9ca2bac7bcd72d8de4f7c06ae1a7e06d207f6972500c7153688981b9ddf424c8

Sharing

Copy URL Twitter E-mail

General

Target

9ca2bac7bcd72d8de4f7c06ae1a7e06d207f6972500c7153688981b9ddf424c8
Size

880KB
MD5

15ba853aaf106fb60f588d7d0eb071dc
SHA1

0ff9f4e93af0367addfd8dc94224e7679535b005
SHA256

9ca2bac7bcd72d8de4f7c06ae1a7e06d207f6972500c7153688981b9ddf424c8
SHA512

41cabdf44e688d6c5383e14e4e5edf8b328428e0dc413b79324c958af5b410c642c64a443cebf3940a428b7b8b539dae035528c0427f15f4b0beae748bcab0e3
SSDEEP

24576:hmU3pqCr4HciFw4rIIC3olIjTViAQQAAwykCksmTrVYi8esE3gcdaXlJxf8h+/Ga:hmU3pqCQcizrIIC3olIjTViAQQAAwykO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ca2bac7bcd72d8de4f7c06ae1a7e06d207f6972500c7153688981b9ddf424c8

Files

9ca2bac7bcd72d8de4f7c06ae1a7e06d207f6972500c7153688981b9ddf424c8
.dll windows:4 windows x64 arch:x64

76e3fc4c5fab4ad92b7866662b6c4b22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libgcc_s_seh-1

_Unwind_Resume

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

api-ms-win-crt-convert-l1-1-0

mbrtowc
wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fputc
fwrite

api-ms-win-crt-string-l1-1-0

memset
strlen
strncmp
wcslen

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset

libstdc++-6

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy
_ZSt20__throw_length_errorPKc
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdaPv
_ZdlPvy
_Znwy
__cxa_allocate_exception
__cxa_begin_catch
__cxa_end_catch
__cxa_free_exception
__cxa_throw
__gxx_personality_seh0

libxerces-c-3-2

_ZN11xercesc_3_213DTDEntityDecl9serializeERNS_16XSerializeEngineE
_ZN11xercesc_3_213XMLAttDefList9serializeERNS_16XSerializeEngineE
_ZN11xercesc_3_213XMLEntityDeclD2Ev
_ZN11xercesc_3_27XMemorydlEPv
_ZNK11xercesc_3_213DTDEntityDecl12getProtoTypeEv
_ZNK11xercesc_3_213DTDEntityDecl14isSerializableEv
_ZNK11xercesc_3_213XMLAttDefList12getProtoTypeEv
_ZNK11xercesc_3_213XMLAttDefList14isSerializableEv

libtascar-0.232.1

_Z16get_license_infoPN11xercesc_3_210DOMElementERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERS7_SA_
_ZN13audiostates_t7prepareER11chunk_cfg_t
_ZN13audiostates_t7releaseEv
_ZN16licensehandler_t11add_licenseERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES7_S7_
_ZN20licensed_component_t12add_licensesEP16licensehandler_t
_ZN6TASCAR10env_expandENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN6TASCAR11add_warningENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKPN11xercesc_3_210DOMElementE
_ZN6TASCAR11transport_tC1Ev
_ZN6TASCAR11tscbasenameERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN6TASCAR12osc_server_t18set_variable_ownerERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN6TASCAR12osc_server_t20unset_variable_ownerEv
_ZN6TASCAR12osc_server_t8add_boolERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPbS8_
_ZN6TASCAR13xml_element_t13get_attributeERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERS6_S8_S8_
_ZN6TASCAR13xml_element_t13get_attributeERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERdS8_S8_
_ZN6TASCAR13xml_element_t13get_attributeERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERjS8_S8_
_ZN6TASCAR13xml_element_t18get_attribute_boolERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERbS8_S8_
_ZN6TASCAR13xml_element_t19get_attribute_dbsplERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERdS8_
_ZN6TASCAR15async_sndfile_t12request_dataEijjPPf
_ZN6TASCAR15async_sndfile_t12stop_serviceEv
_ZN6TASCAR15async_sndfile_t13start_serviceEv
_ZN6TASCAR15async_sndfile_t4openERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEjidj
_ZN6TASCAR15async_sndfile_tC1Ejjj
_ZN6TASCAR15async_sndfile_tD1Ev
_ZN6TASCAR18audioplugin_base_tC2ERKNS_17audioplugin_cfg_tE
_ZN6TASCAR18audioplugin_base_tD2Ev
_ZN6TASCAR6ErrMsgC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN6TASCAR6ErrMsgD1Ev
_ZN6TASCAR6configERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEd
_ZN6TASCAR6strrepENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKS5_S7_
_ZNK6TASCAR13xml_element_t19validate_attributesERNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNK6TASCAR15async_sndfile_t9get_srateEv

