5e0b59493197685006f533943db9a65c014ff40c7e99ece8f608596561cada17

Sharing

Copy URL Twitter E-mail

General

Target

5e0b59493197685006f533943db9a65c014ff40c7e99ece8f608596561cada17
Size

744KB
MD5

31d0861d964bf327b648806ba03d5f87
SHA1

7d440dff52143b999f5aa80fcf73f21d91b8fb68
SHA256

5e0b59493197685006f533943db9a65c014ff40c7e99ece8f608596561cada17
SHA512

cf4a5ddac9aa81f7ac86c85d8333948d37f3c5a6e880f2f043ec64c36c9add49e5ca3f5380cf28fbdd9b23a116dcaa8e60a497f74d81a6bd27da9297829df401
SSDEEP

12288:xlZnOPXwFP9JNGZ7LTh8+BTkwZWbH0vj8/nfEYYvKQpNrqIQs+lxeZEttQYf:5O8JNGlDBTkH0vjCfEYYLpNrs3nQYf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e0b59493197685006f533943db9a65c014ff40c7e99ece8f608596561cada17

Files

5e0b59493197685006f533943db9a65c014ff40c7e99ece8f608596561cada17
.dll windows:4 windows x86 arch:x86

b869e1021db3d2633a9366b2a27a03f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

cschangetext

ord8
ord4
ord6

baseinterface

?ScannerSettingFolder@@YA?AVCString@@XZ
?LaserSettingIni@@YA?AVCString@@XZ
?WriteConfigProfileString@@YAHPBD000@Z
?GetConfigProfileDouble@@YANPBD0N0@Z
?WriteConfigProfileInt@@YAHPBD0H0@Z
?GetConfigProfileInt@@YAHPBD0H0@Z
?MmToOthers@@YANN@Z
?GetUnit@@YAHXZ
?OthersToMm@@YANN@Z
GetUserConfigPath
?ScannerSettingIni@@YA?AVCString@@XZ
?GetConfigProfileString@@YAKPBD00PADK0@Z
?WriteConfigProfileDouble@@YAHPBD0N0@Z

mfc42

ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord800
ord641
ord860
ord540
ord324
ord825
ord2370
ord4234
ord6334
ord2379
ord4710
ord2575
ord6055
ord1776
ord4396
ord5290
ord3402
ord4424
ord3574
ord3571
ord609
ord567
ord3663
ord3626
ord2414
ord2367
ord2302
ord4299
ord1641
ord1146
ord1200
ord535
ord858
ord922
ord2818
ord537
ord6199
ord3092
ord2289
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord2301
ord2358
ord2864
ord668
ord1980
ord3185
ord2781
ord2770
ord924
ord356
ord941
ord939
ord926
ord2393
ord5583
ord3317
ord5981
ord3097
ord2642
ord6215
ord798
ord6648
ord1997
ord4129
ord5465
ord5194
ord533
ord2915
ord1140
ord6877
ord6407
ord5710
ord3610
ord2582
ord4402
ord3370
ord3640
ord3749
ord656
ord2363
ord3181
ord4204
ord3178
ord823
ord6453
ord3499
ord2515
ord355
ord2764
ord3177
ord665
ord603
ord1979
ord1969
ord2801
ord6663
ord5461
ord273
ord5186
ord354
ord6404
ord3301
ord6762
ord6907
ord3874
ord6929
ord3998
ord686
ord3996
ord2862
ord2096
ord384
ord6696
ord1168
ord1253
ord342
ord1182
ord5572
ord6883
ord6467
ord1154
ord3398
ord3733
ord810
ord3920
ord6880
ord2086
ord4000
ord2425
ord801
ord541
ord1199
ord1948
ord2396
ord3346
ord5300
ord5303
ord4079
ord4699
ord5307
ord5289
ord5715
ord4622
ord565
ord817
ord2726
ord4226
ord2298
ord1106
ord2362
ord2452
ord4275
ord640
ord5875
ord1640
ord323
ord2243
ord2089
ord4278
ord6662
ord2080
ord2078
ord2516
ord361
ord5683
ord2513
ord293
ord4124
ord613
ord289
ord4133
ord4297
ord6119
ord4694
ord5148
ord2291
ord2294
ord755
ord2405
ord5794
ord5785
ord470
ord6007
ord6905
ord5608
ord2847
ord6143
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord693

msvcrt

_onexit
__dllonexit
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
time
srand
rand
strncpy
printf
malloc
free
sprintf
_vsnprintf
_CxxThrowException
__CxxFrameHandler
_ftol
atof
_mbscmp
atoi
_splitpath

kernel32

GetPrivateProfileIntA
OutputDebugStringA
lstrcpyA
lstrlenA
GetProcAddress
LoadLibraryA
FreeLibrary
WritePrivateProfileStringA
GetModuleFileNameA
CopyFileA
GetPrivateProfileStringA
Sleep
CreateDirectoryA
GetTickCount

