord5249
ord5453
ord5350
ord5944
ord2591
ord2742
ord2515
ord1498
ord4744
ord3162
ord5783
ord6823
ord1587
ord716
ord4642
ord2974
ord4587
ord4755
ord6132
ord2087
ord4543
ord2597
ord6813
ord403
ord6065
ord809
ord2676
ord595
ord3496
ord3286
ord4654
ord1667
ord2277
ord4510
ord1601
ord2103
ord615
ord3794
ord1937
ord2057
ord2038
ord1934
ord1938
ord2360
ord6760
ord4490
ord3038
ord814
ord2326
ord3621
ord4518
ord899
ord2084
ord6527
ord6098
ord1254
ord6828
ord3537
ord3486
ord3637
ord6091
ord1630
ord2300
ord1052
ord4640
ord3058
ord3060
ord763
ord3868
ord525
ord3187
ord5869
ord306
ord2260
ord2259
ord938
ord942
ord2082
ord2539
ord936
ord1276
ord2219
ord501
ord3356
ord4235
ord4234
ord2677
ord6164
ord2081
ord2656
ord332
ord2224
ord290
ord4494
ord1735
ord287
ord291
ord1219
ord4519
ord6729
ord4457
ord4521
ord1041
ord933
ord554
ord758
ord3528
ord654
ord3807
ord2478
ord4130
ord4128
ord2901
ord4044
ord4268
ord2364
ord788
ord585
ord3662
ord2137
ord5611
ord5403
ord2627
ord5652
ord6794
ord5595
ord1431
ord1425
ord1432
ord2227
ord2265
ord2269
ord2288
ord2297
ord2289
ord2078
ord4396
ord5802
ord4320
ord4616
ord6524
ord1723
ord1787
ord3157
ord4717
ord6577
ord6194
ord5429
ord3183
ord4037
ord4663
ord1722
ord1786
ord2286
ord785
ord3940
ord6807
ord4036
ord6273
ord2593
ord4131
ord5124
ord795
ord265
ord6096
ord590
ord4451
ord4426
ord4351
ord779
ord670
ord576
ord415
ord4685
ord3225
ord6375
ord4697
ord1380
ord2369
ord5655
ord5598
ord4344
ord1681
ord4429
ord2650
ord2651
ord3287
ord5803
ord6381
ord3230
ord6379
ord3229
ord5338
ord3232
ord4553
ord4730
ord5450
ord5447
ord2860
ord2079
ord2445
ord5354
ord4985
ord5615
ord2356
ord2189
ord2341
ord2340
ord6195
ord6517
ord6424
ord6338
ord6595
ord3741
ord2146
ord6426
ord4763
ord4127
ord980
ord6575
ord4720
ord4007
ord4971
ord4586
ord1918
ord6170
ord2595
ord436
ord3563
ord4658
ord686
ord1689
ord6355
ord3145
ord1603
ord580
ord6353
ord1045
ord581
ord1651
ord3108
ord2045
ord3651
ord1716
ord1783
ord775
ord3489
ord4652
ord1665
ord611
ord4492
ord3654
ord4660
ord1719
ord2283
ord778
ord3642
ord1714
ord767
ord4530
ord1696
ord4370
ord2696
ord5497
ord2504
ord3562
ord4657
ord1695
ord2279
ord4511
ord1602
ord2105
ord6791
ord1488
ord692
ord3749
ord6635
ord1486
ord1064
ord4815
ord398
ord662
ord1088
ord1063
ord3252
ord2280
ord693
ord2470
ord1688
ord3165
ord3155
ord4992
ord1678
ord3742
ord3061
ord2484
ord5387
ord4167
ord6205
ord782
ord5887
ord5894
ord5886
ord5908
ord3166
ord2726
ord4010
ord6547
ord6101
ord5974
ord6040
ord5078
ord3217
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord4681
ord3670
ord589
ord296
ord367
ord794
ord600
ord636
ord5632
ord4630
ord5166
ord5324
ord5008
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893

msvcr90

wcsstr
__CxxFrameHandler3
memcpy
memset
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memcmp
atan2
fabs
sqrt
log
exp
bsearch
pow
strcpy
strlen
getenv
sscanf
__iob_func
fprintf
exit
_CIexp
isprint
_CIlog
ldiv
strstr
realloc
__CxxLongjmpUnwind
_setjmp3
longjmp
strncmp
_CIpow
_wfopen
fscanf
fgets
getc
fputc
ferror
feof
fflush
ftell
fseek
fwrite
fread
fclose
_purecall
floor
_wcsicmp
wcsrchr
rand
qsort
_wfindfirst64i32
_wfindnext64i32
_findclose
_wsplitpath
_wcslwr
wcstok_s
wcscpy_s
_stricmp
strncpy_s
_wcsnicmp
strncpy
atoi
_recalloc
calloc
_wsetlocale
free
malloc
printf
wcsncpy
_itoa
sprintf
_CxxThrowException
tolower
_itow
_wtoi
wcstombs
mbstowcs
_wcsdup