Exports

Exports

_Z8snprintfPcyPKcz
_ZN11xercesc_3_210XMLDeleterD0Ev
_ZN11xercesc_3_210XMLDeleterD1Ev
_ZN11xercesc_3_211PSVIHandler24handlePartialElementPSVIEPKDsS2_PNS_11PSVIElementE
_ZN11xercesc_3_212ArrayJanitorIDsE5resetEPDs
_ZN11xercesc_3_212ArrayJanitorIDsE5resetEPDsPNS_13MemoryManagerE
_ZN11xercesc_3_212ArrayJanitorIDsE6orphanEv
_ZN11xercesc_3_212ArrayJanitorIDsE7releaseEv
_ZN11xercesc_3_212ArrayJanitorIDsEC1EPDs
_ZN11xercesc_3_212ArrayJanitorIDsEC1EPDsPNS_13MemoryManagerE
_ZN11xercesc_3_212ArrayJanitorIDsEC2EPDs
_ZN11xercesc_3_212ArrayJanitorIDsEC2EPDsPNS_13MemoryManagerE
_ZN11xercesc_3_212ArrayJanitorIDsED1Ev
_ZN11xercesc_3_212ArrayJanitorIDsED2Ev
_ZN11xercesc_3_212ArrayJanitorIhE5resetEPh
_ZN11xercesc_3_212ArrayJanitorIhE5resetEPhPNS_13MemoryManagerE
_ZN11xercesc_3_212ArrayJanitorIhE6orphanEv
_ZN11xercesc_3_212ArrayJanitorIhE7releaseEv
_ZN11xercesc_3_212ArrayJanitorIhEC1EPh
_ZN11xercesc_3_212ArrayJanitorIhEC1EPhPNS_13MemoryManagerE
_ZN11xercesc_3_212ArrayJanitorIhEC2EPh
_ZN11xercesc_3_212ArrayJanitorIhEC2EPhPNS_13MemoryManagerE
_ZN11xercesc_3_212ArrayJanitorIhED1Ev
_ZN11xercesc_3_212ArrayJanitorIhED2Ev
_ZN11xercesc_3_213DTDEntityDeclD0Ev
_ZN11xercesc_3_213DTDEntityDeclD1Ev
_ZN13audiostates_t12post_prepareEv
_ZN13audiostates_t9configureEv
_ZN18ap_sndfile_async_t10ap_processERSt6vectorIN6TASCAR6wave_tESaIS2_EERKNS1_5pos_tERKNS1_11zyx_euler_tERKNS1_11transport_tE
_ZN18ap_sndfile_async_t12add_licensesEP16licensehandler_t
_ZN18ap_sndfile_async_t13add_variablesEPN6TASCAR12osc_server_tE
_ZN18ap_sndfile_async_t7releaseEv
_ZN18ap_sndfile_async_t9configureEv
_ZN18ap_sndfile_async_tC1ERKN6TASCAR17audioplugin_cfg_tE
_ZN18ap_sndfile_async_tC2ERKN6TASCAR17audioplugin_cfg_tE
_ZN18ap_sndfile_async_tD0Ev
_ZN18ap_sndfile_async_tD1Ev
_ZN18ap_sndfile_async_tD2Ev
_ZN22ap_sndfile_async_cfg_tC1ERKN6TASCAR17audioplugin_cfg_tE
_ZN22ap_sndfile_async_cfg_tC2ERKN6TASCAR17audioplugin_cfg_tE
_ZN22ap_sndfile_async_cfg_tD2Ev
_ZN6TASCAR18audioplugin_base_t13add_variablesEPNS_12osc_server_tE
_ZNK11xercesc_3_212ArrayJanitorIDsE3getEv
_ZNK11xercesc_3_212ArrayJanitorIDsEixEy
_ZNK11xercesc_3_212ArrayJanitorIhE3getEv
_ZNK11xercesc_3_212ArrayJanitorIhEixEy
_ZNK11xercesc_3_213DTDEntityDecl14getIsParameterEv
_ZNK11xercesc_3_213DTDEntityDecl16getIsSpecialCharEv
_ZNK11xercesc_3_213DTDEntityDecl22getDeclaredInIntSubsetEv
_ZTI11chunk_cfg_t
_ZTI13audiostates_t
_ZTI18ap_sndfile_async_t
_ZTI20licensed_component_t
_ZTI22ap_sndfile_async_cfg_t
_ZTIN11xercesc_3_210XMLDeleterE
_ZTIN11xercesc_3_211PSVIHandlerE
_ZTIN11xercesc_3_213DTDEntityDeclE
_ZTIN11xercesc_3_213XMLAttDefListE
_ZTIN11xercesc_3_213XMLEntityDeclE
_ZTIN11xercesc_3_213XSerializableE
_ZTIN11xercesc_3_27XMemoryE
_ZTIN6TASCAR13xml_element_tE
_ZTIN6TASCAR18audioplugin_base_tE
_ZTIN6TASCAR6ErrMsgE
_ZTINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZTISt9exception
_ZTS11chunk_cfg_t
_ZTS13audiostates_t
_ZTS18ap_sndfile_async_t
_ZTS20licensed_component_t
_ZTS22ap_sndfile_async_cfg_t
_ZTSN11xercesc_3_210XMLDeleterE
_ZTSN11xercesc_3_211PSVIHandlerE
_ZTSN11xercesc_3_213DTDEntityDeclE
_ZTSN11xercesc_3_213XMLAttDefListE
_ZTSN11xercesc_3_213XMLEntityDeclE
_ZTSN11xercesc_3_213XSerializableE
_ZTSN11xercesc_3_27XMemoryE
_ZTSN6TASCAR13xml_element_tE
_ZTSN6TASCAR18audioplugin_base_tE
_ZTSN6TASCAR6ErrMsgE
_ZTSNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZTSSt9exception
_ZTV18ap_sndfile_async_t
_ZTV22ap_sndfile_async_cfg_t
_ZTVN11xercesc_3_210XMLDeleterE
_ZTVN11xercesc_3_211PSVIHandlerE
_ZTVN11xercesc_3_213DTDEntityDeclE
_ZTVN11xercesc_3_213XMLAttDefListE
_ZThn16_N18ap_sndfile_async_t7releaseEv
_ZThn16_N18ap_sndfile_async_t9configureEv
_ZThn16_N18ap_sndfile_async_tD0Ev
_ZThn16_N18ap_sndfile_async_tD1Ev
_ZThn176_N18ap_sndfile_async_t12add_licensesEP16licensehandler_t
audioplugin_base_t_factory
audioplugin_base_t_tascar_version

