c5ee071c95344e1d64379bad3c5f6391e7edac44189d54a0bd741bfedade87c1

Sharing

Copy URL Twitter E-mail

General

Target

c5ee071c95344e1d64379bad3c5f6391e7edac44189d54a0bd741bfedade87c1
Size

32KB
MD5

a1cecc76880b420f873506fd75a38aa9
SHA1

cd5f98310f1b14ae8a6eaef0178b10ada2c0ce73
SHA256

c5ee071c95344e1d64379bad3c5f6391e7edac44189d54a0bd741bfedade87c1
SHA512

a18dd38bae53c6e96daa3d6395967702799209984322c952d73596c140708f3ded3bcd34f5ff4f0a9c8be73166cfffea1105e40a67797a692526c918b07869d8
SSDEEP

768:+7sll6aym/3OdxMRCZXEWHwyMhKKJKGWYVOIhpwec6z:CsSa9/+jIhSec6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5ee071c95344e1d64379bad3c5f6391e7edac44189d54a0bd741bfedade87c1

Files

c5ee071c95344e1d64379bad3c5f6391e7edac44189d54a0bd741bfedade87c1
.dll windows:6 windows x64 arch:x64

5cba51d20bafd819506d42611e4ead70

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ttkbasecommon

?setWrapper@Debug@ttk@@UEAAHPEBVWrapper@2@@Z
?setDebugLevel@Debug@ttk@@UEAAHAEBH@Z
??1Debug@ttk@@UEAA@XZ
??0Debug@ttk@@QEAA@XZ

msvcp140

?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
_Mbrtowc

vcruntime140

_CxxThrowException
memcpy
__std_exception_copy
__C_specific_handler
__std_type_info_destroy_list
memmove
memset
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_cexit

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh

kernel32

QueryPerformanceCounter
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessId

