4e041465023a8d706bbd586d816e5c583e2add28924860e46c6706ffc67cd908

Sharing

Copy URL Twitter E-mail

General

Target

4e041465023a8d706bbd586d816e5c583e2add28924860e46c6706ffc67cd908
Size

17KB
MD5

71c258e1cc3fb860116d5e1bacab7cc2
SHA1

8d58b636a973c77b4d8a09fe15cafdf24d8b3bb2
SHA256

4e041465023a8d706bbd586d816e5c583e2add28924860e46c6706ffc67cd908
SHA512

b650f79a49a57c713e9d0426f7a8582f6638dfcf6a9891afde179297deacfc4363d227c99f71464a79d67e01ab990bc66389720d06cb5c39b2728a491ff20b85
SSDEEP

192:CGvR8P3E4LGXPJ4eqTU5RDGRx2i2UODtEn6yCDLpEB264pf:CGpi36OD2PKODtEqpXf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e041465023a8d706bbd586d816e5c583e2add28924860e46c6706ffc67cd908

Files

4e041465023a8d706bbd586d816e5c583e2add28924860e46c6706ffc67cd908
.dll windows:6 windows x64 arch:x64

66b10b60f61e2f6160ce671fd212e7f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\TomoVision\Prog\MSC\obj_Release_x64\Menu_2D_TAG_Save\Menu_2D_TAG_Save.pdb

Imports

kernel32

Sleep
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW

lib_convert

?Multi_Tag_Id@@3EA

lib_util

?Error_Fct@@YAHPEAUHWND__@@IPEB_WZZ
?Fct_Random_Seed@@YAXI@Z
?hwnd@@3PEAUHWND__@@EA
?Fct_Random_Int@@YAIXZ

module_structures

?Script_Read_Line@@YAHQEB_WZZ
?Fct_Variable_Value@@YAPEAXPEB_WPEAHPEAGPEAP6AHXZ@Z
?License_SliceO_Check@@YAHH@Z
?Fct_Tool_Text_Cleanup@@YAXHPEAPEAPEA_W@Z
?Fct_Tool_Text_Read@@YAHPEADPEAPEAPEA_W@Z

msvcp140

_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memcpy
__current_exception
__current_exception_context
memset

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_initterm
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_at_quick_exit
_initterm_e

Exports

Exports

Ctrl_Create
Ctrl_Open
Exit
Register
Sort
Version

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66b10b60f61e2f6160ce671fd212e7f2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

lib_convert

lib_util

module_structures

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 744B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 44B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 744B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 44B