9a5be7ef8fce98e54624111842a0acea7de85df374b6351db2d096706fd3bc0a

Sharing

Copy URL Twitter E-mail

General

Target

9a5be7ef8fce98e54624111842a0acea7de85df374b6351db2d096706fd3bc0a
Size

540KB
MD5

cefecebeb2277cdc2f790b3cc620b2a4
SHA1

3a424128b6f15394dd64912e3bde60d2475cbc41
SHA256

9a5be7ef8fce98e54624111842a0acea7de85df374b6351db2d096706fd3bc0a
SHA512

02aaf090a2269ae1688955bd12597a1dd5274aace65e116396317109065aee1853ff1fb291d6128764a03505dd7d43a03a724babf1e3d963cde7c39a26a79b68
SSDEEP

12288:qeGqee5eTUB+1i39t8m4K5TblkfHA5l5+sPf5rzpL9N:SMzygVBN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a5be7ef8fce98e54624111842a0acea7de85df374b6351db2d096706fd3bc0a

Files

9a5be7ef8fce98e54624111842a0acea7de85df374b6351db2d096706fd3bc0a
.dll windows:4 windows x86 arch:x86

8da77663c416da7f1b65ec2bc47bcbd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetTempPathW
CopyFileW
GetExitCodeThread
Sleep
CreateProcessW
MultiByteToWideChar
CreateEventW
CancelIo
GetLastError
WriteFile
ReadFile
SetEvent
ConnectNamedPipe
CreateNamedPipeW
CreateFileW
WaitNamedPipeW
GetOverlappedResult
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
TerminateThread
SetEndOfFile
LoadLibraryA
TerminateProcess
GetExitCodeProcess
Process32NextW
GetTickCount
ReleaseSemaphore
WaitForSingleObject
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
GetCurrentProcess
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
SetLastError
TlsFree
TlsAlloc
ExitProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringW
DeleteFileW
FindFirstFileW
FindClose
GetPrivateProfileIntW
WritePrivateProfileStringW
WideCharToMultiByte
CloseHandle
LoadLibraryW
GetProcAddress
CreateSemaphoreW
FreeLibrary
GetVersion
GetCommandLineA
ExitThread
HeapAlloc
RtlUnwind
HeapFree
GetFileAttributesW
InterlockedDecrement
InterlockedIncrement
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue

user32

PostMessageW
SendMessageW
MessageBoxW
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW

ole32

CoInitializeEx
CoInitialize
CoUninitialize

cdmapi32

ord33
ord77
ord25
ord51
ord78
ord9
ord36
ord37
ord68
ord10
ord47
ord48
ord90
ord76

ipssrun

?PNL_PNLLDStringFromLDStruct@@YAHPAV_PANEL_RUN_GLOBAL@@PAU_OMRON_DEVICE@@PAGW4_PNLLD_CONV_TYPE@@@Z
?PNLChangeOmronDeviceFromFinsFormat@@YAHPAV_PANEL_RUN_GLOBAL@@PBDHPAU_TAG_DEVICE@@PAU_OMRON_DEVICE@@@Z
ord381
?PNLIsTagCheckHost@@YAHPAV_PANEL_RUN_GLOBAL@@H@Z
ord306
ord144
?PNLGetHostNameFromHostID@@YAHPAV_PANEL_RUN_GLOBAL@@GPAU_HOST@@@Z
?PNLCheckDataType@@YAFPAU_ADDRESS_NUM@@JJH_N@Z
ord408
?PNLCheckExecTagCollation@@YAHPAV_PANEL_RUN_GLOBAL@@PAV_PANEL_RUN_WINDOW@@@Z
?prgGlobal@@3V_PANEL_RUN_GLOBAL@@A

cxwin

ord1

winmm

timeGetTime

taglist

?NSGetTagData@@YAHHKPAGHAAHAAK1@Z
?NSCountTagDeviceNum@@YAHHK@Z
?NSGetVariableName@@YAHHKPAGH@Z
?NSCheckExistTagList@@YAHXZ
?NSLoadTaglistData@@YAPAXPAG@Z
?NSLoadTaglistHeader@@YAPAXPAG@Z
?NSGetOverTagListCount@@YAHXZ
?NSGetVMParameter@@YAHPADAAKAAH2@Z
?NSGetVMParameterbyPointName@@YAHPADAAKAAH2@Z
?NSGetTagListData@@YAHHKAAHAAK0@Z

