38dc72c3eabf9cce0c73f2a7c4ab62f0754797001c91aa6b74d6810dbf1df1ab

Sharing

Copy URL Twitter E-mail

General

Target

38dc72c3eabf9cce0c73f2a7c4ab62f0754797001c91aa6b74d6810dbf1df1ab
Size

22KB
MD5

46e308ad75f5b9af78881b2a6b078c8b
SHA1

08db9a7b9386a597eaf8805c8b87cec83dd3029c
SHA256

38dc72c3eabf9cce0c73f2a7c4ab62f0754797001c91aa6b74d6810dbf1df1ab
SHA512

ec7316eb8891ba2b8250dd2ec1e61e6f8774e76de57055e0a8c04a51421db4274fad968f04456ec207e2c7978526853f3048e656355d7a51834abf47dde379c1
SSDEEP

384:52x26twOhpzR8c4SNrCh5yrAP02K8Cpm:52x262+zv4SVYBq5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38dc72c3eabf9cce0c73f2a7c4ab62f0754797001c91aa6b74d6810dbf1df1ab

Files

38dc72c3eabf9cce0c73f2a7c4ab62f0754797001c91aa6b74d6810dbf1df1ab
.dll windows:6 windows x64 arch:x64

1e79a9423813bd71c0b1b02f8e363144

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\TomoVision\Prog\MSC\obj_Release_x64\System_Undo\System_Undo.pdb

Imports

lib_util

?hwnd@@3PEAUHWND__@@EA
?Error_Fct@@YAHPEAUHWND__@@IPEB_WZZ

module_update

?Fct_Cuda_Dispatch@@YAHI@Z

module_structures

?Undo_Redo_Command@@YAHXZ
?Script_Arg_Check@@YAHPEADHH@Z
?Fct_Update@@YAX_KPEAX1PEAVRegion_2D@@@Z
?Undo_Undo_Command@@YAHXZ
?Script_Read_Line@@YAHQEB_WZZ

msvcp140

?_Xbad_alloc@std@@YAXXZ
_Mbrtowc
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ

vcruntime140

_CxxThrowException
__C_specific_handler
__std_exception_copy
memset
__std_type_info_destroy_list
__current_exception_context
__std_exception_destroy
__current_exception
memcpy

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-string-l1-1-0

_wcsnicmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initialize_onexit_table
terminate
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e

kernel32

GetCurrentProcessId
RtlLookupFunctionEntry
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind

Exports

Exports

Exit
Init
Register
Script_Parse
Script_Register
Sort
Variable_Get
Variable_Register
Version

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e79a9423813bd71c0b1b02f8e363144

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

lib_util

module_update

module_structures

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 888B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 92B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 888B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 92B