4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e

Sharing

Copy URL Twitter E-mail

General

Target

4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e
Size

2.4MB
MD5

d65d2e17bf4a62b32088c94e4de734ab
SHA1

647eb8a975f7bac9e70326c7fc48ea067f41ec92
SHA256

4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e
SHA512

8bbfe5b7a69bb41f11e61a2c5878b1f2e1a7a2129155f2ed56e56dbf29f8282d6f5e9af4490f2663db2a90c0c6c235718aa8600b64c1845d59a602e3b2a80775
SSDEEP

49152:+m/xooWlq2BUplUwGZMiXvlbO/kLg6Vk6S:pxozrBUj+dnV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e

Files

4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e
.dll windows:5 windows x86 arch:x86

d754e7a5faaed415c645a0aec036af3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\Program Files (x86)\Jenkins\workspace\Polly-Release\pollywin_vs2017\Release\lsx-ases.pdb

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetLastError
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
WaitForSingleObject
ExitThread
GetExitCodeThread
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapReAlloc
FlushFileBuffers
GetConsoleCP
WriteFile
HeapAlloc
HeapFree
RtlUnwind
RaiseException
ReadFile
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameA
GetACP
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle

libopenblas

cblas_daxpy
cblas_dcopy
cblas_ddot
cblas_dgbmv
cblas_dgemm
cblas_dgemv
cblas_dger
cblas_drot
cblas_dscal
cblas_dspmv
cblas_dspr
cblas_dspr2
cblas_dsymm
cblas_dsyrk
cblas_dtpmv
cblas_dtpsv
cblas_saxpy
cblas_scopy
cblas_sdot
cblas_sgbmv
cblas_sgemm
cblas_sgemv
cblas_sger
cblas_srot
cblas_sscal
cblas_sspmv
cblas_sspr
cblas_sspr2
cblas_ssymm
cblas_ssyrk
cblas_stpmv
cblas_stpsv
dgesvd_
dgetrf_
dgetri_
dsptrf_
dsptri_
dtptri_
sgesvd_
sgetrf_
sgetri_
ssptrf_
ssptri_
stptri_

Exports

Exports

LsxAsesAudioDataIn
LsxAsesAudioEnd
LsxAsesAudioGetSnrDb
LsxAsesAudioInit
LsxAsesAudioQuality
LsxAsesGetErrorInfo
LsxAsesGetParam
LsxAsesSessionBegin
LsxAsesSessionDataIn
LsxAsesSessionEnd
LsxAsesSessionGetResult
LsxAsesSessionSetParam
LsxAsesSessionSpeechIn
LsxAsesSetParam
LsxAsesStart
LsxAsesStop
LsxAsesVersion
LsxAsesVoasGetText
LsxAsesVoasGetTextSplit
LsxAsesVoasGetTextSplitCount
LsxAsesVoasIsKeyWord
LsxAsesVoasLoadNet
LsxAsesVoasUnLoadNet

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d754e7a5faaed415c645a0aec036af3e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

libopenblas

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 331KB - Virtual size: 331KB

.data Size: 60KB - Virtual size: 69KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 85KB - Virtual size: 85KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 331KB - Virtual size: 331KB

.data
Size: 60KB - Virtual size: 69KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 85KB - Virtual size: 85KB