ad9942686cf84005b055873cc000f7fc46387680e583fe3809c6acb7c7dffebe

Sharing

Copy URL

Twitter E-mail

General

Target

ad9942686cf84005b055873cc000f7fc46387680e583fe3809c6acb7c7dffebe
Size

80KB
MD5

fb97831c27e88a954f35cc75a519ea2d
SHA1

0f27562fe6d288e38f2b4f46559eb3daef18e2ef
SHA256

ad9942686cf84005b055873cc000f7fc46387680e583fe3809c6acb7c7dffebe
SHA512

6236bfd1a41aa035df00dc786014456a7ccb1d26d66ec7e845ae5fa3b6e07e3f44e865cc2ec256a1a262170f68058b892442ae5ecaf780c46341105666ef3491
SSDEEP

1536:eu7z5LOMoTi25oOQZj1Z5ynNDziQSft4xajrKY7o33yfMZOQXbbpu:r13rZUNviQSft4xaHKY7oDZOQXb9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad9942686cf84005b055873cc000f7fc46387680e583fe3809c6acb7c7dffebe

Files

ad9942686cf84005b055873cc000f7fc46387680e583fe3809c6acb7c7dffebe
.exe windows:5 windows x86 arch:x86

e6a8083f178903baae85e67cd37d3d5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ramgui

RamguiInvokeThreePortSmallRamUI_TGI
RamguiInvokeTwoPortRamUI_TGI
RamguiInvokeDualPortRamUI_TGI

amfc

??0AmfcMdbQueryDisplay@@QAE@W4ActALLOCATE@@@Z

tgifactory

?AddFileDescriptor@SpiritFileSet@Tgifactory@@QAE_NABVSpiritFileDescriptor@2@@Z
?AddFileSet@SpiritComponent@Tgifactory@@QAE_NABVSpiritFileSet@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteCXF@SpiritComponent@Tgifactory@@QAE_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1SpiritBase@Tgifactory@@UAE@XZ
?SendTGIParameters@TgiClientWrapper@Tgifactory@@QAE_NABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z
?GetTGIParameters@TgiClientWrapper@Tgifactory@@QAEXAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VParameterDetails@Tgifactory@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VParameterDetails@Tgifactory@@@std@@@2@@std@@@Z
??0SpiritFileDescriptor@Tgifactory@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
??0CmdLine@Tgifactory@@QAE@HQAPAD@Z
?GetParameter@CmdLine@Tgifactory@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
??0TgiClientWrapper@Tgifactory@@QAE@HQAPAD@Z
?ConnectToTGIServer@TgiClientWrapper@Tgifactory@@QAE_NXZ
?GetTGI@TgiClientWrapper@Tgifactory@@QAEPAVTgiclient@@XZ
??1ParameterDetails@Tgifactory@@QAE@XZ
??0SpiritFileSet@Tgifactory@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AddView@SpiritComponent@Tgifactory@@QAE_NABVSpiritView@2@@Z
??0SpiritView@Tgifactory@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0SpiritComponent@Tgifactory@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?GetValue@ParameterDetails@Tgifactory@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

base

??1ActEnv@@QAE@XZ
MdbKillFL
?MdbSetDisplayClass@@YAXPAVMdbDisplayLtr@@@Z
?SysDeleteFile@@YAXABVSysPath@@@Z
?SysMakeDirs@@YAXABVSysPath@@@Z
ArgsParse
DefSetFL
MdbInitFL
SysPathStat
SysMkdir
?SysCreateQualifiedPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD0@Z

mfc90

ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4890
ord2769
ord3659
ord589
ord793
ord1186
ord798
ord2447
ord4029
ord800
ord3110
ord2961
ord4714
ord3107
ord2978
ord2766
ord6001
ord5646
ord5663
ord4981
ord4333
ord5659
ord5657
ord3209
ord2087
ord4199
ord5813
ord6721
ord5533
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord1137
ord4434
ord4409
ord6783
ord4667
ord4159
ord1276
ord1046

msvcr90

_setmbcp
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
sprintf
isspace
ispunct
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
_purecall
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ

kernel32

InterlockedExchange
GetStartupInfoA
Sleep
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedCompareExchange

msvcp90

?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

og1200-vc90as

?GXInit@@YGXIPBD0@Z

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6a8083f178903baae85e67cd37d3d5f

Headers

DLL Characteristics

File Characteristics

Imports

ramgui

amfc

tgifactory

base

mfc90

msvcr90

kernel32

msvcp90

og1200-vc90as

Sections

.text Size: 50KB - Virtual size: 49KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 50KB - Virtual size: 49KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB