CADe_SIMU[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CADe_SIMU.exe
Size

18.9MB
MD5

9afdeb16784cca74ac7d1c3a6f3acc24
SHA1

474bdf924329c126f9579673bec9e291fa40527c
SHA256

b6898c19fead1009e31936ad0660dca16339de634034e0c70c8417455c6514fc
SHA512

45e4a543dc9919b664e2167c90f2210caf51aa3f88a5c1162987e67f6d11e9cfab519c0ddd1fb74180342b00c84c98fe0a47a1a1775cc4ed5b45f7c873cb0a2f
SSDEEP

196608:Fasx/aw+juSDhVhrhahgM7m/8+VPeKxcYWiW+:FNouSnM7SvBnd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CADe_SIMU.exe

Files

CADe_SIMU.exe
.exe windows:4 windows x86 arch:x86

8398b4c6a6e6f0a8f96557612f7f590a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

libnodave

daveNewInterface
daveSetTimeout
daveWriteBytes
openSocket
closeSocket
daveGetU8
daveReadBytes
daveNewConnection
daveConnectPLC

mfc42d

ord3362
ord1364
ord3651
ord4176
ord1781
ord4118
ord5076
ord3618
ord4208
ord2078
ord1310
ord3069
ord3944
ord3670
ord2076
ord1566
ord5078
ord3002
ord4064
ord1344
ord4191
ord1830
ord1631
ord4205
ord2340
ord2481
ord2584
ord3691
ord2473
ord2585
ord2341
ord2432
ord2339
ord3143
ord3144
ord3142
ord2431
ord3367
ord3786
ord3658
ord1952
ord1228
ord4492
ord2875
ord684
ord574
ord736
ord492
ord317
ord728
ord1743
ord1756
ord1772
ord1761
ord1857
ord3524
ord5056
ord813
ord734
ord3831
ord3948
ord1748
ord1766
ord850
ord3779
ord3776
ord3774
ord3552
ord5077
ord3702
ord1880
ord1860
ord3231
ord1033
ord4130
ord1789
ord2661
ord4227
ord4229
ord2104
ord3366
ord3826
ord4239
ord4215
ord4408
ord3784
ord3657
ord2021
ord1285
ord2986
ord528
ord706
ord730
ord5065
ord4951
ord567
ord4228
ord4143
ord308
ord996
ord403
ord719
ord3446
ord4820
ord2052
ord1532
ord3502
ord1098
ord1401
ord3527
ord3825
ord2411
ord2415
ord5058
ord1858
ord1876
ord4178
ord1350
ord4304
ord2484
ord4387
ord3656
ord4000
ord3950
ord1797
ord3636
ord2753
ord2509
ord4749
ord3373
ord4785
ord4901
ord3785
ord3660
ord582
ord328
ord590
ord1136
ord1510
ord4258
ord714
ord2636
ord4123
ord880
ord342
ord487
ord3938
ord3382
ord1232
ord1956
ord4475
ord3778
ord3777
ord3716
ord4028
ord1468
ord3542
ord3758
ord3978
ord4068
ord3611
ord3969
ord3729
ord3739
ord3738
ord3726
ord3728
ord3725
ord4003
ord4001
ord3379
ord4756
ord1365
ord4175
ord4216
ord3001
ord1342
ord3664
ord671
ord462
ord4190
ord943
ord824
ord4780
ord418
ord470
ord1660
ord2640
ord2107
ord2800
ord4458
ord1729
ord298
ord2042
ord4884
ord4787
ord596
ord4997
ord4566
ord1717
ord349
ord4282
ord3517
ord648
ord3415
ord3570
ord3201
ord5072
ord2324
ord877
ord454
ord4460
ord415
ord812
ord3010
ord1042
ord573
ord556
ord5051
ord4896
ord2170
ord507
ord3110
ord3116
ord2420
ord4753
ord4835
ord474
ord3836
ord1871
ord1275
ord2010
ord1041
ord3369
ord721
ord2488
ord1863
ord343
ord5086
ord3059
ord511
ord3312
ord562
ord2760
ord4978
ord4457
ord1639
ord316
ord1638
ord293
ord3478
ord450
ord1884
ord302
ord1100
ord2799
ord677
ord4811
ord2084
ord1834
ord4126
ord4832
ord3170
ord3309
ord3867
ord3862
ord559
ord565
ord586
ord680
ord3990
ord3889
ord4821
ord3890
ord3870
ord3845
ord422
ord3768
ord3616
ord3848
ord4011
ord3442
ord3427
ord4101
ord3819
ord2329
ord1861
ord305
ord486
ord4380
ord944
ord903
ord945
ord558
ord900
ord735
ord901
ord296
ord4162
ord1376
ord1215
ord4061
ord4291
ord4170
ord4015
ord2824
ord717
ord1446
ord4268
ord1996
ord1264
ord410
ord643
ord2993
ord2991
ord1408
ord282
ord1295
ord1179
ord1632
ord2423
ord1048
ord1183
ord4256
ord768
ord764
ord5084
ord791
ord787
ord1434
ord3533
ord4079
ord1609
ord2103
ord1784
ord2412
ord4078
ord4082
ord3692
ord3575
ord2680
ord4021
ord974
ord4279
ord2717
ord2223
ord2222
ord3430
ord3361
ord4174
ord1779
ord4211
ord2077
ord1309
ord3666
ord1829
ord3661
ord391
ord599
ord4185
ord1258
ord1990
ord475
ord1747
ord1770
ord1757
ord4894
ord4775
ord4793
ord4805
ord4806
ord3821
ord299
ord335
ord306
ord1019
ord2634
ord2383
ord478
ord1754
ord4390
ord1811
ord2633
ord2351
ord678
ord1435
ord3534
ord3167
ord1636
ord1785
ord4080
ord4083
ord3693
ord2679
ord973
ord2224
ord3431
ord1780
ord4212
ord3667
ord3662
ord697
ord681
ord516
ord479
ord392
ord4778
ord4945
ord3420
ord1855
ord2055
ord2054
ord4689
ord1624
ord3450
ord1656
ord3685
ord4186
ord1259
ord1991
ord4031
ord3421
ord646
ord413
ord1799
ord1809
ord2206
ord3717
ord294
ord476
ord4794
ord4802
ord1304
ord4462
ord4467
ord4103
ord2434
ord1490
ord3757
ord3627
ord3972
ord3970
ord4004
ord4002
ord1343
ord526
ord704
ord3551
ord2448
ord1284
ord2020
ord4864
ord4556
ord1316
ord2378
ord1864
ord351
ord3637
ord1590
ord1862
ord4017
ord3629
ord4195
ord1190
ord1087
ord1313