Exports

Exports

??$?0$$V@?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@QEAA@U_Zero_then_variadic_args_t@1@@Z
??$?0V?$allocator@D@std@@$$V@?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@QEAA@U_One_then_variadic_args_t@1@$$QEAV?$allocator@D@1@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@$$QEAV10@QEBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@QEBDAEBV10@@Z
??$_Allocate@$0BA@U_Default_allocate_traits@std@@$0A@@std@@YAPEAX_K@Z
??$_Allocate_manually_vector_aligned@U_Default_allocate_traits@std@@@std@@YAPEAX_K@Z
??$_Construct_in_place@PEADAEBQEAD@std@@YAXAEAPEADAEBQEAD@Z
??$_Convert_size@_K@std@@YA_K_K@Z
??$_Deallocate@$0BA@$0A@@std@@YAXPEAX_K@Z
??$_Destroy_in_place@PEAD@std@@YAXAEAPEAD@Z
??$_Get_size_of_n@$00@std@@YA_K_K@Z
??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z
??$_Pocca@V?$allocator@D@std@@@std@@YAXAEAV?$allocator@D@0@AEBV10@@Z
??$_Pocma@V?$allocator@D@std@@@std@@YAXAEAV?$allocator@D@0@0@Z
??$_Reallocate_for@V<lambda_66f57f934f28d61049862f64df852ff0>@@PEBD@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAAEAV01@_KV<lambda_66f57f934f28d61049862f64df852ff0>@@PEBD@Z
??$_Reallocate_grow_by@V<lambda_65e615be2a453ca0576c979606f46740>@@PEBD_K@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAAEAV01@_KV<lambda_65e615be2a453ca0576c979606f46740>@@PEBD_K@Z
??$_Unfancy@D@std@@YAPEADPEAD@Z
??$_Voidify_iter@PEAPEAD@std@@YAPEAXPEAPEAD@Z
??$addressof@$$CBV?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@YAPEBV?$_String_val@U?$_Simple_types@D@std@@@0@AEBV10@@Z
??$addressof@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@YAPEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEBV10@@Z
??$addressof@PEAD@std@@YAPEAPEADAEAPEAD@Z
??$addressof@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@YAPEAV?$_String_val@U?$_Simple_types@D@std@@@0@AEAV10@@Z
??$addressof@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEAV10@@Z
??$forward@AEBQEAD@std@@YAAEBQEADAEBQEAD@Z
??$forward@V?$allocator@D@std@@@std@@YA$$QEAV?$allocator@D@0@AEAV10@@Z
??$max@_K@std@@YAAEB_KAEB_K0@Z
??$min@_K@std@@YAAEB_KAEB_K0@Z
??$move@AEAV?$allocator@D@std@@@std@@YA$$QEAV?$allocator@D@0@AEAV10@@Z
??$move@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@YA$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEAV10@@Z
??0?$_String_val@U?$_Simple_types@D@std@@@std@@QEAA@XZ
??0?$allocator@D@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@$$QEAV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@QEBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@U_String_constructor_concat_tag@1@AEBV01@QEBD_K23@Z
??0ProjectionFromTable@ttk@@QEAA@XZ
??0_Bxty@?$_String_val@U?$_Simple_types@D@std@@@std@@QEAA@XZ
??0_Fake_proxy_ptr_impl@std@@QEAA@AEBU_Fake_allocator@1@AEBU_Container_base0@1@@Z
??0bad_alloc@std@@AEAA@QEBD@Z
??0bad_alloc@std@@QEAA@AEBV01@@Z
??0bad_array_new_length@std@@QEAA@AEBV01@@Z
??0bad_array_new_length@std@@QEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@QEBDH@Z
??1?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@QEAA@XZ
??1?$_String_val@U?$_Simple_types@D@std@@@std@@QEAA@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??1ProjectionFromTable@ttk@@UEAA@XZ
??1_Bxty@?$_String_val@U?$_Simple_types@D@std@@@std@@QEAA@XZ
??1bad_alloc@std@@UEAA@XZ
??1bad_array_new_length@std@@UEAA@XZ
??1exception@std@@UEAA@XZ
??2@YAPEAX_KPEAX@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
??R<lambda_65e615be2a453ca0576c979606f46740>@@QEBAXQEADQEBD_K12@Z
??R<lambda_66f57f934f28d61049862f64df852ff0>@@QEBAXQEAD_KQEBD@Z
??_7ProjectionFromTable@ttk@@6B@
??_7bad_alloc@std@@6B@
??_7bad_array_new_length@std@@6B@
??_7exception@std@@6B@
??_DProjectionFromTable@ttk@@QEAAXXZ
??_R0?AVBaseClass@ttk@@@8
??_R0?AVDebug@ttk@@@8
??_R0?AVProjectionFromTable@ttk@@@8
??_R0?AVbad_alloc@std@@@8
??_R0?AVbad_array_new_length@std@@@8
??_R0?AVexception@std@@@8
?_Adjust_manually_vector_aligned@std@@YAXAEAPEAXAEA_K@Z
?_Alloc_proxy@_Container_base0@std@@QEAAXAEBU_Fake_allocator@2@@Z
?_Allocate@_Default_allocate_traits@std@@SAPEAX_K@Z
?_Calculate_growth@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBA_K_K@Z
?_Calculate_growth@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CA_K_K00@Z
?_Copy_assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAXAEBV12@U?$integral_constant@_N$0A@@2@@Z
?_Get_first@?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@QEAAAEAV?$allocator@D@2@XZ
?_Get_first@?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@QEBAAEBV?$allocator@D@2@XZ
?_Getal@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAAEAV?$allocator@D@2@XZ
?_Getal@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBAAEBV?$allocator@D@2@XZ
?_Large_string_engaged@?$_String_val@U?$_Simple_types@D@std@@@std@@QEBA_NXZ
?_Maklocwcs@std@@YAPEA_WPEB_W@Z
?_Memcpy_val_from@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAXAEBV12@@Z
?_Move_assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAXAEAV12@U_Equal_allocators@2@@Z
?_Myptr@?$_String_val@U?$_Simple_types@D@std@@@std@@QEAAPEADXZ
?_Myptr@?$_String_val@U?$_Simple_types@D@std@@@std@@QEBAPEBDXZ
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?_Release@_Fake_proxy_ptr_impl@std@@QEAAXXZ
?_Take_contents@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAXAEAV12@U?$integral_constant@_N$00@2@@Z
?_Throw_bad_array_new_length@std@@YAXXZ
?_Tidy_deallocate@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAXXZ
?_Tidy_init@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAXXZ
?_Xlen_string@std@@YAXXZ
?allocate@?$allocator@D@std@@QEAAPEAD_K@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@QEBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@QEBD_K@Z
?assign@?$_Narrow_char_traits@DH@std@@SAXAEADAEBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@QEBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@QEBD_K@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
?copy@?$_Char_traits@DH@std@@SAPEADQEADQEBD_K@Z
?deallocate@?$allocator@D@std@@QEAAXQEAD_K@Z
?length@?$_Narrow_char_traits@DH@std@@SA_KQEBD@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ
?max@?$numeric_limits@_J@std@@SA_JXZ
?max_size@?$_Default_allocator_traits@V?$allocator@D@std@@@std@@SA_KAEBV?$allocator@D@2@@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ
?move@?$_Char_traits@DH@std@@SAPEADQEADQEBD_K@Z
?select_on_container_copy_construction@?$_Default_allocator_traits@V?$allocator@D@std@@@std@@SA?AV?$allocator@D@2@AEBV32@@Z
?setDebugMsgPrefix@Debug@ttk@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setThreadNumber@BaseClass@ttk@@UEAAHH@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ
?what@exception@std@@UEBAPEBDXZ
wmemcpy

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5cba51d20bafd819506d42611e4ead70

Headers

DLL Characteristics

File Characteristics

Imports

ttkbasecommon

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 124B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 124B