050ae93b859023347f6d3d3a4bc2c56e919845e1732c0ce2c7ec61386adc2124

Sharing

Copy URL Twitter E-mail

General

Target

050ae93b859023347f6d3d3a4bc2c56e919845e1732c0ce2c7ec61386adc2124
Size

617KB
MD5

e9d583b4642d47f270faed9888357301
SHA1

ce71409befd44d9ecffe1c1870c3c4a2872d4b74
SHA256

050ae93b859023347f6d3d3a4bc2c56e919845e1732c0ce2c7ec61386adc2124
SHA512

675972b1f5d9c98c503bcccb879bb091319cb51153320bb97b5e067ad54e0eea735345f45f81b5c2fdf0e15c7deda1880153300182bc053e81a4193bdbebde8d
SSDEEP

12288:9NVjYoFhzxoQf1ORnmgj+sDNrVhUONAOpE+XZ7ZA1dzEVNjKKrw:9NTFhyQfetUDapczEI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
050ae93b859023347f6d3d3a4bc2c56e919845e1732c0ce2c7ec61386adc2124

Files

050ae93b859023347f6d3d3a4bc2c56e919845e1732c0ce2c7ec61386adc2124
.exe windows:6 windows x86 arch:x86

b7b9feaab7cbc8deff4bb4c7d6b57a89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

B:\GB\Source\Release\colman.pdb

Imports

comctl32

ord17

dtxdb32

_DDB_LessThanRec@16
_DDB_PrevRec@12
_DDB_EndSession@4
_DDB_GetLastErrorNum@4
_DDB_OpenFile@8
_DDB_CloseFile@4
_DDB_FindRec@16
_DDB_ReadRec@12
_DDB_FirstRec@12
_DDB_EndSet@4
_DDB_NextRecInSet@8
_DDB_StartSet@24
_DDB_GetFilePos@4
_DDB_NextRec@12
_DDB_GreaterThanOrEqualRec@16
_DDB_EnsureLockingOn@4
_DDB_RestoreLockingState@8
_DDB_GetOpenFile@8
_DDB_AddRec@8
_DDB_WriteRec@8
_DDB_GetAccessMode@4
_DDB_StartLocking@4
_DDB_PauseLocking@4
_DDB_ResumeLocking@4
_DDB_StopLocking@4
_DDB_GetLastFileNum@4
_DDB_DeleteCurRec@4
_DDB_SetFilePos@12
_DDB_PrevRecInSet@8
_DDB_CreateSavePoint@4
_DDB_ClearSavePoint@4
_DDB_RestoreToSavePoint@4
_DDB_GetLastActiveSession@0
_DDB_WriteVRec@12
_DDB_UnlockRecordInFile@8
_DDB_GetRecSizeFromIFILDefinition@4
_DDB_ReReadRecord@12
_DDB_GetLockMode@4
_DDB_GetLastResultNum@4
_DDB_UPDCURI@12
_DDB_MIDSET@16
_DDB_SetAccessMode@8
_DDB_UnlockCurRecord@4
_DDB_LessThanOrEqualRec@16
_DDB_OpenFileExclusive@8
_DDB_CREIFIL@8
_DDB_LastRec@12
_DDB_LKISAM@8
_DDB_SETCURI@20
_DDB_GetDataMode@0
_DDB_ReadEntireVarRec@8
_DDB_GetVarRecLength@4
_DDB_EnsureLockingNotOn@4
_DDB_StartSession@4