kernel32

GlobalUnlock
FreeLibrary
GetVersionExW
GlobalLock
lstrcpyW
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryA
GetWindowsDirectoryW
lstrcatW
SetLastError
GetProcAddress
GetModuleHandleW
WaitForSingleObject
SetEvent
LocalHandle
LocalFree
LocalAlloc
lstrcmpW
GetUserDefaultLangID
SetThreadUILanguage
LoadLibraryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
lstrlenW
GetPrivateProfileIntW
GetCurrentDirectoryW
FindResourceExW
LoadResource
LockResource
WideCharToMultiByte
DeleteFileW
CreateFileW
GetLastError
WritePrivateProfileStringW
GetFileSize
GetPrivateProfileStringW
CloseHandle
MulDiv
GetModuleFileNameW
GlobalFree
GlobalAlloc

user32

GetSubMenu
GetWindowRect
UpdateWindow
EnableWindow
InflateRect
OffsetRect
IntersectRect
FillRect
DrawFocusRect
DeleteMenu
GetMenuItemCount
LoadMenuW
GetClientRect
ScreenToClient
GetDC
InvalidateRect
ReleaseCapture
RegisterClipboardFormatW
IsRectEmpty
EqualRect
SendMessageW
GetParent
CopyRect
SetRect
LoadCursorW
GetKeyState
GetCapture
SetCapture
SetCursor
GetFocus
ReleaseDC
IsChild
DispatchMessageW
TranslateMessage
LoadMenuIndirectW
GetSystemMetrics
GetDlgCtrlID
wsprintfW
SetScrollPos
LoadIconW
GetMessagePos
GetSysColor
MapWindowPoints
PtInRect
PostMessageW
KillTimer
SetTimer
GetSystemMenu
EnableMenuItem

gdi32

CreatePenIndirect
CreatePen
UnrealizeObject
GetDeviceCaps
CreateDCW
EnumFontsW
GetBkColor
CreateFontW
GetTextMetricsW
DeleteDC
GetStockObject
SelectObject
SetBkColor
GetTextExtentPoint32W
FloodFill
StretchBlt
PatBlt
Ellipse
CreateCompatibleDC
RectInRegion
CreateRoundRectRgn
CreateCompatibleBitmap
CreateFontIndirectW
CreateBrushIndirect
StretchDIBits
RealizePalette
CreatePalette
GetDIBits
GetObjectW
SetPixel
RoundRect
Rectangle
LPtoDP
DPtoLP
CreateSolidBrush

comdlg32

PrintDlgW
GetOpenFileNameW

winspool.drv

EnumPrintersW
ClosePrinter
DocumentPropertiesW
GetPrinterW
OpenPrinterW
SetPrinterW
GetPrinterDriverW
DeviceCapabilitiesW
SetFormW
GetFormW

advapi32

RegOverridePredefKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey

shell32

ShellExecuteW
SHGetFolderPathW
DragAcceptFiles

comctl32

ImageList_DrawEx
ord17
ImageList_GetIconSize

odbc32

ord154
ord4
ord13
ord31
ord24

Sections

.text
Size: 774KB - Virtual size: 773KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 863KB - Virtual size: 862KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

��lƣu
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b59c8bb17a97edc1120983ff5827f355

Headers

DLL Characteristics

File Characteristics

Imports

argobl1

barplus

bclw32

dbtable

pfgenerater

properties

winport

winppla

winpplb

winpplz

mfc90u

msvcr90

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

odbc32

Sections

.text Size: 774KB - Virtual size: 773KB

.rdata Size: 246KB - Virtual size: 245KB

.data Size: 6KB - Virtual size: 17KB

.rsrc Size: 863KB - Virtual size: 862KB

��lƣu Size: 16KB - Virtual size: 20KB

.text
Size: 774KB - Virtual size: 773KB

.rdata
Size: 246KB - Virtual size: 245KB

.data
Size: 6KB - Virtual size: 17KB

.rsrc
Size: 863KB - Virtual size: 862KB

��lƣu
Size: 16KB - Virtual size: 20KB