010787cc66284513a5f5e8231b5efa918e8a09062018ef4d9371ba87870d651d

Sharing

Copy URL Twitter E-mail

General

Target

010787cc66284513a5f5e8231b5efa918e8a09062018ef4d9371ba87870d651d
Size

302KB
MD5

d4ddc9d3433ea4e3afe849fc77bc018f
SHA1

1be26049625d60e2ba4afa6a570af30b0d848d7a
SHA256

010787cc66284513a5f5e8231b5efa918e8a09062018ef4d9371ba87870d651d
SHA512

25fad9b84e66e1f35f7980e402b8892655e49fd6204e61e700dceb844d2118f3b8cdafafa065bedb67e113725708140df5171c9dcaae5f7c9f376b797b4a06c0
SSDEEP

3072:tHg5XYDJ+jRy5paDIIxGSb7ISpOfq9gyPvo+SQvrHSrtU0kviu0//ioMVElkx1Qj:tFAIyGy7ISQqSxzYV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
010787cc66284513a5f5e8231b5efa918e8a09062018ef4d9371ba87870d651d

Files

010787cc66284513a5f5e8231b5efa918e8a09062018ef4d9371ba87870d651d
.exe windows:6 windows x86 arch:x86

961aa13b12de8d26ba2652bb826a7a00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Scr\Simba\SPRD_MES_DLL_V2.0\Unisoc_Solution_MES\Unisoc_Solution_MES\Common\Lib\Unisoc_MES_Login.pdb

Imports

unisoc_solution_mes

MES_Login
MES_Logout
MES_V2_SendDatabase
MES_V2_GetDbList
MES_V2_GetBatchList
MES_V2_GetProcessFlow
MES_Handle_Release
MES_V1_GetStationListByBatch
MES_GetLastError
MES_V2_GetDocumentListEx
MES_V2_GetSequenceFile
MES_V2_GetBatchInfo
MES_V1_QueryStation
MES_V1_QueryBatch
MES_V1_QueryAccount
MES_EnableCheck
MES_V2_GetLine
MES_V2_GetHouse
MES_Handle_Create

unisoc_solution_printlog

PLOG_Handle_Create
PLOG_Handle_Release
PLOG_Set_Log_Param

mfc140u

ord995
ord1472
ord7997
ord2205
ord952
ord13911
ord6860
ord10250
ord5763
ord12928
ord12219
ord12251
ord10433
ord8217
ord4589
ord12247
ord12239
ord5918
ord3852
ord6349
ord14668
ord6350
ord14669
ord6348
ord14667
ord8000
ord14466
ord11983
ord11982
ord2034
ord7941
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord2486
ord5357
ord8324
ord12865
ord8386
ord8470
ord14131
ord5422
ord8773
ord8464
ord11038
ord1526
ord12793
ord4477
ord13628
ord13800
ord13806
ord5882
ord6533
ord1513
ord1133
ord6549
ord12921
ord2246
ord1066
ord6490
ord9126
ord3145
ord4219
ord12559
ord8817
ord14547
ord14234
ord2029
ord14137
ord7820
ord1462
ord985
ord7653
ord3833
ord9468
ord7654
ord1446
ord1002
ord6834
ord6129
ord3941
ord12124
ord11717
ord4974
ord12220
ord14588
ord12089
ord9135
ord3257
ord4236
ord13981
ord8172
ord12457
ord8339
ord3842
ord4255
ord4285
ord4251
ord4209
ord4113
ord6220
ord13756
ord3305
ord3302
ord8210
ord2761
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12078
ord3838
ord11936
ord14578
ord8965
ord12171
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4912
ord4927
ord4988
ord4502
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord13703
ord5935
ord2682
ord3939
ord3372
ord3371
ord3265
ord12168
ord5249
ord5549
ord5760
ord9350
ord5525
ord5790
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10255
ord9209
ord6804
ord10379
ord286
ord1689
ord6751
ord14657
ord12405
ord2383
ord14604
ord12348
ord2378
ord2215
ord4886
ord1511
ord6559
ord1523
ord6489
ord4885
ord265
ord266
ord1412
ord928
ord280
ord1525
ord1171
ord540
ord2522
ord6566
ord3882
ord2385
ord296
ord1045
ord4815
ord2304
ord4237
ord3364
ord3258
ord8991
ord2653
ord11775
ord2624
ord2649
ord9136
ord12121
ord10600
ord5840
ord11583
ord4466
ord9298
ord7640
ord1070
ord6497
ord9128
ord3147
ord4222
ord8744
ord2993
ord3872
ord1447
ord968
ord7411
ord12131
ord9040
ord11396
ord4092
ord3404
ord3403
ord3164
ord6218
ord13752
ord2760
ord12173
ord9235
ord9210
ord1391
ord890
ord13544
ord10472
ord11015
ord14507
ord7495
ord3697
ord1113
ord1111
ord4179
ord462
ord2409
ord12531

kernel32

GetLocalTime
CreateDirectoryA
CloseHandle
CreateThread
CreateEventW
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringW
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
ReleaseMutex
CreateMutexW
DeleteCriticalSection
GetLastError
InitializeCriticalSectionEx
GetModuleFileNameW
GetPrivateProfileStringA
WritePrivateProfileStringA
WideCharToMultiByte
GetModuleFileNameA
VirtualQuery
GetProcAddress
GetVersion
MultiByteToWideChar
GetVersionExW

user32

GetSysColor
IsIconic
GetSystemMenu
SwitchToThisWindow
FindWindowW
LoadIconW
DrawIcon
KillTimer
SetTimer
GetWindowRect
GetClientRect
SendMessageW
InvalidateRect
EnableWindow
LoadBitmapW
AppendMenuW
GetSystemMetrics
SetRect

gdi32

CreateFontW
CreateSolidBrush

shell32

ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsA
PathIsDirectoryA

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

vcruntime140

_CxxThrowException
memmove
__current_exception_context
__current_exception
memset
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
__std_terminate
_except_handler4_common
memcpy

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_set_app_type
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
exit

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-stdio-l1-1-0

fputs
__p__commode
__stdio_common_vsprintf_s
_set_fmode
fseek
fclose
fopen_s

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

961aa13b12de8d26ba2652bb826a7a00

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

unisoc_solution_mes

unisoc_solution_printlog

mfc140u

kernel32

user32

gdi32

shell32

comctl32

shlwapi

msvcp140

version

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 81KB - Virtual size: 80KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 183KB - Virtual size: 182KB

.reloc Size: 8KB - Virtual size: 80KB

.text
Size: 81KB - Virtual size: 80KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 183KB - Virtual size: 182KB

.reloc
Size: 8KB - Virtual size: 80KB