6d1c871084654ad74bb96a4c6035bb6e98e393659c67265b7859620a2df71014

Sharing

Copy URL Twitter E-mail

General

Target

6d1c871084654ad74bb96a4c6035bb6e98e393659c67265b7859620a2df71014
Size

1.5MB
MD5

b66a38989a8daa7aedad3ed99858a37c
SHA1

9cf609ba3f560fd4d9ccd5fd4cb23a5aac60ed15
SHA256

6d1c871084654ad74bb96a4c6035bb6e98e393659c67265b7859620a2df71014
SHA512

bdaf5b511a44424994468aad25a4b8aa1212d96c3d364aa3b22dc8ab1b0b77ee64b81ac239a3f23c811f02d19da712aaf11d0fcfd01fc6970c83c08d16204dfa
SSDEEP

12288:jhE6ROOvvWHrcD4g4kC5m6IX96NPZO6n43VZrcXDleKZB2NcdITGoMW9llX3AccU:jc0vycD4g4kCo6NPZQVlPdLFJgeiyZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d1c871084654ad74bb96a4c6035bb6e98e393659c67265b7859620a2df71014

Files

6d1c871084654ad74bb96a4c6035bb6e98e393659c67265b7859620a2df71014
.exe windows:4 windows x86 arch:x86

9a0376d3d00afd7e2b1b1bbb2336c273

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

adsapi32

DRV_GetErrorMessage
DRV_DioReadPortByte
DRV_AIVoltageIn
DRV_AIConfig
DRV_DioWriteBit
DRV_AOVoltageOut
DRV_DeviceGetFeatures
DRV_DeviceOpen
DRV_DeviceGetList
DRV_DeviceGetNumOfList

mfc42d

ord2863
ord556
ord573
ord699
ord559
ord293
ord316
ord519
ord299
ord728
ord4457
ord3553
ord4205
ord3563
ord1041
ord2301
ord3793
ord4216
ord4297
ord1781
ord1809
ord1799
ord4048
ord4653
ord2742
ord2790
ord3755
ord3848
ord3608
ord3632
ord4011
ord3309
ord2230
ord5073
ord1504
ord3889
ord3170
ord877
ord454
ord1902
ord5072
ord3201
ord880
ord3598
ord3355
ord3174
ord648
ord4461
ord868
ord3415
ord3570
ord4460
ord415
ord558
ord1775
ord2179
ord296
ord4566
ord449
ord2208
ord562
ord1316
ord1638
ord1639
ord4433
ord2324
ord302
ord1582
ord1930
ord5005
ord4952
ord1928
ord418
ord470
ord1078
ord4475
ord972
ord1629
ord3447
ord5064
ord1032
ord3119
ord2120
ord1896
ord4195
ord3629
ord3948
ord4017
ord1862
ord4753
ord1364
ord3651
ord3658
ord1952
ord1228
ord2875
ord574
ord478
ord298
ord317
ord680
ord3524
ord4951
ord4551
ord1623
ord450
ord2435
ord1096
ord1729
ord3831
ord863
ord3697
ord2168
ord1136
ord4634
ord4208
ord2965
ord4291
ord2438
ord734
ord2409
ord596
ord4997
ord1660
ord349
ord4926
ord1714
ord4458
ord417
ord2123
ord3162
ord2800
ord646
ord413
ord813
ord485
ord2255
ord2640
ord4589
ord4615
ord2383
ord2068
ord2995
ord2316
ord3862
ord422
ord3989
ord565
ord306
ord1757
ord2351
ord899
ord901
ord487
ord3287
ord4558
ord4645
ord2476
ord4720
ord2619
ord4726
ord4794
ord4802
ord4061
ord2807
ord1087
ord2751
ord2508
ord2991
ord812
ord1788
ord944
ord3403
ord945
ord4028
ord3517
ord943
ord823
ord2434
ord2058
ord3070
ord3413
ord2649
ord4469
ord824
ord590
ord1019
ord5016
ord3483
ord737
ord714
ord554
ord1510
ord1509
ord768
ord758
ord290
ord2636
ord4123
ord342
ord791
ord772
ord1770
ord1772
ord5056
ord619
ord382
ord4896
ord3281
ord3286
ord1790
ord3400
ord4934
ord586
ord335
ord2474
ord2513
ord3573
ord1595
ord3067
ord903
ord1419
ord1915
ord3644
ord685
ord608
ord493
ord367
ord1934
ord851
ord3104
ord850
ord4462
ord4887
ord2608
ord4492
ord1425
ord3646
ord660
ord443
ord3531
ord4984
ord2548
ord2279
ord2333
ord2589
ord3877
ord986
ord2730
ord2550
ord1026
ord2915
ord5065
ord4837
ord4985
ord3867
ord3990
ord730
ord719
ord1417
ord3530
ord2103
ord1784
ord2412
ord4078
ord4081
ord3692
ord3575
ord2679
ord4021
ord973
ord4279
ord2717
ord2223
ord2222
ord3429
ord3361
ord4174
ord4210
ord2077
ord1309
ord3666
ord3661
ord612
ord599
ord516
ord374
ord354
ord697
ord4368
ord4739
ord1855
ord2055
ord2054
ord4685
ord3118
ord979
ord1602
ord1179
ord3450
ord1656
ord3685
ord4902
ord4183
ord1239
ord1969
ord4632
ord4505
ord4284
ord2448
ord312
ord2229
ord4170
ord4945
ord4856
ord4583
ord2352
ord3652
ord3710
ord2885
ord1416
ord3758
ord3757
ord3978
ord3627
ord3972
ord3731
ord4068
ord3610
ord3614
ord3969
ord3729
ord3739
ord3738
ord3726
ord3728
ord3725
ord4003
ord4001
ord3379
ord4755
ord4175
ord3001
ord1342
ord4190
ord1597
ord3664
ord352
ord671
ord3529
ord1238
ord1968
ord3572
ord1590
ord3835
ord4390
ord4209
ord2170
ord507
ord3110
ord3700
ord490
ord3056
ord3254
ord2593
ord3717
ord3024
ord1996
ord1264
ord2936
ord410
ord643
ord723
ord2687
ord319
ord4787
ord2042
ord1493
ord1789
ord2661
ord4227
ord4230
ord3366
ord3827
ord4239
ord4215
ord4409
ord3784
ord2023
ord1287
ord531
ord708
ord2105
ord3519
ord738
ord3776
ord3774
ord3552
ord5077
ord3702
ord1880
ord1860
ord4415
ord3231
ord1033
ord4130
ord4229
ord2104
ord3826
ord4408
ord2021
ord1285
ord2986
ord706
ord528
ord593
ord567
ord4228
ord4143
ord308
ord996
ord468
ord2133
ord345
ord3446
ord4820
ord2052
ord1401
ord3527
ord3825
ord2411
ord2415
ord5058
ord1858
ord1876
ord4178
ord4420
ord1350
ord4304
ord2484
ord4387
ord3656
ord4000
ord3950
ord1797
ord3636
ord2753
ord2509
ord4749
ord3373
ord4785
ord3785
ord3660
ord328
ord582
ord3938
ord3382
ord1232
ord1956
ord4901
ord1490
ord3551
ord3611
ord3616
ord3836
ord3970
ord4004
ord4002
ord1343
ord526
ord704
ord1042
ord1284
ord2020
ord3369
ord3592
ord3097
ord1661
ord2760
ord3421
ord1190
ord1288
ord2024
ord3657
ord3786
ord3367
ord2431
ord3142
ord3144
ord3143
ord2339
ord2432
ord2341
ord2585
ord2473
ord3691
ord2584
ord2481
ord2340
ord1631

