a9fc3d9bb033d33ecea7a30bdedcffcbf9aae2520098b813b0eeac8222ec6b8c

Sharing

Copy URL Twitter E-mail

General

Target

a9fc3d9bb033d33ecea7a30bdedcffcbf9aae2520098b813b0eeac8222ec6b8c
Size

6.5MB
MD5

41532f8b130d53cb63d2da679069b780
SHA1

27103521766bbc96673f7c48a13bf127763ed655
SHA256

a9fc3d9bb033d33ecea7a30bdedcffcbf9aae2520098b813b0eeac8222ec6b8c
SHA512

8bb634d3188d82409c5e4c4c2b4e20259a63756ff25e8f92bd783a0cd13220911e40264c17bfa17ce5ced80b5ef443ad76c39c2f018f300343c2bdf8eeaed343
SSDEEP

98304:d4tM9dBeOCY3mRVzn24FzrZN4f6m1ob2fZJKWVu:9eldLE1ob2fZgWV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9fc3d9bb033d33ecea7a30bdedcffcbf9aae2520098b813b0eeac8222ec6b8c

Files

a9fc3d9bb033d33ecea7a30bdedcffcbf9aae2520098b813b0eeac8222ec6b8c
.exe windows:6 windows x86 arch:x86

ce5b300fa0fb35e565cc392f76dc263d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Project\Tcb-Bank\EATM2013(1009)\TCBeATMHelper\Release\TCBeATMHelper.pdb

Imports

winscard

SCardBeginTransaction
SCardTransmit
SCardReconnect
SCardStatusW
SCardConnectW
SCardFreeMemory
SCardEstablishContext
SCardReleaseContext
SCardListReadersW
SCardDisconnect

kernel32

IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
WriteConsoleW
GetFileInformationByHandle
PeekNamedPipe
GetTimeZoneInformation
GetStringTypeW
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
SetEnvironmentVariableA
Sleep
SizeofResource
LockResource
LoadResource
FindResourceW
CreateToolhelp32Snapshot
Process32FirstW
CloseHandle
GetStartupInfoW
OpenProcess
Process32NextW
LocalFree
LocalAlloc
GetLocaleInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
CreateFileA
GetLastError
SetFilePointer
WideCharToMultiByte
WriteFile
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
LeaveCriticalSection
SetUnhandledExceptionFilter
RaiseException
HeapSize
EnterCriticalSection
DecodePointer
DeleteCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
MultiByteToWideChar
MulDiv
GetTickCount
UnhandledExceptionFilter
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
ExitThread
RtlUnwind
SetConsoleCtrlHandler
AreFileApisANSI
ExitProcess
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
GetConsoleCP
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
VirtualProtect
GetProfileIntW
GetTempPathW
GetTempFileNameW
SearchPathW
GetWindowsDirectoryW
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
GetCurrentDirectoryW
SetErrorMode
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetEndOfFile
ReadFile
FreeEnvironmentStringsW
InitializeCriticalSectionEx
GetEnvironmentStringsW
LockFile
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
GetFullPathNameW
GetFileSize
FlushFileBuffers
DeleteFileW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CompareStringW
GlobalGetAtomNameW
GlobalFlags
LocalReAlloc
GlobalHandle
GlobalReAlloc
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
lstrcmpA
GetCurrentThread
FileTimeToSystemTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
CreateFileW
ResumeThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
EncodePointer
GetModuleHandleA
GetModuleFileNameW
FreeResource
OutputDebugStringA
CopyFileW
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SystemTimeToFileTime
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
FindClose
FindFirstFileW
FindNextFileW
LoadLibraryA
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertThreadToFiber
ConvertFiberToThread
FormatMessageW
GetStdHandle
GetFileType
GetVersion
GetModuleHandleW
CreateFiber
SwitchToFiber
DeleteFiber
InterlockedExchangeAdd
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
SetLastError
TlsAlloc
InterlockedCompareExchange
GetModuleHandleExW
CreateThread
GetSystemTime
GetCurrentProcessId
TerminateProcess