msvcrtd

abs
memcpy
sin
cos
sqrt
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
strlen
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strcpy
_ftol
atof
sprintf
atoi
_chkesp
__CxxFrameHandler
_setmbcp
_initterm
strcat

kernel32

GlobalLock
ExitProcess
GetStartupInfoA
GetModuleHandleA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalReAlloc
GlobalUnlock

user32

SetCursor
wsprintfA
SetClipboardData
GetClipboardData
IsClipboardFormatAvailable
MessageBeep
EmptyClipboard
CloseClipboard

gdi32

SetDIBitsToDevice
CreateDIBitmap
StretchDIBits
GetDIBits

shell32

ShellExecuteA

mfco42d

ord798

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.1MB - Virtual size: 13.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8398b4c6a6e6f0a8f96557612f7f590a

Headers

File Characteristics

Imports

libnodave

mfc42d

msvcrtd

kernel32

user32

gdi32

shell32

mfco42d

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.rdata Size: 164KB - Virtual size: 160KB

.data Size: 8KB - Virtual size: 224KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 13.1MB - Virtual size: 13.1MB

.reloc Size: 188KB - Virtual size: 184KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.rdata
Size: 164KB - Virtual size: 160KB

.data
Size: 8KB - Virtual size: 224KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 13.1MB - Virtual size: 13.1MB

.reloc
Size: 188KB - Virtual size: 184KB