dtx32

_DTX_verf_Phone@16
_DTX_StripPhone@8
_DTX_Set_Phone@12
ord100
ord74
_DTX_GetCountry@0
ord60
ord62
_DTX_SysDate@8
ord49
_DTX_FormatPercent@8
_DTX_DBFindErr@4
FixCrLfForTextbox
_DTX_SpellChecker_SetBtnToolTipCustom@12
_DTX_UnpackName@16
_DTX_PackPrefName@24
_DTX_PackName@20
_DTX_SpellChecker_KillBtnToolTip@8
_DTX_SpellChecker_SetBtnToolTip@8
_DTX_SpellChecker_CheckControlText@8
_DTX_SpellChecker_AddBMPToBtn@8
_DTX_GetStationID@4
ord66
ord64
_DTX_BuildPatAgingAudit@24
_DTX_BuildProcAudit@16
ord11
_DTX_SysTime@8
_DTX_StripSS@8
_DTX_FormatSS_CheckHideMask@12
_DTX_verf_Money@16
_DTX_FormatMoney@8
_DTX_stripDateString2000@20
_DTX_stripDateString1900@20
_DTX_getmonth_name@8
_DTX_week_day@12
_DTX_month_day@16
_DTX_getday_name@8
_DTX_fmtDateString2000@24
_DTX_GetOverrideUserID@4
_ExistsPreviousInstance@4
_DTX_GetLoggedInUserID@4
ord52
_DrawTransparentBitmap@20
ord61
ord63
_DTX_GetPatientPicturePath@8
_DTX_SelectPatient@20
_DTX_GetString@4
ord43
ord44
ord46
_DTX_BuildInitialProcAudit@16
_DTX_GetCurrentDbCommonPath@8
ord48
ord55
ord71
_GetWinVersion@8
_DTX_FormatPackTime@12
_DTX_CheckForPrivatePhone@8
DTX_GoToHelpURL
ord20
_DTX_fmtDateString1900@24
_DTX_DateStr@20
_DTX_FormatNDate2000@8
_DTX_FormatNDate1900@8
_DTX_DateOut@16
_DTX_DateIn@12
ord101
_DTX_InitializeDBEx@4
_DTX_InitializeDB@0
ord4
ord3
ord65
_DTX_GetSerialNumber@8
_DTX_SetOverrideToLoggedIn@0
ord53
_DTX_SaveWindowPosInfo@8
_DTX_RestoreSavedWindowPos@8

dtxsdir

ord1
ord6
DTXSQL_GetWorkstationOptionString
ord2
ord100
ord102
ord3
ord4
ord5
ord104

dxprnt32

?PRT_GenerateLabel@@YAXPAXPAUpatlst@@UtagRECT@@H@Z
?PRT_GenerateApptRemindLabel@@YAXPAXUtagRECT@@PAD222H@Z
?PRT_SavePrintDC@@YGXPAX@Z
?DxPrint_Fonts@@YGHPAX00@Z
?PRT_SelectObjectEx@@YGPAXPAXHPAH@Z
?DxPrint_DestroyFonts@@YGXXZ
_CallDxPrint@4

patalert

PATALERT_RunPatAlertsSetup
PATALERT_GetPatAlertExist
PATALERT_PopUpPatientAlerts

kernel32

_lclose
_llseek
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalHandle
GetTempPathA
GlobalReAlloc
GlobalSize
lstrcpyA
lstrcatA
lstrlenA
LocalAlloc
LocalLock
LocalUnlock
LocalFree
GetModuleFileNameA
CreateProcessA
GetPrivateProfileStringA
GetCurrentThreadId
lstrcpynA
GetProfileStringA
MulDiv
FindClose
FindFirstFileA
CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
SetFileAttributesA
GetLocalTime
GetModuleHandleA
ExpandEnvironmentStringsA
LoadLibraryExA
OutputDebugStringA
_lread
OpenFile
WritePrivateProfileStringA
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
CreateMutexA
GetLastError
GetModuleHandleExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThread
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
_lwrite