msvcrtd

_CxxThrowException
_setmbcp
memset
__CxxFrameHandler
_chkesp
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
wcslen
strlen
_ftol
_mbsnbcpy
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
strcat
_itoa
_purecall
memcpy
_mbsrchr
atoi
fabs
atof
_controlfp

kernel32

CreateDirectoryA
GetModuleHandleA
GetPrivateProfileIntA
ReadFile
MultiByteToWideChar
WriteFile
lstrlenA
CreateFileA
Sleep
CreateThread
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
TerminateThread
InterlockedDecrement
GetLastError
GetStartupInfoA
LocalFree
LocalAlloc
FormatMessageA
SetCommTimeouts
SetCommState
CloseHandle
WideCharToMultiByte
lstrlenW
GetCommState

user32

GetIconInfo
GetDC
CreateIconIndirect
ReleaseDC
SendMessageA
GetSysColor
GetSubMenu
DestroyMenu
LoadImageA
SetWindowLongA
GetWindowLongA
DestroyCursor
DestroyIcon
SetFocus
wsprintfA
DrawTextA
ChangeDisplaySettingsA
GetCursorPos
LoadMenuA
FillRect
TrackPopupMenuEx
PostMessageA
SetCursor

gdi32

GetStockObject
GetObjectA
GetPixel
SetPixel
CreateCompatibleBitmap
CreateBitmap
CreateCompatibleDC
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteDC
DeleteObject

advapi32

RegOpenKeyExA
RegEnumValueA
RegQueryValueExA

shell32

ShellExecuteExA

comctl32

_TrackMouseEvent

mfco42d

ord552
ord283
ord2784
ord380
ord373
ord614
ord381
ord907
ord1059
ord340
ord589
ord809
ord798
ord2061

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleRun

oleaut32

SysAllocString
VariantChangeType
VariantCopy
VariantInit
VariantClear
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.adate
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9a0376d3d00afd7e2b1b1bbb2336c273

Headers

File Characteristics

Imports

adsapi32

mfc42d

msvcrtd

kernel32

user32

gdi32

advapi32

shell32

comctl32

mfco42d

ole32

oleaut32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 80KB - Virtual size: 78KB

.data Size: 12KB - Virtual size: 10KB

.idata Size: 12KB - Virtual size: 9KB

.rsrc Size: 272KB - Virtual size: 268KB

.reloc Size: 40KB - Virtual size: 36KB

.adate Size: 16KB - Virtual size: 12KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 80KB - Virtual size: 78KB

.data
Size: 12KB - Virtual size: 10KB

.idata
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 272KB - Virtual size: 268KB

.reloc
Size: 40KB - Virtual size: 36KB

.adate
Size: 16KB - Virtual size: 12KB