user32

GetKeyNameTextW
InvertRect
HideCaret
EnableScrollBar
DrawIconEx
GetMenuDefaultItem
SetClassLongW
LockWindowUpdate
RegisterClipboardFormatW
EnumChildWindows
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
MapVirtualKeyW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
PostThreadMessageW
ModifyMenuW
IsMenu
NotifyWinEvent
SetWindowRgn
GetSystemMenu
TrackMouseEvent
IsRectEmpty
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
MonitorFromPoint
SetParent
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
CreatePopupMenu
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DeleteMenu
SetCapture
WaitMessage
CharUpperW
CopyImage
GetMenuItemInfoW
DestroyMenu
RealChildWindowFromPoint
GetSysColorBrush
IntersectRect
ShowOwnedPopups
SystemParametersInfoW
MessageBeep
IsZoomed
PostQuitMessage
TranslateMessage
GetMessageW
SendDlgItemMessageA
LoadMenuW
IsDialogMessageW
SetWindowTextW
CheckDlgButton
SetDlgItemTextW
MoveWindow
ShowWindow
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
UnionRect
SetScrollInfo
GetWindowRgn
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
GetForegroundWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
GetLastActivePopup
ScreenToClient
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
DrawFrameControl
PostMessageW
SetRect
DrawEdge
SetCursorPos
CharUpperBuffW
UpdateLayeredWindow
SetMenuDefaultItem
CopyIcon
FrameRect
IsClipboardFormatAvailable
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetUpdateRect
GetNextDlgGroupItem
GetParent
GetComboBoxInfo
GetDoubleClickTime
CreateMenu
DestroyCursor
GetScrollInfo
MapDialogRect
ReleaseCapture
GetCapture
WindowFromPoint
ClientToScreen
GetIconInfo
CallNextHookEx
OffsetRect
InflateRect
DrawFocusRect
GetFocus
GetWindowLongW
DestroyIcon
SetRectEmpty
IsWindowVisible
GetWindow
GetWindowThreadProcessId
EnumWindows
IsIconic
LoadIconW
UnregisterClassW
RedrawWindow
FillRect
DrawTextW
DrawIcon
SendMessageW
GetDesktopWindow
GetCursorPos
GetAsyncKeyState
GetSystemMetrics
GetWindowRect
SetForegroundWindow
SendInput
SetTimer
GetKeyState
KillTimer
ReleaseDC
GetDC
CopyRect
GetSysColor
LoadImageW
InvalidateRect
IsWindow
EnableWindow
LoadBitmapW
GetClientRect
LoadCursorW
SetCursor

gdi32

ExtSelectClipRgn
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateRectRgnIndirect
SetRectRgn
DPtoLP
GetTextExtentPoint32W
IntersectClipRect
EnumFontFamiliesW
GetTextCharsetInfo
GetDIBits
RealizePalette
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
GetRgnBox
OffsetRgn
GetTextColor
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
GetBkColor
CreateEllipticRgn
SelectClipRgn
CreatePolygonRgn
Polygon
Polyline
Rectangle
EnumFontFamiliesExW
RoundRect
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetTextFaceW
SetPixelV
SaveDC
RestoreDC
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
CopyMetaFileW
SetPixel
GetDeviceCaps
CreateDCW
DeleteDC
CreateFontW
CreateFontIndirectW
GetStockObject
CreateDIBitmap
CreateCompatibleBitmap
SelectObject
RectVisible
PtVisible
Ellipse
LineTo
PatBlt
DeleteObject
StretchBlt
BitBlt
GetTextMetricsW
CreateCompatibleDC
GetObjectW

msimg32

AlphaBlend
TransparentBlt

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

CryptCreateHash
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
CryptGenRandom
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptDecrypt
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegCloseKey

shell32

SHBrowseForFolderW
SHGetFolderPathA
SHGetFileInfoW
DragQueryFileW
ShellExecuteW
SHGetDesktopFolder
SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHAppBarMessage
DragFinish

comctl32

_TrackMouseEvent

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathFindExtensionW
PathRemoveFileSpecW

uxtheme

GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
GetThemeColor
IsAppThemed
GetThemePartSize
CloseThemeData
OpenThemeData
IsThemeBackgroundPartiallyTransparent
DrawThemeBackground
DrawThemeParentBackground
DrawThemeText

ole32

CoLockObjectExternal
DoDragDrop
CoTaskMemAlloc
CoTaskMemFree
OleDuplicateData
ReleaseStgMedium
CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize
CoDisconnectObject
RegisterDragDrop
CreateStreamOnHGlobal
OleGetClipboard
OleLockRunning
CoInitializeEx
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
RevokeDragDrop
IsAccelerator

oleaut32

SysAllocString
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString

gdiplus

GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

ws2_32

accept
listen
closesocket
send
WSASetLastError
recv
socket
WSACleanup
WSAIoctl
inet_ntoa
WSAStartup
inet_addr
WSAGetLastError
htons
ntohs
setsockopt
bind

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 740KB - Virtual size: 740KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce5b300fa0fb35e565cc392f76dc263d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winscard

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

rpcrt4

ws2_32

oleacc

imm32

winmm

crypt32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 740KB - Virtual size: 740KB

.data Size: 45KB - Virtual size: 122KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 176KB - Virtual size: 175KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 740KB - Virtual size: 740KB

.data
Size: 45KB - Virtual size: 122KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 176KB - Virtual size: 175KB