055dc31d9f89341209bb6355f6d0230b70099b9f94a172ba15caa065d7d3ba7b

Sharing

Copy URL Twitter E-mail

General

Target

055dc31d9f89341209bb6355f6d0230b70099b9f94a172ba15caa065d7d3ba7b
Size

1.7MB
MD5

722b57eae2669b9f98c9df2beeaa9985
SHA1

147c9d53571064d6b40679109f47de3da8d1a10b
SHA256

055dc31d9f89341209bb6355f6d0230b70099b9f94a172ba15caa065d7d3ba7b
SHA512

614083c727a4b6ac477013d979c15ebe2dd11a107fc59e32bb9ab3f34033e2dc8d4a63bd4705bc89f28ca700390c50c83b0a55916269c37958a1711f750291ef
SSDEEP

24576:foQVhX3UsTNjx+mZCkt76f/24pN+XNqNG6hditW:5tf9Ckt7c20+9qNxUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
055dc31d9f89341209bb6355f6d0230b70099b9f94a172ba15caa065d7d3ba7b

Files

055dc31d9f89341209bb6355f6d0230b70099b9f94a172ba15caa065d7d3ba7b
.exe windows:4 windows x86 arch:x86

6b3fe2939fb430e3ae12baa0280be9b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\ois\x86\ship\0\ois.pdb

Imports

kernel32

GetModuleFileNameW
RaiseException
CloseHandle
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
GetCommandLineW
GetProcAddress
LoadLibraryW
FreeLibrary
DeleteFileW
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetCurrentThreadId
FoldStringW
GetLocaleInfoW
Sleep
TlsAlloc
GetLastError
TlsGetValue
TlsFree
LoadLibraryA

user32

SetForegroundWindow
IsZoomed
IsIconic
ShowWindow
SetWindowPos
DestroyWindow
IsWindow
SetWindowPlacement
GetWindowPlacement
GetParent
UpdateWindow
LoadImageW
GetSystemMetrics
LoadIconW
MapVirtualKeyW
PostMessageW

msocf

?Init@CToolbarData@MsoCF@@QAGXPBUStaticToolbarDesc@2@IPBUStaticMenuDesc@2@I@Z
??0CToolbarData@MsoCF@@QAE@XZ
?TheApp@Frame@MsoCF@@YGPAUAFrameApp@2@XZ
?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z
?Set@Properties@MsoCF@@YGXPAUIPropertySet@2@ABUPropertyInfo@2@PBXW4PropertyType@2@@Z
?LookupProperty@MsoCF@@YGABUPropertyInfo@1@I@Z
?TheActionManager@MsoCF@@YGPAUIActionManager@1@XZ
?Start@Frame@MsoCF@@YGXXZ
?Start@Utilities@MsoCF@@YGXHPAU_msotcfcf@@@Z
?Free@Allocator@Memory@MsoCF@@YGXPAX@Z
?SetWzFromPattern@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IQAPB_WHPAH@Z
?SetWtzFromPattern@Strings@MsoCF@@YGXAAV?$CWtzInBuffer_Template@V?$CBuffer@_W@MsoCF@@@2@PAUHINSTANCE__@@IQAPB_WH@Z
?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z
?SetWzFromResource@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IPAH@Z
?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z
??1CToolbarData@MsoCF@@QAE@XZ
?SetWzFromNumber@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@IHHPAH@Z
?g_FastBufferAllocator@MsoCF@@3VCFastBufferAllocator@1@A
?g_FixedBufferAllocator@MsoCF@@3VCFixedBufferAllocator@1@A
?Finish@Utilities@MsoCF@@YGXXZ
?Finish@Frame@MsoCF@@YGXXZ
?TerminateTheApp@Frame@MsoCF@@YGXXZ

oisapp

?OnSetFocus@OISAppApi@@YGXXZ
?CreateMediaWindow@OISAppApi@@YGPAUHWND__@@PAU2@@Z
?ExitInstance@OISAppApi@@YGXXZ
?Singleton@CAppOA@@SGPAV1@XZ
?GetRootCollection@CAppOA@@SGXPAPB_W@Z
?CdlDoIdle@OISAppApi@@YGXXZ
?GetCDLContext@OISAppApi@@YGPAUICdlContext@Cdl@@XZ
?GetApp@OISAppApi@@YGPAVCOISApp@@XZ
?DgRedEyePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgRotatePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgRenamePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@_N@Z
?DgHueSatPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgBrightContrastPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?GetTestWizardInfo@COISApp@@SGXW4TestWizardRequestedItem@@PAXPAUtagPOINT@@@Z
?DgFileFormatOptDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgResizeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@_N@Z
?DgEditHomeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgNavigationPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgPublishDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgUploadDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgEditModeButtonBar@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgUploadModeButtonBar@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgCompressPicsDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgLocatePicturesDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgHomeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgEmailDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgPropertiesPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?SetTestWizardInfo@COISApp@@SGJKUtagVARIANT@@@Z
?SetShowToolbar@OISAppApi@@YGXP6GXH@Z@Z
?SetContextMenuCallback@OISAppApi@@YGXP6GXHABUtagPOINT@@H@Z@Z
?SetFrameHwnd@OISAppApi@@YGXPAUHWND__@@@Z
?InitInstance@OISAppApi@@YGXPAUMSOINST@@PAUHINSTANCE__@@ABVCThreadLocalStorage@Ofc@@@Z
?DoEditMode@COISApp@@QAEXABV?$TArray@VCVarStr@Ofc@@@Ofc@@_N@Z
?DoSendToMode@COISApp@@QAEXABUDownloadSettings@@@Z
?DoDownloadMode@COISApp@@QAEXAAUDownloadSettings@@@Z
?DoUploadMode@COISApp@@QAEXABV?$TArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoBrowseMode@COISApp@@SGXABV?$TArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoNormalMode@COISApp@@SGXXZ
?FDoShutdown@OISAppApi@@YG_NXZ
?CdlDoEvent@OISAppApi@@YG_NAAUtagMSG@@@Z
?RFMDisableApp@COISApp@@QAEXXZ
?CdlWorkPaneCallback@OISAppApi@@YGHHHPAX00@Z
?DgCropPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?GetOISSelectionContext@OISAppApi@@YGXPAPAUIActionContext@MsoCF@@@Z

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__CxxFrameHandler3
memset
_CxxThrowException
memcpy
memmove
_amsg_exit
__getmainargs

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6b3fe2939fb430e3ae12baa0280be9b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msocf

oisapp

msvcr80

Sections

.text Size: 61KB - Virtual size: 60KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 61KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB