287594f20af6f24428cb592a01dcff8c82cc0557f9602ec759a0d34b3e729af9

Sharing

Copy URL Twitter E-mail

General

Target

287594f20af6f24428cb592a01dcff8c82cc0557f9602ec759a0d34b3e729af9
Size

584KB
MD5

80e21ab58556dd4acb85dead0f083fde
SHA1

8cc16e6a1aaa0fee8a4e5ff5943f06b2b20c24ed
SHA256

287594f20af6f24428cb592a01dcff8c82cc0557f9602ec759a0d34b3e729af9
SHA512

29d4450771c1e3f03fbb61a665345d592eeaa67d282ccb3849eeac39d2240f6465f7ac0b33e34e82714cd064378707773aeac2fcf8af862035f776329f74221f
SSDEEP

12288:bpA9iDf010/ECr/SoohZJUVeQb06gevFwouwAbMSa:MOM46FhZEPAbMx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
287594f20af6f24428cb592a01dcff8c82cc0557f9602ec759a0d34b3e729af9

Files

287594f20af6f24428cb592a01dcff8c82cc0557f9602ec759a0d34b3e729af9
.dll windows:5 windows x86 arch:x86

cf000e08e96860a3d378b0cb353a5e43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Gandalf勿动\20210712\Release\SComplexNeedle.pdb

Imports

readfile

?g_GetPatternFile@@YAHAAV?$CTypedPtrList@VCObList@@PAVCDefinedSplit@@@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?g_GetMotifFile@@YAHAAV?$CList@VCStitchPos@@V1@@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@1@Z

smath

?g_FixPointAtPolyline@@YAXAAV?$CList@VCTPoint@@V1@@@ABVCTPoint@@AAV2@AANAAPAU__POSITION@@44@Z
?g_IdCurveCtrlPointBezier@@YAXAAV?$CList@VCTPoint@@V1@@@0H@Z
?g_DistOfTwoPoint@@YANVCTPoint@@0@Z
?g_FloatToInt@@YAJABN@Z
?g_GetLineInnerPoint@@YAXAAVCTPoint@@00N@Z
?g_Get3PointAngle@@YANABVCTPoint@@00@Z
?g_DistOfTwoPoint@@YANHHHH@Z
?g_TBCurveToLine@@YAXAAV?$CList@VCTPoint@@V1@@@0H@Z
?g_CounterClockWiseOflist@@YAXAAV?$CList@VCTPoint@@V1@@@@Z
?g_GetListBoundRect@@YA?AVCRect@@AAV?$CList@VCTPoint@@V1@@@@Z
?g_IsTwoPolylineOfInt@@YAHAAV?$CList@VCTPoint@@V1@@@0@Z
?g_GetPointToPolylineOfDis@@YANAAV?$CList@VCTPoint@@V1@@@VCTPoint@@AAV2@@Z
?g_FixPointAtline@@YAHVCTPoint@@00AAV1@@Z

arithmetic

?g_Offsetlist@@YAXAAV?$CList@UdPOINT@@U1@@@HH0@Z

mfc90u

ord813
ord600
ord280
ord712
ord5883
ord2458
ord2523
ord3589
ord6822
ord5778
ord6811
ord5767
ord1243
ord1707
ord1248
ord2571
ord1070
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord296
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord6018
ord3112
ord4728
ord2966
ord3115
ord2774
ord2251
ord6131
ord3590
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord4211
ord794
ord589
ord4043
ord266
ord265
ord799
ord801
ord1607
ord285
ord3220
ord1552
ord5770
ord3187
ord605
ord1274
ord321
ord1241
ord1239
ord1264
ord1180
ord1233
ord2084
ord391
ord1152
ord1273
ord1271
ord1145
ord1076
ord1137
ord322
ord802
ord1088
ord5535
ord663
ord404
ord811
ord286
ord2983
ord2537
ord464
ord2771
ord1039

msvcr90

_CIsin
_CIcos
_CIsqrt
floor
_CIacos
_CxxThrowException
memset
_CIatan2
_CIatan
_CItan
?what@exception@std@@UBEPBDXZ
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
__CxxFrameHandler3
_finite
ceil
_time64
srand
exit
malloc
_wsplitpath_s
rand
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
memmove_s
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
_CIasin
??0exception@std@@QAE@ABV01@@Z

kernel32

LocalAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LocalFree
IsDebuggerPresent
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetModuleFileNameW

user32

UnionRect
SetRectEmpty

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Exports

Exports

?g_CreateComplexStitch@@YAHAAV?$CTypedPtrList@VCObList@@PAVCComplexline@@@@VCTPoint@@1AAV?$CTypedPtrList@VCObList@@PAVCDefinedSplit@@@@11AAVCStitchFillType@@AAVCStitchEffect@@AAV?$CList@VCStitchPos@@V1@@@@Z
?g_GetPathOfStipple@@YAHAAV?$CTypedPtrList@VCObList@@PAVCComplexline@@@@VCTPoint@@111AAVCStitchFillType@@AAVCStitchEffect@@AAV?$CList@PAVCComplexline@@PAV1@@@@Z
?g_GetPathOfZigzag@@YAHAAV?$CTypedPtrList@VCObList@@PAVCComplexline@@@@VCTPoint@@111AAVCStitchFillType@@AAVCStitchEffect@@AAV?$CList@PAVCComplexline@@PAV1@@@@Z

Sections

.text
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf000e08e96860a3d378b0cb353a5e43

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

readfile

smath

arithmetic

mfc90u

msvcr90

kernel32

user32

msvcp90

Exports

Exports

Sections

.text Size: 537KB - Virtual size: 536KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 537KB - Virtual size: 536KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB