b3727b09510a8f6044554868f45332a8d7b2c8fcf0a5ad48d13496a43874da74

Sharing

Copy URL Twitter E-mail

General

Target

b3727b09510a8f6044554868f45332a8d7b2c8fcf0a5ad48d13496a43874da74
Size

1.3MB
MD5

064d34f3c0821cb875382203cd179ffd
SHA1

07796e541688aeb5a411bad0ee1e71b40dc0157d
SHA256

b3727b09510a8f6044554868f45332a8d7b2c8fcf0a5ad48d13496a43874da74
SHA512

05428854625e8de616b08c5917bae480d25c1fd2f0954c497550f15a7e50d7f1721a3b4a9e0f9c4f564e3aa36476cba8f91dcf728aa47d290b31c5d7c9c6f844
SSDEEP

24576:BlJy1S8OPB/ukyeBDjx8eq+otRtiL2FTOgyQkdGNXNM5fpemT3JdcJ:aE/yoSeqzmqkdNBTgJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3727b09510a8f6044554868f45332a8d7b2c8fcf0a5ad48d13496a43874da74

Files

b3727b09510a8f6044554868f45332a8d7b2c8fcf0a5ad48d13496a43874da74
.dll windows:4 windows x86 arch:x86

d0719f38aa95ef0a25973545d158f188

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord6139
ord287
ord2818
ord540
ord3571
ord3619
ord3626
ord3663
ord640
ord2405
ord537
ord6172
ord5789
ord2915
ord5875
ord5873
ord2414
ord5785
ord1641
ord1640
ord323
ord2754
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord289
ord823
ord613
ord610
ord800
ord1168
ord6394
ord6383
ord5440
ord5450
ord924
ord6876
ord6282
ord6283
ord2763
ord6648
ord6779
ord940
ord6663
ord6662
ord4278
ord6883
ord4277
ord6143
ord5861
ord5572
ord5683
ord4129
ord941
ord4204
ord1105
ord2841
ord541
ord2614
ord801
ord5199
ord2107
ord2860
ord6171
ord5710
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord3953
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord3573
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord6467
ord1578
ord600
ord826
ord269
ord539
ord858
ord1158
ord939
ord535
ord860
ord815
ord561
ord3738
ord4424
ord825
ord4622
ord4080
ord3079

msvcrt

getenv
_purecall
fclose
fopen
fread
fwrite
fseek
ftell
fflush
fputc
getc
fgets
fscanf
free
wcscmp
malloc
__CxxFrameHandler
strstr
_strlwr
_ftol
atoi
atof
wcslen
sprintf
wcscpy
wcschr
wcsstr
_mbscmp
strncmp
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
wcscat
_close
_lseek
realloc
floor
strncpy
calloc
_strnicmp
_CIpow
ldiv
_CIacos
_CIfmod
qsort
rand
_cabs
ceil
_CxxThrowException
_swab
_setjmp3
__CxxLongjmpUnwind
longjmp
printf
isprint
tmpnam
vsprintf
abort
_pctype
_isctype
__mb_cur_max
fprintf
fputs
_write
memmove
_iob
strchr
vfprintf
strtok
exit
sscanf
strrchr
_stricmp
putc
_errno
_getcwd
fgetc
perror
mktime
tmpfile
gmtime
puts
_snprintf
strtod
strcpy
strlen
memcpy
memset
pow
exp
log
sqrt
fabs
atan2
_open
_unlink
_setmode
_read

kernel32

GlobalSize
LockResource
CreateFileW
LocalAlloc
LocalFree
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
GetUserDefaultLangID
DeleteFileA
GetTickCount
GetCurrentDirectoryA
WritePrivateProfileStringA
GetLastError
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
DeleteCriticalSection
CreateEventA
InitializeCriticalSection
GetLocaleInfoA
WideCharToMultiByte
Sleep
LoadLibraryA
GetProcAddress
CopyFileA
MultiByteToWideChar
GlobalFree
CreateFileA
WriteFile
CloseHandle
FindResourceA
SizeofResource
LoadResource
GlobalAlloc
GlobalLock
GlobalUnlock

user32

FillRect
LoadImageA
ReleaseDC
GetIconInfo
DrawTextA
GetSysColor
IntersectRect
CopyRect
GetDC

gdi32

CreateSolidBrush
SetEnhMetaFileBits
GetEnhMetaFileHeader
SetWinMetaFileBits
GetDeviceCaps
DeleteEnhMetaFile
ExtTextOutA
GetEnhMetaFilePaletteEntries
CreatePalette
PlayEnhMetaFile
CreateRectRgn
CombineRgn
CreateFontIndirectA
SetTextColor
SetBkMode
GetCurrentObject
RectVisible
SetBkColor
StretchBlt
SaveDC
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SetStretchBltMode
SetDIBitsToDevice
BitBlt
RestoreDC
CreateDIBSection
CreateDIBPatternBrushPt
SetBrushOrgEx
PatBlt
CreateFontIndirectW
Rectangle
ExtCreatePen
GetBitmapBits
ExtTextOutW
GetTextCharacterExtra
StretchDIBits
GetTextExtentPoint32W
GetTextExtentPoint32A
DeleteObject
GetStockObject
SelectPalette
RealizePalette
CreateCompatibleBitmap
SelectObject
DeleteDC
CreateCompatibleDC
CreateBitmap
CreateFontA
TextOutA
GetObjectA
GetDIBits

advapi32

IsTextUnicode
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegCloseKey

ole32

CreateStreamOnHGlobal

gdiplus

GdipCreateBitmapFromFileICM
GdipGetImageGraphicsContext
GdipDisposeImage
GdipGetImageThumbnail
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdiplusStartup
GdipImageRotateFlip
GdipSaveImageToFile
GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipCloneImage
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipFree
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipCloneBitmapAreaI

msvcp60

?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

grgspgeneraltool

?GetProductVersionString@OSpGeneralTool@@QAE?AVCString@@PAUHINSTANCE__@@@Z
??0OSpGeneralTool@@QAE@PBD0@Z
??1OSpGeneralTool@@UAE@XZ
?bGetSpConfigString@OSpGeneralTool@@QAEHPBD0AAHPAD@Z

grgsplog

??1OGrgSpLogIntf@@UAE@XZ
?bCreate@OGrgSpLogIntf@@QAEHPAD0@Z
??0OGrgSpLogIntf@@QAE@XZ
?bDestory@OGrgSpLogIntf@@QAEHXZ
?bLog@OGrgSpLogIntf@@QAEHPADK@Z
?bLogDevCallExecute@OGrgSpLogIntf@@QAEHPAD0JABUtDevReturn@@@Z
?bLogDevCallStatus@OGrgSpLogIntf@@QAEHPAD0JABUtDevReturn@@@Z

zint

ZBarcode_Create
ZBarcode_Encode
ZBarcode_Print
ZBarcode_Clear
ZBarcode_Delete

shlwapi

PathFileExistsA
PathRemoveFileSpecA

ws2_32

ntohs
htonl
ntohl
htons

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??0OGrgSpLogIntf@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??4OGrgSpLogIntf@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_7OGrgSpLogIntf@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXABV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPBD0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
poCreateInstance

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0719f38aa95ef0a25973545d158f188

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

ole32

gdiplus

msvcp60

grgspgeneraltool

grgsplog

zint

shlwapi

ws2_32

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 132KB - Virtual size: 131KB

.data Size: 68KB - Virtual size: 96KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 28KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 132KB - Virtual size: 131KB

.data
Size: 68KB - Virtual size: 96KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 28KB