9f0b1ae1f33e4999d2f523c3446e7f28db038af017f6ae883482babdeb8bec3f

Sharing

Copy URL

Twitter E-mail

General

Target

9f0b1ae1f33e4999d2f523c3446e7f28db038af017f6ae883482babdeb8bec3f
Size

193KB
MD5

853886d8574495b6ee63e4a3eed3df22
SHA1

d48bf43e83f4dc908080ff309299315859a54808
SHA256

9f0b1ae1f33e4999d2f523c3446e7f28db038af017f6ae883482babdeb8bec3f
SHA512

f18326c3b2048f46a6699e99411085a43b499e090a1398f2c85a8dee049e445ef55bf0d17aac5a6022ab0cb3f37deaee38d3cc684b3ae3ea14f323795e7e4607
SSDEEP

6144:5id4rhtdB+QCbeLgtHnCd06CxTz3HQ+6:FCsgtHnCd06Cxw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f0b1ae1f33e4999d2f523c3446e7f28db038af017f6ae883482babdeb8bec3f

Files

9f0b1ae1f33e4999d2f523c3446e7f28db038af017f6ae883482babdeb8bec3f
.dll windows:5 windows x86 arch:x86

2c8c3f757c036d509ab48874229a5cb2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\2.1new\src\Cooperation\Release\PcscReader.pdb

Imports

kernel32

TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
RaiseException
HeapSize
HeapReAlloc
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
InterlockedExchange
lstrlenA
lstrcmpA
InterlockedIncrement
GetCurrentProcessId
GetModuleHandleA
GlobalFlags
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
lstrcmpW
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
FormatMessageW
SetErrorMode
lstrlenW
GetCurrentThreadId
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GlobalLock
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
FreeLibrary
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
GetModuleFileNameW
SetLastError
GetModuleHandleW
GetProcAddress
ReleaseMutex
WaitForSingleObject
OpenMutexW
GetLastError
CreateMutexW
CloseHandle
GetTickCount
Sleep

user32

PostQuitMessage
DestroyMenu
LoadCursorW
GetSysColorBrush
GetWindowThreadProcessId
ReleaseDC
GetDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ClientToScreen
IsWindowEnabled
SetWindowTextW
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
EnableWindow
SetForegroundWindow
GetClientRect
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
GetWindowLongW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnregisterClassW
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
SendMessageW
GetKeyState
PeekMessageW
ValidateRect
UnhookWindowsHookEx

gdi32

DeleteDC
RectVisible
GetStockObject
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
GetDeviceCaps
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
TextOutW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

shlwapi

PathFindFileNameW
PathFindExtensionW

oleaut32

VariantClear
VariantChangeType
VariantInit

winscard

SCardTransmit
SCardBeginTransaction
SCardGetAttrib
SCardCancel
SCardEndTransaction
SCardReleaseContext
SCardConnectW
SCardDisconnect
SCardReconnect
SCardEstablishContext
SCardControl
SCardListReadersW
SCardStatusW
SCardFreeMemory

Exports

Exports

??0CMyMutex@@QAE@XZ
??0CMySingleLock@@QAE@PAVCMyMutex@@@Z
??0CPCSCReader@@QAE@PB_W@Z
??0CPCSCReader@@QAE@XZ
??1CMyMutex@@QAE@XZ
??1CMySingleLock@@QAE@XZ
??1CPCSCReader@@QAE@XZ
??4CMyMutex@@QAEAAV0@ABV0@@Z
??4CMySingleLock@@QAEAAV0@ABV0@@Z
??4CPCSCReader@@QAEAAV0@ABV0@@Z
?CardIsExist@CPCSCReader@@QAEHK@Z
?Connect@CPCSCReader@@QAEHXZ
?CreateObject@CMyMutex@@QAEHHPB_W@Z
?DisConnect@CPCSCReader@@QAEHXZ
?EscapeSend@CPCSCReader@@QAEHPAEK0PAKK@Z
?FreeReaderList@CPCSCReader@@QAEHPAPA_W@Z
?GetAttribValue@CPCSCReader@@QAEHKPAEPAK@Z
?GetKey@CPCSCReader@@QAEHXZ
?GetReaderList@CPCSCReader@@QAEHPAPA_W@Z
?Init@CPCSCReader@@QAEHPB_W@Z
?ListPcscReader@CPCSCReader@@QAEHAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@K@Z
?Lock@CMyMutex@@QAEHXZ
?Lock@CMySingleLock@@QAEXXZ
?ReConnect@CPCSCReader@@QAEHXZ
?ReaderIsExist@CPCSCReader@@QAEHXZ
?Reset@CPCSCReader@@QAEHPAEPAK@Z
?Reset@CPCSCReader@@QAEHXZ
?SendCommand@CPCSCReader@@QAEHPBDKPAEPAKPAG@Z
?SendCommandI@CPCSCReader@@AAEHPBDKPAEPAKPAG@Z
?SetAutoCheck@CPCSCReader@@QAEX_N@Z
?SetKey@CPCSCReader@@QAEXH@Z
?UnLock@CMyMutex@@QAEHXZ
?UnLock@CMySingleLock@@QAEXXZ
?_SendCommand@CPCSCReader@@AAEHPBDKPAEPAKPAG@Z

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c8c3f757c036d509ab48874229a5cb2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

shlwapi

oleaut32

winscard

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 27KB - Virtual size: 27KB