user32

EnableWindow
GetWindowRect
GetDC
SendMessageA
LoadBitmapA
SetTimer
SetCursor
GetClientRect
SetCapture
GetCapture
ReleaseCapture
ClipCursor
InvalidateRect
LoadCursorA
PostQuitMessage
UpdateWindow
UnregisterHotKey
RegisterHotKey
IsWindowVisible
SetParent
ShowCaret
GetParent
IsWindow
KillTimer

gdi32

GetObjectA
CreateCompatibleDC
StretchBlt
GetTextExtentPoint32A
GetDeviceCaps

shlwapi

PathIsDirectoryA

usbdevice

ord540
ord548
ord551
ord542
ord552
ord609
ord612
ord541
ord565
ord553
ord593
ord596
ord594
ord613
ord602
ord603
ord624
ord635
ord534
ord557
ord558
ord559
ord628
ord638
ord536
ord537
ord644
ord597
ord587
ord623
ord599
ord591
ord590
ord589
ord600
ord598
ord588
ord42
ord630
ord32
ord626
ord535
ord632
ord645

Exports

Exports

CanPreviewToMarkAuto
CloseAdjustThread
CloseMotorStatusThread
CorrectCurrent
DbgPrint
DownloadMarkSettings
EnInvertPWM
EnSetPulseWidth
FreeEMSetting
GetAdjustEnergyProperty
GetAdjustSpace
GetAssSnapState
GetAssState
GetAutoPreviewState
GetCO2DutyLimit
GetCorDatatType
GetCorrectFileName
GetCorrectFolderName
GetCorrectMode
GetCurrentUserLevel
GetFrequencyLimit
GetGridSnapState
GetGridSpace
GetGridState
GetHomeType
GetIPG_PWM_Type
GetInputPortSetting
GetLaserType
GetLightCorrect
GetLightSpeed
GetMarkIOSetting
GetMaxCurrent
GetModuleMaxHomeTime
GetMotorDirection
GetMotorHomeSpeed
GetMotorParameters
GetMotorSpeedSetting
GetMotorStepSpeed
GetMotorWorkSpace
GetObjectSnapState
GetOptimizationCenter
GetOptimizationCutting
GetOptimizationFill
GetOriginPos
GetOriginXYZ
GetOutputPortSetting
GetPA_MO_Delay
GetPasteOffset
GetPreionization
GetPrintLogoSetting
GetPrinterSetting
GetPulseMode
GetRotateCorrectInfo
GetRotateDelay
GetRotateRatio
GetRotateSplitAngleRange
GetRotateSplitType
GetRulerState
GetSPIProperty
GetSafePort
GetSafetyMarkState
GetScannerDynamicNum
GetScannerModeName
GetScannerModeNum
GetScannerType
GetSortType
GetSplitSize
GetSplitType
GetStepMotorSetting
GetTableHomePos
GetWorkpieceInfo
GetWorkpieceSplitInfo
GetWorkspaceSize
GetXCorrectPara
GetYCorrectPara
GetZCorrect
GetZCorrectOffset
GetZDefaultPos
GetZHeight
GetZMode
GetZOffsets
HideAdjustWindow
HideModuleAdjustWindow
HideMotorStatusWindow
InitializeAdjustEnergy
InitializeLaserSetting
IsAdjustWindowVisible
IsFinishedHome
IsModuleAdjustWindowVisible
IsMotorStatusWindowVisible
IsMotorXEnable
IsMotorYEnable
IsNewAdjustType
IsRotateMarkEnable
IsRotateMarkFinishedHome
IsScannerAutomic
IsScannerAutomicHomeInit
IsScannerAutomicHomeRangeChange
IsSplitMarkEnable
IsTableModuleEnable
ReadCorrectPara_0
ReadCorrectPara_1
ReadCorrectPara_PV
ReadMotorPara
ReadSystemPara
RefreshAdjustWindow
RefreshMotorStatusWindow
ResetCorrectMode
ResetDynamicModulePos
ResetMotorZProperty
ResetTableModulePos
SetAssSnapState
SetAssState
SetCurCSCBoard
SetGridSnapState
SetGridState
SetMotorHomeSpeed
SetMotorSpeedSetting
SetObjectSnapState
SetRulerState
SetSafetyMarkState
ShowAdjustWindow
ShowEMSettingDlg
ShowModuleAdjustWindow
ShowMotorStatusWindow
ShowRotateMarkWindow
ShowSplitMarkWindow
ShowTableAdjustWindow
StartAdjustThread
StartMotorStatusThread
TableModuleHome
TransMotorValue

Sections

.text
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b869e1021db3d2633a9366b2a27a03f3

Headers

File Characteristics

Imports

cschangetext

baseinterface

mfc42

msvcrt

kernel32

user32

gdi32

shlwapi

usbdevice

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 150KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 492KB - Virtual size: 491KB

.rsrc Size: 44KB - Virtual size: 43KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 152KB - Virtual size: 150KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 492KB - Virtual size: 491KB

.rsrc
Size: 44KB - Virtual size: 43KB

.reloc
Size: 20KB - Virtual size: 17KB