5b7966ee0c649652d1de64953f3628bc2c6fa5dd994f7ff47be06dfb28e0b6a8

Sharing

Copy URL Twitter E-mail

General

Target

5b7966ee0c649652d1de64953f3628bc2c6fa5dd994f7ff47be06dfb28e0b6a8
Size

124KB
MD5

27a5be71c15c270f9e524042d87e93cd
SHA1

ae5bbaa0322e4754357c600a6d25558b31bfede6
SHA256

5b7966ee0c649652d1de64953f3628bc2c6fa5dd994f7ff47be06dfb28e0b6a8
SHA512

7bbb84ee41849bc9ab59292eed1d771ffca67960a4646e363baafc30d83e402a45a4d74312ea01472981032fd4776ba5d6467ed8dae48b386c836972b4e6e25f
SSDEEP

1536:bDq68OR5kNNABLupZ2NAtQpf5cd13RJsFtEWmigvcfaqsUE5nQ8:bDq6zuNNA9u0AtQphcbRJkyftE2nQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b7966ee0c649652d1de64953f3628bc2c6fa5dd994f7ff47be06dfb28e0b6a8

Files

5b7966ee0c649652d1de64953f3628bc2c6fa5dd994f7ff47be06dfb28e0b6a8
.exe windows:4 windows x86 arch:x86

d1e9b5013ab75c43fb28198d16e0b8ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hcreg6

?GetPMPDirectory@@YA?AVCString@@XZ
hcreg_SetErrorHandler
?GetDriverDirectory@@YA?AVCString@@XZ
?GetProgramName@@YA?AVCString@@XZ
?GetProductName@@YA?AVCString@@XZ
?GetAppKey@@YA?AVCString@@PBD@Z
?GetCurrentPlotStylePolicy@@YAKXZ
IsACADApp
?GetProductBaseName@@YA?AVCString@@XZ
?GetCompanyName@@YA?AVCString@@XZ
?GetPlotStylesDirectory@@YA?AVCString@@XZ

plotcfg6

?what@HT_Exception@@UBEPBDXZ
??1HT_Exception@@UAE@XZ
?SPMP@@YAPAVHT_SPMem_Pool@@XZ

plcfmgr

?sty_to_pm3@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@V?$HT_Smart_Pointer@VHT_Style_Sheet_Configuration@@@@PBD_N@Z
?load_sty@HT_Plot_Config_Manager@@QAE?AV?$HT_Smart_Pointer@VHT_Style_Sheet_Configuration@@@@VHT_String@@@Z
??0HT_Style_Sheet_Configuration_Imp@@QAE@XZ
?load_pc2@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@PBD000AAVHT_String@@JV?$HT_Smart_Pointer@VHT_Plot_Config@@@@@Z
??0HT_Plot_Style_Imp@@QAE@PBD@Z
?update_sty_cfg@HT_Plot_Config_Manager@@QAEX_NPBD1HVHT_String@@V?$HT_Smart_Pointer@VHT_Style_Sheet_Configuration@@@@V?$HT_Smart_Pointer@VHT_Error_Handler@@@@1AA_N555@Z
?save_sty@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@PBD0J@Z
?load_cfg@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@PBD0HVHT_String@@1J@Z
??0HT_Plot_Config_Manager@@QAE@AAVHT_String@@00V?$HT_Smart_Pointer@VHT_Error_Handler@@@@K@Z
?load_pcp@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@PBD000AAVHT_String@@JV?$HT_Smart_Pointer@VHT_Plot_Config@@@@@Z

heidi6

??2HT_Object@@SAPAXI@Z
??1HT_String@@UAE@XZ
??1HT_Object@@UAE@XZ
??0HT_String@@QAE@PBD@Z
?copy@HT_String@@QAEXPBD@Z
??0HT_String@@QAE@ABV0@@Z
??3HT_String@@SAXPAX@Z
??3HT_Object@@SAXPAX@Z

apperr

HD_Create_App_Error_Handler

styedit

StyEditEx

mfc42

ord5067
ord3356
ord5280
ord4834
ord5016
ord4375
ord826
ord269
ord5953
ord1176
ord1243
ord1576
ord600
ord823
ord1907
ord3610
ord2411
ord2023
ord4218
ord2578
ord6055
ord1776
ord4398
ord5290
ord4837
ord3402
ord4424
ord3582
ord5161
ord4905
ord4742
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5287
ord3798
ord4835
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord616
ord656
ord800
ord768
ord860
ord567
ord540
ord489
ord825
ord2370
ord2299
ord2302
ord4258
ord4976
ord3181
ord941
ord939
ord940
ord668
ord3097
ord2642
ord3092
ord1980
ord858
ord3178
ord2781
ord2770
ord924
ord356
ord6215
ord537
ord5160
ord5162
ord3317
ord922
ord4224
ord3790
ord535
ord4710
ord5849
ord3499
ord2515
ord1168
ord5710
ord4129
ord2763
ord2818
ord6467
ord818
ord2463
ord6199
ord3874
ord1651
ord2867
ord1578
ord4635
ord4607
ord4716
ord4750
ord4608
ord5288
ord2528
ord4852
ord3615
ord355
ord641
ord2864
ord3663
ord541
ord801
ord5861
ord5821
ord3662
ord414
ord713
ord5859
ord2358
ord2652
ord1669
ord2614
ord2817
ord2764
ord5683
ord6283
ord6282
ord6334
ord5981
ord1908
ord4715
ord1690
ord2621
ord1134
ord4439
ord2054
ord4431
ord771
ord497
ord4259
ord1008
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815

msvcrt

_mbsicmp
strpbrk
_CxxThrowException
_mbsnbcpy
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_stricmp
_mkdir
_ismbblead
exit
_EH_prolog
??1type_info@@UAE@XZ
__doserrno
strcspn
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__CxxFrameHandler
atoi
??0exception@@QAE@ABV0@@Z
_splitpath
__dllonexit
_onexit
_setmbcp
_controlfp

kernel32

GetModuleHandleA
GetStartupInfoA
CreateFileA
GetModuleFileNameA
SetErrorMode
CloseHandle
GetLastError
FormatMessageA
LocalFree
lstrcpyA
lstrlenA
LocalAlloc

user32

GetParent
EnableWindow
PostMessageA
SendMessageA
EnumChildWindows

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

msvcirt

?openprot@filebuf@@2HB
??0ifstream@@QAE@PBDHH@Z
??1ios@@UAE@XZ
??1ifstream@@UAE@XZ
??_Difstream@@QAEXXZ
?get@istream@@IAEAAV1@PADHH@Z
_mtlock
_mtunlock

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1e9b5013ab75c43fb28198d16e0b8ef

Headers

File Characteristics

Imports

hcreg6

plotcfg6

plcfmgr

heidi6

apperr

styedit

mfc42

msvcrt

kernel32

user32

advapi32

msvcirt

Sections

.text Size: 52KB - Virtual size: 50KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 44KB - Virtual size: 43KB

.text
Size: 52KB - Virtual size: 50KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 44KB - Virtual size: 43KB