08f1d573beeb2ac31639af581569b66f63f02958de3749f5270bc60b5b729e10

Sharing

Copy URL Twitter E-mail

General

Target

08f1d573beeb2ac31639af581569b66f63f02958de3749f5270bc60b5b729e10
Size

796KB
MD5

8cdf08bc5d0e52d794324b2fc51febbd
SHA1

3a695f585306ec3918246c871f8be89066453a4d
SHA256

08f1d573beeb2ac31639af581569b66f63f02958de3749f5270bc60b5b729e10
SHA512

f1417e56b06797a553686610d9bf7cb9edc961af0c55b0f172702e9997df92c6a530382944df5cac5c9eb494e771035ff364de5a29fa579d0d952b027daecd92
SSDEEP

12288:/sMFU4TAFQ3v1GolgZxIH5r7jBAjlx+7bJcQPNvzp7R4P2erywsBHprj/qptOkvT:/sMFNTGw5jyW7bJzPlBR4PXOwsCtO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08f1d573beeb2ac31639af581569b66f63f02958de3749f5270bc60b5b729e10

Files

08f1d573beeb2ac31639af581569b66f63f02958de3749f5270bc60b5b729e10
.dll windows:4 windows x86 arch:x86

45831543ffff2e8e33078fcd7c0efe56

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\BlueMarble\Libdev\BMFlex\Release\bmflexdll.pdb

Imports

oleaut32

SysAllocString

msvcr71

__dllonexit
__CppXcptFilter
_adjust_fdiv
_initterm
_except_handler3
__security_error_handler
memmove
_unlink
toupper
__mb_cur_max
_isctype
_pctype
strtol
fgets
ungetc
clearerr
atol
_beginthread
_endthread
_putenv
vsprintf
_wunlink
_wremove
remove
_waccess
_wrename
rename
_wstat
_close
_wopen
_wfreopen
freopen
_wfopen
getchar
_popen
fgetc
perror
exit
mktime
_findfirst
_findnext
_stat
_findclose
qsort
memcmp
free
realloc
longjmp
srand
rand
__p__environ
getenv
_sys_nerr
_sys_errlist
_exit
fprintf
malloc
tolower
strrchr
fflush
_setjmp3
_errno
calloc
_iob
abs
localtime
strncmp
sscanf
strcmp
sprintf
strcat
strcpy
_stricmp
??2@YAPAXI@Z
ctime
strncpy
atoi
_splitpath
fopen
_open
_getcwd
_getpid
fseek
ftell
??_U@YAPAXI@Z
fread
strstr
??3@YAXPAX@Z
??_V@YAXPAX@Z
fclose
strchr
strlen
time
memset
memcpy
_access
_onexit

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
DeviceIoControl
WriteFile
ReadFile
CreateFileA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetLastError
VirtualFree
VirtualAlloc
GetDriveTypeA
GetVolumeInformationA
FindClose
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
GetCurrentProcess
GetProcessTimes
GetEnvironmentVariableW
GetEnvironmentVariableA
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
CreateMutexA
GetLastError
ReleaseMutex
SetHandleInformation
SetErrorMode
GetModuleHandleA
GetTickCount
SetEvent
CreateEventA
ResetEvent
WaitForSingleObject
CloseHandle
Sleep
GetVersion
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA

user32

CreateDialogIndirectParamA
DialogBoxIndirectParamA
wsprintfA
GetSystemMetrics
MoveWindow
ShowWindow
GetClientRect
SetFocus
GetFocus
GetParent
EndDialog
GetDlgItemTextA
GetDlgItemTextW
SetDlgItemTextA
MessageBeep
GetWindowLongA
SendMessageA
SetWindowTextA
MessageBoxA
GetDlgItem
GetWindowRect
GetActiveWindow
EnableWindow
ScreenToClient

netapi32

Netbios

advapi32

RegCloseKey
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
GetUserNameA
GetUserNameW
RegEnumKeyExA

comdlg32

GetOpenFileNameA

comctl32

ord17

wsock32

closesocket
gethostname

Exports

Exports

??0Cbmflexdll@@QAE@XZ
??4Cbmflexdll@@QAEAAV0@ABV0@@Z
?fnbmflexdll@@YAHXZ
?nbmflexdll@@3HA
CheckStatus
GetErrorMessage
GetHostID
GetLicense
GetLicenseWithStatus
GetLocalHostID
ReleaseJob
ReleaseLicense
ReturnBorrowedLic
ValidateCodeSpace
ValidateSymbol

Sections

.text
Size: 624KB - Virtual size: 620KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_TEXT_HA
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45831543ffff2e8e33078fcd7c0efe56

Headers

File Characteristics

PDB Paths

Imports

oleaut32

msvcr71

kernel32

user32

netapi32

advapi32

comdlg32

comctl32

wsock32

Exports

Exports

Sections

.text Size: 624KB - Virtual size: 620KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 48KB - Virtual size: 81KB

_TEXT_HA Size: 68KB - Virtual size: 66KB

.reloc Size: 24KB - Virtual size: 20KB

.text
Size: 624KB - Virtual size: 620KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 48KB - Virtual size: 81KB

_TEXT_HA
Size: 68KB - Virtual size: 66KB

.reloc
Size: 24KB - Virtual size: 20KB