c12a2f92f3e9dd6eec353d0e3d8e0dd7c4f48abf9f7cbd0e33e580c606d3e395

Sharing

Copy URL Twitter E-mail

General

Target

c12a2f92f3e9dd6eec353d0e3d8e0dd7c4f48abf9f7cbd0e33e580c606d3e395
Size

181KB
MD5

76223dc4274fdec64614489fea97c85e
SHA1

f47f5c27e2981c272bec8337e8be3fdadf58ebac
SHA256

c12a2f92f3e9dd6eec353d0e3d8e0dd7c4f48abf9f7cbd0e33e580c606d3e395
SHA512

34aabbbe919ab197a7018cb2fd5958de3cb7e89e13a8dea0809d8a8d2c7da6bc212be978c222be2ed41ca3abb053277aec8ea6bd4f125fc498aac2cee986f2bc
SSDEEP

1536:VyQ/5ilc40EnIY2qd1FTRKF/No/sZnhwhw7ROg8LnD22Zg0YJ5JVNp9a4RUqyVXT:12c17Y2qd1BRSmJgM223YJXXa4IZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c12a2f92f3e9dd6eec353d0e3d8e0dd7c4f48abf9f7cbd0e33e580c606d3e395

Files

c12a2f92f3e9dd6eec353d0e3d8e0dd7c4f48abf9f7cbd0e33e580c606d3e395
.dll windows:6 windows x64 arch:x64

7fe6bdf86d0090b724a1bdeeb86ab7d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Lite_Custom\Lorex\P_2019.10.30_DCMBase_SmartPSS_2.03.1_LorexClient\bin\TalkStream.pdb

Imports

libdsl

??0DRefObj@dsl@@IEAA@XZ
?Reset@DRefObj@dsl@@UEAAXXZ
??1DRefObj@dsl@@MEAA@XZ
?addref@DRefObj@dsl@@AEAAHXZ
?release@DRefObj@dsl@@AEAAHXZ
??0DTimerHandler@dsl@@QEAA@XZ
??1DTimerHandler@dsl@@MEAA@XZ
??0DMessage@dsl@@QEAA@H@Z
??1DMessage@dsl@@UEAA@XZ
?GetType@DMessage@dsl@@QEBAHXZ
??_DDMessage@dsl@@QEAAXXZ
??0DMessageQueue@dsl@@QEAA@II@Z
?QueueSize@DMessageQueue@dsl@@UEAAHXZ
?IsRunning@DMessageQueue@dsl@@QEBA_NXZ
?GetTime@DTime@dsl@@SA_JXZ
?Start@DMessageQueue@dsl@@UEAAHXZ
?SignalStop@DMessageQueue@dsl@@UEAAHXZ
?Stop@DMessageQueue@dsl@@UEAAHXZ
?PushMsg@DMessageQueue@dsl@@UEAAHPEAVDMessage@2@@Z
??1DMessageQueue@dsl@@MEAA@XZ
?destroy@DRefObj@dsl@@MEAAXXZ
?strcpy_x@DStr@dsl@@SAHPEADHPEBD@Z
??0DMutexGuard@dsl@@QEAA@PEAVDMutex@1@@Z
?GetObjInfo@DRefObj@dsl@@UEBAXPEAVDStr@2@@Z
??1DMutexGuard@dsl@@QEAA@XZ
??0DTimerMgr@dsl@@QEAA@XZ
??1DTimerMgr@dsl@@UEAA@XZ
?CreateTimer@DTimerMgr@dsl@@QEAAIPEAVDTimerHandler@2@@Z
?StartTimer@DTimerMgr@dsl@@QEAAHIH@Z
?DestroyTimer@DTimerMgr@dsl@@QEAAHI@Z
??0DMutex@dsl@@QEAA@XZ
??1DMutex@dsl@@QEAA@XZ
?Lock@DMutex@dsl@@QEAAXXZ
?Unlock@DMutex@dsl@@QEAAXXZ

platformsdk

??1StartTalkMsg@DPSdk@@UEAA@XZ
??1StopTalkMsg@DPSdk@@UEAA@XZ
??0StartTalkMsg@DPSdk@@QEAA@XZ
??0StopTalkMsg@DPSdk@@QEAA@XZ
??0GetTalkParamMsg@DPSdk@@QEAA@XZ
??1GetTalkParamMsg@DPSdk@@UEAA@XZ

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_type_info_destroy_list
memset
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__CxxFrameHandler3
_CxxThrowException
memmove
memcpy
_purecall
memcmp
__std_terminate
__C_specific_handler
__std_exception_copy
__std_exception_destroy

api-ms-win-crt-string-l1-1-0

strcmp
strlen

api-ms-win-crt-runtime-l1-1-0

_cexit
_crt_at_quick_exit
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
terminate
_register_onexit_function
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_crt_atexit

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

kernel32

GetProcAddress
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
WideCharToMultiByte
MultiByteToWideChar
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

Exports

Exports

??0CTalkStreamInstance@DCM@@QEAA@AEBV01@@Z
??0CTalkStreamInstance@DCM@@QEAA@XZ
??0ITalkStreamComponent@DCM@@QEAA@AEBV01@@Z
??0ITalkStreamComponent@DCM@@QEAA@XZ
??1CTalkStreamInstance@DCM@@UEAA@XZ
??1ITalkStreamComponent@DCM@@UEAA@XZ
??4CTalkStreamInstance@DCM@@QEAAAEAV01@AEBV01@@Z
??4ITalkStreamComponent@DCM@@QEAAAEAV01@AEBV01@@Z
??_7CTalkStreamInstance@DCM@@6B@
??_7ITalkStreamComponent@DCM@@6B@
?CreateTalkStreamInstance@CTalkStreamInstance@DCM@@QEAAPEAVITalkStreamComponent@2@XZ

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fe6bdf86d0090b724a1bdeeb86ab7d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libdsl

platformsdk

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

api-ms-win-crt-stdio-l1-1-0

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 127KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 12KB - Virtual size: 11KB

.gfids Size: 512B - Virtual size: 52B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 604B

.text
Size: 128KB - Virtual size: 127KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 12KB - Virtual size: 11KB

.gfids
Size: 512B - Virtual size: 52B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 604B