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76e3fc4c5fab4ad92b7866662b6c4b22

Headers

DLL Characteristics

File Characteristics

Imports

libgcc_s_seh-1

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

libstdc++-6

libxerces-c-3-2

libtascar-0.232.1

Exports

Exports

Sections

.text Size: 33KB - Virtual size: 33KB

.data Size: 512B - Virtual size: 288B

.rdata Size: 5KB - Virtual size: 5KB

.pdata Size: 2KB - Virtual size: 1KB

.xdata Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 2KB

.edata Size: 5KB - Virtual size: 4KB

.idata Size: 7KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 312B

/4 Size: 2KB - Virtual size: 1KB

/19 Size: 593KB - Virtual size: 593KB

/31 Size: 16KB - Virtual size: 16KB

/45 Size: 42KB - Virtual size: 41KB

/57 Size: 8KB - Virtual size: 7KB

/70 Size: 6KB - Virtual size: 5KB

/81 Size: 9KB - Virtual size: 8KB

/97 Size: 62KB - Virtual size: 61KB

/113 Size: 6KB - Virtual size: 6KB

.text
Size: 33KB - Virtual size: 33KB

.data
Size: 512B - Virtual size: 288B

.rdata
Size: 5KB - Virtual size: 5KB

.pdata
Size: 2KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 5KB - Virtual size: 4KB

.idata
Size: 7KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 312B

/4
Size: 2KB - Virtual size: 1KB

/19
Size: 593KB - Virtual size: 593KB

/31
Size: 16KB - Virtual size: 16KB

/45
Size: 42KB - Virtual size: 41KB

/57
Size: 8KB - Virtual size: 7KB

/70
Size: 6KB - Virtual size: 5KB

/81
Size: 9KB - Virtual size: 8KB

/97
Size: 62KB - Virtual size: 61KB

/113
Size: 6KB - Virtual size: 6KB