user32

GetSystemMetrics
LoadMenuA
GetMenu
DestroyMenu
EnableMenuItem
GetSubMenu
RemoveMenu
TrackPopupMenu
BeginPaint
EndPaint
InvalidateRect
GetClientRect
GetWindowRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
LoadCursorA
LoadIconA
DialogBoxParamA
EndDialog
GetDlgItemTextA
SetFocus
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
SetDlgItemInt
GetDlgItemInt
GetDesktopWindow
GetParent
GetFocus
DdeInitializeA
DdeUninitialize
DdeConnect
DdeDisconnect
DdeNameService
DdeClientTransaction
DdeCreateDataHandle
DdeCreateStringHandleA
DdeQueryStringA
DdeFreeStringHandle
GetWindowLongA
SetRect
IntersectRect
IsRectEmpty
ReleaseCapture
AppendMenuA
SetCapture
GetClassInfoA
SetWindowLongA
DrawTextA
CreatePopupMenu
ReleaseDC
PtInRect
GetSysColorBrush
UnhookWindowsHookEx
GetDialogBaseUnits
SetWindowsHookExA
ClientToScreen
WindowFromPoint
CallNextHookEx
LoadAcceleratorsA
GetDC
LoadBitmapA
FrameRect
DrawIcon
FillRect
CallWindowProcA
SetScrollPos
SetScrollRange
GetLastActivePopup
PeekMessageA
CreateDialogParamA
RedrawWindow
IsDialogMessageA
ValidateRect
InvertRect
LoadImageA
EnumThreadWindows
GetForegroundWindow
RegisterWindowMessageA
GetWindow
GetCursor
ModifyMenuA
CheckMenuItem
DrawMenuBar
DeleteMenu
GetMenuItemCount
InsertMenuA
GetMenuItemID
SubtractRect
IsWindowEnabled
MapVirtualKeyA
keybd_event
MoveWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
PostMessageA
DispatchMessageA
TranslateMessage
GetMessageA
EnableWindow
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
SetDlgItemTextA
UpdateWindow
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetDlgItem
SendMessageA
wsprintfA
FindWindowA
MessageBoxA
SetForegroundWindow
GetActiveWindow
IsIconic
ShowWindow
TranslateAcceleratorA
KillTimer
SetTimer
LoadStringA
SetWindowPos
GetPropA
GetDlgCtrlID
SetPropA
RemovePropA
IsWindow
SetActiveWindow
IsWindowVisible
OffsetRect
CheckDlgButton

gdi32

StartPage
CreateCompatibleDC
StartDocA
EndDoc
GetDeviceCaps
DeleteDC
CreateDCA
EndPage
CreatePen
GetObjectA
GetStockObject
SetBkMode
SetTextColor
SetBkColor
DeleteObject
CreateSolidBrush
GetTextExtentPointA
SetROP2
GetTextColor
SelectObject
GetPixel
CreateFontIndirectA
DPtoLP
BitBlt
GetTextExtentPoint32A
SetPixel
CreateCompatibleBitmap
RoundRect
GetTextMetricsA
MoveToEx
Rectangle
LineTo
StretchBlt
PatBlt

comdlg32

ChooseColorA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

ole32

CoInitialize

msvcp140

_Query_perf_counter
_Query_perf_frequency
_Xtime_get_ticks
_Thrd_sleep
?_Xlength_error@std@@YAXPBD@Z

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CryptQueryObject
CryptMsgClose
CertCloseStore
CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam

vcruntime140

__RTDynamicCast
__std_exception_copy
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context
__current_exception
_CxxThrowException
__std_exception_destroy
memcmp
__std_terminate
strstr
memmove
strchr
memset
memcpy
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strcat
toupper
_strupr
strncpy
_memicmp
strcpy_s
_strnicmp
strcat_s
strlen
strcspn
strtok
strncpy_s
islower
isupper
strncat_s
tolower
isspace
_stricmp
_strdup
isalpha
isalnum
strpbrk
strncat
isdigit
strcpy
strncmp
strcmp
ispunct

api-ms-win-crt-convert-l1-1-0

atol
atof
_ltoa
mbstowcs_s
atoi
_itoa

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
rename
_splitpath
_chdir
_unlink

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vsprintf
_getcwd
__stdio_common_vsscanf
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
_set_new_mode
calloc

api-ms-win-crt-math-l1-1-0

modf
_libm_sse2_pow_precise
_except1
__setusermatherr

api-ms-win-crt-time-l1-1-0

_strtime
_time64

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
terminate
_set_app_type
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

?RECALL_DeleteContinuingCareViewWrapper@@YA_NPAXH@Z
?RECALL_EditContinuingCareViewWrapper@@YA_NPAXPAG@Z
DeleteListControlData
_DTX_RscFillListCtrl@8
_SortListCtrl@8

Sections

.text
Size: 437KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7b9feaab7cbc8deff4bb4c7d6b57a89

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

dtxdb32

dtx32

dtxsdir

dxprnt32

patalert

kernel32

user32

gdi32

comdlg32

advapi32

ole32

msvcp140

wintrust

crypt32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 437KB - Virtual size: 436KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 5KB - Virtual size: 174KB

.rsrc Size: 119KB - Virtual size: 119KB

.text
Size: 437KB - Virtual size: 436KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 5KB - Virtual size: 174KB

.rsrc
Size: 119KB - Virtual size: 119KB