3e7f8494cd101d565c89d0d254c3009b37c1a444182a24fa6c6c3e150c241eb6

Sharing

Copy URL Twitter E-mail

General

Target

3e7f8494cd101d565c89d0d254c3009b37c1a444182a24fa6c6c3e150c241eb6
Size

14KB
MD5

9bdb1435354e3c67af5b306976f85c9d
SHA1

d643009b71e191e7c9df77ae3fa03c49b06b72d3
SHA256

3e7f8494cd101d565c89d0d254c3009b37c1a444182a24fa6c6c3e150c241eb6
SHA512

c917d73a1cf068fbb5f7cc650a467cede751d4ac066bb0355be82c14f25f83d9a0043820b9c9651a5798b3811e6ed2f6d4c8e112f0162a5ac102f7691984aa3a
SSDEEP

384:TsyTrX/D7r0VtgQX+7ZADZWkwxdOZ41PGUaF1C7/:oynXfrytJX+7O8dOZ41+UOC7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e7f8494cd101d565c89d0d254c3009b37c1a444182a24fa6c6c3e150c241eb6

Files

3e7f8494cd101d565c89d0d254c3009b37c1a444182a24fa6c6c3e150c241eb6
.dll windows:5 windows x86 arch:x86

9a80a9822526c70112cc85753be7cd5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\tfsagent\_work\12\s\src\Release9\Estimate.pdb

Imports

kernel32

Sleep
LeaveCriticalSection
EnterCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSection
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcess
DecodePointer
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

engine

?Write@CWorker@@UAEXPAUNcCode@@@Z
?PostMsg@CWorker@@UAEXI@Z
?GetStationIndex@CWorker@@UAEHXZ
?SetPhoenix@CWorker@@UAE_NPBDAAUValueItemInfo@CGAccess@@_N@Z
?TryGetPhoenix@CWorker@@UAE_NPBDAAUValueItemInfo@CGAccess@@_N@Z
?GetPhoenix@CWorker@@UAE_NPBDAAUValueItemInfo@CGAccess@@_N@Z
?SetWriteFifo@CWorker@@UAEXPAV?$CRingBuffer@PAUNcCode@@$03@@H@Z
?Log@CGAccess@@2P6AXPBD00@ZA
??0CWorker@@QAE@PBD@Z
??1CWorker@@UAE@XZ
??3Part@@SAXPAX@Z
?Read@CWorker@@UAEPAUNcCode@@XZ
??2Part@@SAPAXII@Z
?Reset@CWorker@@UAE_NXZ
RtTrace
?IsPipeAborted@CWorker@@UAE_NXZ
?SwitchToMainFiber@CWorker@@UAEXXZ
?Wait@CWorker@@UAEXPAX@Z
?Syn@CWorker@@UAEXXZ
?SynIfNeed@CWorker@@UAEXXZ
?Msg@CWorker@@UAEXPBD0@Z
?Pause@CWorker@@UAEXN@Z
?Initialize@CWorker@@UAE_NPAUlua_State@@@Z
?ReadSetting@CWorker@@UAE_NPAUlua_State@@@Z
?WriteSetting@CWorker@@UAE_NPAUlua_State@@@Z
?SetReadFifo@CWorker@@UAEXPAV?$CRingBuffer@PAUNcCode@@$03@@H@Z

msvcp100

_Nan

msvcr100

?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
memset
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
vsprintf_s
_strnicmp
_vsnprintf_s
??3@YAXPAX@Z
_crt_debugger_hook
_amsg_exit
__CppXcptFilter
??2@YAPAXI@Z
__CxxFrameHandler3

zua

lua_getglobal
lua_setglobal
luaL_setfuncs
lua_createtable
lua_pushboolean
lua_topointer
lua_pushlightuserdata
luaL_checklstring

Exports

Exports

CreateEstimate
DeleteEstimate
ReadUpNcCode
Stop
luaopen_Estimate

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a80a9822526c70112cc85753be7cd5c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

engine

msvcp100

msvcr100

zua

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 940B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 940B