3d347dd7e814c953fa393734f8ef48dcedbd87d292e2579a1ca0e565db9166af

Sharing

Copy URL Twitter E-mail

General

Target

3d347dd7e814c953fa393734f8ef48dcedbd87d292e2579a1ca0e565db9166af
Size

709KB
MD5

e0ebd19d83388226f0fa16e4a295a169
SHA1

5ccf9580017f09ccaca1219c8a7ef08c728f8e51
SHA256

3d347dd7e814c953fa393734f8ef48dcedbd87d292e2579a1ca0e565db9166af
SHA512

adde73e8a51c70146648d0fa4d8b3dd3eaf7c69473d2a700182bb48dfbbd8478eff417bb18c90f2612a49de9a71ce9b5b02086875b6900a984841a2bae4f6900
SSDEEP

6144:d2bqb2D4H/KZbOZZdk2BfUE/OkVklLmX/klLmXCY:d2DySZmtBfL5klLmX/klLmXCY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d347dd7e814c953fa393734f8ef48dcedbd87d292e2579a1ca0e565db9166af

Files

3d347dd7e814c953fa393734f8ef48dcedbd87d292e2579a1ca0e565db9166af
.exe windows:5 windows x86 arch:x86

07b555acb040994973aad38c94df69e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Giba\Desktop\Package [SOURCE] JRteam\eMU\DataServer\Release\DataServer_EX803\DataServer.pdb

Imports

kernel32

GetLocalTime
CreateFileA
SetFilePointer
WriteFile
GetFileSize
ReadFile
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetErrorMode
SetUnhandledExceptionFilter
GetVolumeInformationA
GetSystemInfo
TerminateProcess
GetModuleHandleA
VirtualProtect
VirtualQuery
TerminateThread
CreateIoCompletionPort
CreateDirectoryA
CreateThread
SetThreadPriority
CreateSemaphoreA
ReleaseSemaphore
GetQueuedCompletionStatus
WaitForSingleObject
ExitProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
CloseHandle
GetTickCount
GetPrivateProfileIntA
GetPrivateProfileStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
InitializeCriticalSection

user32

wsprintfA
SetWindowTextA
SetTimer
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
DialogBoxParamA
LoadStringA
DestroyWindow
DefWindowProcA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
GetClientRect
EndDialog
PostQuitMessage
GetDC
FillRect
ReleaseDC
MessageBoxA

gdi32

CreateSolidBrush
GetStockObject
TextOutA
SetTextColor
SelectObject
SetBkMode
DeleteObject
CreateFontA

odbc32

ord13
ord24
ord75
ord7
ord31
ord36
ord11
ord20
ord18
ord8
ord4
ord26
ord16
ord72

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
??1_Container_base12@std@@QAE@XZ
?_Swap_all@_Container_base12@std@@QAEXAAU12@@Z
?_Xlength_error@std@@YAXPBD@Z

ws2_32

WSAAccept
inet_ntoa
WSASend
listen
bind
htonl
WSASocketA
recv
closesocket
WSAStartup
WSAGetLastError
socket
htons
inet_addr
gethostbyname
connect
WSARecv
send

rpcrt4

UuidCreateSequential

dbghelp

MiniDumpWriteDump

psapi

GetModuleInformation

msvcr100

memmove
_CxxThrowException
memcpy
memset
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
asctime_s
_localtime64_s
strncpy_s
_atoi64
atof
_time64
srand
rand
isalnum
isalpha
atoi
isdigit
isspace
??_V@YAXPAX@Z
vsprintf_s
_stricmp
tolower
strstr
strcpy_s
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??3@YAXPAX@Z

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 530KB - Virtual size: 530KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07b555acb040994973aad38c94df69e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

odbc32

msvcp100

ws2_32

rpcrt4

dbghelp

psapi

msvcr100

Sections

.text Size: 130KB - Virtual size: 129KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 2KB - Virtual size: 828KB

.rsrc Size: 530KB - Virtual size: 530KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 130KB - Virtual size: 129KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 2KB - Virtual size: 828KB

.rsrc
Size: 530KB - Virtual size: 530KB

.reloc
Size: 17KB - Virtual size: 17KB