sim_tagcheck

SIM_GetDeviceInfo

cxserverinterfacestub

?CDMSClosePLC@@YAGG@Z
?CDMSOpenProject@@YAGPAUHWND__@@PAXPADGPAG@Z
?CDMSOpenPLC@@YAGGPADGPAG@Z
?CDMSSetData@@YAGGPAU_tagCDMDATA@@P6GX0J@ZJ@Z
?CDMSGetNotFoundErrorVariable@@YAHPAGH0H@Z
?CDMSGetSizeErrorVariable@@YAHPAGH0H@Z
?CDMSEnumDeviceData@@YAGGPBD0GP6GH0J@ZJ@Z
?CDMSPLCCommand@@YAGGGPAXGP6GHGG0GJ@ZJ@Z
?CDMSRestartGetData@@YAGGPBDGGP6GHPAU_tagCDMDATA@@J@ZJ@Z
?CDMSPauseGetData@@YAGGPBDGGP6GHPAU_tagCDMDATA@@J@ZJ@Z
?CDMSGetData@@YAGGPBDGGP6GHPAU_tagCDMDATA@@J@ZJ@Z
?CDMSCloseProject@@YAGG@Z

taglistaccesscontroller

?GetTagChangeCompleteFlg@@YAHHAAH@Z
?FindTag@@YAPBDHKAAHAAK0@Z

Exports

Exports

?PNLCheckMonitorDone@@YAHPAX@Z
?PNLConnectCM@@YAHPAXPAG@Z
?PNLDisconnectCM@@YAHPAX@Z
?PNLFreeMemory@@YAXPAX@Z
?PNLGetB@@YAHJJPAG@Z
?PNLGetHB@@YAHJJPAG@Z
?PNLGetHW@@YAHJJPAG@Z
?PNLGetSB@@YAHJPAG@Z
?PNLGetSW@@YAHJJPAG@Z
?PNLGetTR@@YAHJJPAG@Z
?PNLGetW@@YAHJJPAG@Z
?PNLLDClose@@YAHPAX@Z
?PNLLDEndCM@@YAHPAXH@Z
?PNLLDErrorFunc@@YAHPAXKKKKK@Z
?PNLLDGetWaitingForWriteInDemand@@YAHPAX0PAH1@Z
?PNLLDLoadCMDll@@YAHPAV_PANEL_RUN_GLOBAL@@@Z
?PNLLDOpen@@YAHPAXPAUHWND__@@PAGH2@Z
?PNLLDStartCM@@YAHPAGPAPAX@Z
?PNLMultiByteToWideChar@@YAPAGPAD@Z
?PNLSetB@@YAHJJPAGH@Z
?PNLSetHB@@YAHJJPAGH@Z
?PNLSetHW@@YAHJJPAGH@Z
?PNLSetSB@@YAHPAXJPAGH@Z
?PNLSetSW@@YAHPAXJJPAGH@Z
?PNLSetTR@@YAHJJPAG@Z
?PNLSetW@@YAHJJPAGH@Z
?PNLWideCharToMultiByte@@YAPADPAG@Z
?VLA_ExClose@@YAHPAXF@Z
?VLA_ExOpen@@YAHPAXF@Z
?VLA_ExRecvMsg@@YAHPAXFPAG1PAJ02J@Z
?VLA_ExSendMsg@@YAHPAXFGGJ0JJ@Z

Sections

.text
Size: 220KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 224KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8da77663c416da7f1b65ec2bc47bcbd9

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

cdmapi32

ipssrun

cxwin

winmm

taglist

sim_tagcheck

cxserverinterfacestub

taglistaccesscontroller

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 217KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 224KB - Virtual size: 229KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 220KB - Virtual size: 217KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 224KB - Virtual size: 229KB

.reloc
Size: 20KB - Virtual size: 17KB