02a870a96655785c7fe38fc9e25b35e2fa385c1015c2f3b216576b59543aceb4

Sharing

Copy URL Twitter E-mail

General

Target

02a870a96655785c7fe38fc9e25b35e2fa385c1015c2f3b216576b59543aceb4
Size

35KB
MD5

b1520596ee4df0caa4a20d43c588d166
SHA1

fbc0c93013cd7be3528d23adcdfdbee06f7b6d45
SHA256

02a870a96655785c7fe38fc9e25b35e2fa385c1015c2f3b216576b59543aceb4
SHA512

c70877061850a66ec0005c06e5f563d82533fccd93fdf6f94512349f8136f34f67ec97da893af6236842f81818530ce9c5a3c03f4373e25c796ad63eb47174ec
SSDEEP

768:p3pm1dxI1q7sZzmeGjPUGbn6JhHCp+DzGQp+9pOZdD+Gcz/:p3IjwyXPRD6JhHCEGQsDOZ/cz/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02a870a96655785c7fe38fc9e25b35e2fa385c1015c2f3b216576b59543aceb4

Files

02a870a96655785c7fe38fc9e25b35e2fa385c1015c2f3b216576b59543aceb4
.dll windows:5 windows x86 arch:x86

3aef60ae5c54fdd9fd4402dbac39072c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\tfsagent\_work\12\s\src\Release9\NcCodeIssuer.pdb

Imports

kernel32

Sleep
LeaveCriticalSection
EnterCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer

engine

ComputeAngle
?Enter@CLuaAccess@@QAE_NH@Z
?Read@CLuaAccess@@QAE_NAAHPBD1HH@Z
?Write@CLuaAccess@@QAE_NNPBD@Z
?PostMsg@CWorker@@UAEXI@Z
?GetStationIndex@CWorker@@UAEHXZ
?SetPhoenix@CWorker@@UAE_NPBDAAUValueItemInfo@CGAccess@@_N@Z
??0CLuaAccess@@QAE@PAUlua_State@@@Z
??1CLuaAccess@@UAE@XZ
?Enter@CLuaAccess@@QAE_NPBD@Z
?Read@CLuaAccess@@QAE_NAANHPBDNN@Z
?Leave@CLuaAccess@@QAEXXZ
?Read@CLuaAccess@@QAE_NAA_NH@Z
?Write@CLuaAccess@@QAE_NNH@Z
?Log@CGAccess@@2P6AXPBD00@ZA
??0CWorker@@QAE@PBD@Z
??1CWorker@@UAE@XZ
?Read@CLuaAccess@@QAE_NAA_NPBD@Z
?Write@CLuaAccess@@QAE_N_NPBD@Z
?Reset@CWorker@@UAE_NXZ
?Read@CWorker@@UAEPAUNcCode@@XZ
??3Part@@SAXPAX@Z
?LS@CGAccess@@SAPADPBD0@Z
GetArcLen
GetAngleAndRadiusByRatio
?IsPipeAborted@CWorker@@UAE_NXZ
?SwitchToMainFiber@CWorker@@UAEXXZ
?Write@CWorker@@UAEXPAUNcCode@@@Z
?Wait@CWorker@@UAEXPAX@Z
?Syn@CWorker@@UAEXXZ
?SynIfNeed@CWorker@@UAEXXZ
?Msg@CWorker@@UAEXPBD0@Z
?Pause@CWorker@@UAEXN@Z
?SetReadFifo@CWorker@@UAEXPAV?$CRingBuffer@PAUNcCode@@$03@@H@Z
?SetWriteFifo@CWorker@@UAEXPAV?$CRingBuffer@PAUNcCode@@$03@@H@Z
?GetPhoenix@CWorker@@UAE_NPBDAAUValueItemInfo@CGAccess@@_N@Z
?TryGetPhoenix@CWorker@@UAE_NPBDAAUValueItemInfo@CGAccess@@_N@Z

msvcp100

_Nan

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_CIcos
_CIsin
__CxxFrameHandler3
_CxxThrowException
memset
_CIsqrt
_except_handler4_common
_crt_debugger_hook
??3@YAXPAX@Z
??2@YAPAXI@Z
_vsnprintf_s
ceil
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_stricmp

rtcp

CreateRtcp
DeleteRtcp

zua

lua_createtable
lua_setglobal
lua_topointer
lua_pushlightuserdata
luaL_checklstring
lua_getglobal
lua_pushboolean
luaL_setfuncs
lua_newthread

Exports

Exports

Clear
CmdIssuerStop
CreateNcCodeWorker
DeleteNcCodeWorker
ReadNcCode
luaopen_NcCodeIssuer

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3aef60ae5c54fdd9fd4402dbac39072c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

engine

msvcp100

msvcr100

rtcp

zua

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB