75f20157e34d7eedbb41e1cf849fbe50N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

75f20157e34d7eedbb41e1cf849fbe50N.exe
Size

356KB
MD5

75f20157e34d7eedbb41e1cf849fbe50
SHA1

4df0b7f7b35e9cfa4a247482febec643b57f382b
SHA256

b7fb1d5ada5b2ca91588241ca331d1ded98b757d0f495a7a12375a353c21005c
SHA512

ad083fb164b7ec12796bcd2c561f1e153312a60f643832b4b44ec63e751e7063d2decd7b66377f01c44dab3253504ac00fea61cdc382e287741f76964a10d8fb
SSDEEP

6144:O57TDHi6k+l/TQppxwB2GhitiakKnc+xAvqZ+T3:OJPHi6k+FQpk2vi26t3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75f20157e34d7eedbb41e1cf849fbe50N.exe

Files

75f20157e34d7eedbb41e1cf849fbe50N.exe
.dll windows:4 windows x86 arch:x86

4eda78bf8f43ec8b20f802911345e02c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
FreeLibrary
GetProcAddress

clc_base

??0CalculationLifeBase@@QAE@AAVLifeCoverageBase@@@Z
?CalcMecPremium@CalculationLifeBase@@MAENXZ
?MecTest@CalculationLifeBase@@MAEXXZ
?CalcValues@CalculationLifeBase@@UAEXXZ
?PolicyValue@CalculationBase@@UAENW4ResultEnum@@H@Z
??1CalculationBase@@QAE@XZ

cov_base

??1LifeCoverageBase@@UAE@XZ
??1AnnuityCoverageBase@@UAE@XZ
??1CoverageBase@@UAE@XZ
??0TraditionalLifeCoverage@@QAE@AAV0@@Z

rpt

?LineCount@RPT_STRING@@UAEFF@Z
?PrintLineCount@RPT_BLANK_LINE@@UAEFF@Z
?LineCount@RPT_BLANK_LINE@@UAEFF@Z
??0RPT_REPORT_END@@QAE@XZ
?SetDisplayOffset@RPT_COLUMN@@QAEXF@Z
?SetBreak@RPT_COLUMN@@QAEXXZ
?SetColsPerLine@RPT_REPORT@@QAEXF@Z
?SetColsPerLine@RPT_TABLE@@QAEXF@Z
?SetPrintFont@RPT_ELEMENT@@QAEXG@Z
?Add@RPT_TABLE@@QAEXPAVRPT_COLUMN@@@Z
?SetData@RPT_COLUMN@@QAEXFPBD@Z
??0RPT_COLUMN@@QAE@HHHW4RPT_JUSTIFY@@J@Z
?SetFont@RPT_TABLE@@QAEXF@Z
??0RPT_TABLE@@QAE@HHH@Z
?RptScenarioExplanation@@YAXPAVRPT_REPORT@@H@Z
??0RPT_PAGE_BREAK@@QAE@XZ
??0RPT_BLOCK_END@@QAE@XZ
??0RPT_BLOCK_BEGIN@@QAE@XZ
??0RPT_DEFINITION@@QAE@PBD0F@Z
?PrintLineCount@RPT_STRING@@UAEFF@Z
??0RPT_BLANK_LINE@@QAE@F@Z
??0RPT_STRING@@QAE@PBDFJW4RPT_JUSTIFY@@F@Z
?SetLine2@RPT_HEADER@@QAEXPBD@Z
?PrintLineCount@RPT_BLOCK_BEGIN@@UAEFF@Z
?RptCoverPage@@YAXPAVRPT_REPORT@@W4STATES@@W4RECORD_TYPE@@PBD3UportableDate@@_N3@Z
?AddRptFooter@@YAXAAVRPT_REPORT@@PAUHINSTANCE__@@W4STATES@@J@Z
?Add@RPT_REPORT@@QAEXPAVRPT_ELEMENT@@G@Z
??0RPT_HEADER@@QAE@F@Z
??1RPT_HEADER@@UAE@XZ
??1RPT_STRING@@UAE@XZ
??1RPT_BLANK_LINE@@UAE@XZ
??1RPT_PARAGRAPH@@UAE@XZ
??1RPT_DEFINITION@@UAE@XZ
??1RPT_BLOCK_BEGIN@@UAE@XZ
??1RPT_BLOCK_END@@UAE@XZ
??1RPT_PAGE_BREAK@@UAE@XZ
??1RPT_TABLE@@UAE@XZ
??1RPT_COLUMN@@UAE@XZ
??1RPT_REPORT_END@@UAE@XZ
?LineCount@RPT_REPORT_END@@UAEFF@Z
?PrintLineCount@RPT_REPORT_END@@UAEFF@Z
?LineCount@RPT_PAGE_BREAK@@UAEFF@Z
?PrintLineCount@RPT_PAGE_BREAK@@UAEFF@Z
?LineCount@RPT_DEFINITION@@UAEFF@Z
?PrintLineCount@RPT_DEFINITION@@UAEFF@Z
?LineCount@RPT_PARAGRAPH@@UAEFF@Z
?PrintLineCount@RPT_PARAGRAPH@@UAEFF@Z
?LineCount@RPT_TABLE@@UAEFF@Z
?PrintLineCount@RPT_TABLE@@UAEFF@Z
??0RPT_PARAGRAPH@@QAE@PBDFF@Z
?LineCount@RPT_BLOCK_BEGIN@@UAEFF@Z
?PrintLineCount@RPT_COLUMN@@UAEFF@Z
?LineCount@RPT_COLUMN@@UAEFF@Z
?PrintLineCount@RPT_BLOCK_END@@UAEFF@Z
?LineCount@RPT_BLOCK_END@@UAEFF@Z
?PrintLineCount@RPT_ELEMENT@@UAEFF@Z
?LineCount@RPT_ELEMENT@@UAEFF@Z
?SetLine1@RPT_HEADER@@QAEXPBD@Z

rpt_util

?CalculateAge@@YAHABUportableDate@@0W4AGE_BASIS@@@Z
?Rnd@@YANNFF@Z
?RatedUpAge@@YAHABUTLI_COVERAGE_BASE@@@Z
?CalculateJointAge@@YAHAAH0ABUTLI_COVERAGE_BASE@@ABULIFE_COVERAGE_BASE@@@Z
?FormatNumber@@YAXPADNJFF@Z
?IsFullyCompliant@@YAHW4STATES@@@Z
?IsWesternState@@YAHW4STATES@@@Z
?TableRatingText@@YAXPADW4EXTRA_RATING@@@Z
?SexToString@@YAXW4SEX@@PAD@Z
?UwClassToString@@YAXW4UNDERWRITING_CLASS@@PADW4RECORD_TYPE@@@Z
?ModeToString@@YAXW4PREMIUM_MODE@@PAD@Z
?FormatNumber@@YAXPADJJFF@Z

trm_calc

?DeathBenefit@TermBase@@UAEJH@Z
?SumOfPremium@TermBase@@UAENH@Z
?MidpointPremium@TermBase@@UAENH@Z
?GuaranteedPremium@TermBase@@UAENH@Z
?CurrentPremium@TermBase@@UAENH@Z
??1ChoiceTermCalculations@@UAE@XZ
??0ChoiceTermCalculations@@QAE@ABULIFE_COVERAGE_BASE@@@Z
?Durations@TermBase@@QAEHXZ

msvcrt

_adjust_fdiv
malloc
_initterm
free
?terminate@@YAXXZ
_except_handler3
strcpy
strcat
sprintf
memcpy
pow
__CxxFrameHandler
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
_itoa

Exports

Exports

??0AnnuityCoverageBase@@QAE@ABV0@@Z
??0CalculationBase@@QAE@ABV0@@Z
??0CalculationLifeBase@@QAE@ABV0@@Z
??0CoverageBase@@QAE@ABV0@@Z
??0LifeCoverageBase@@QAE@ABV0@@Z
??1CalculationLifeBase@@UAE@XZ
??4AnnuityCoverageBase@@QAEAAV0@ABV0@@Z
??4CalculationBase@@QAEAAV0@ABV0@@Z
??4CalculationLifeBase@@QAEAAV0@ABV0@@Z
??4CoverageBase@@QAEAAV0@ABV0@@Z
??4LifeCoverageBase@@QAEAAV0@ABV0@@Z
??4TraditionalLifeCoverage@@QAEAAV0@ABV0@@Z
??_7AnnuityCoverageBase@@6B@
??_7CalculationBase@@6B@
??_7CalculationLifeBase@@6B@
??_7CoverageBase@@6B@
??_7LifeCoverageBase@@6B@
?Agent@CoverageBase@@QAEJXZ
?AuxiliaryRpts@CoverageBase@@QAE?AUSUPP_REPORT_STRUCTURE@@XZ
?BirthDate@CoverageBase@@QAE?AUportableDate@@XZ
?BtrAmount@TraditionalLifeCoverage@@QAEJXZ
?CalcControl@AnnuityCoverageBase@@QAE?AW4UL_CALC_CONTROL@@XZ
?CalcDurations@CoverageBase@@QBEHXZ
?CalcResult@CalculationBase@@QAEJXZ
?ChildrensTerm@TraditionalLifeCoverage@@QAEJXZ
?ChoiceCoverageTerm@TraditionalLifeCoverage@@QAE?AW4ChoiceCoverageEnum@@XZ
?CompanyCode@TraditionalLifeCoverage@@QAEPADXZ
?CovPtr@CalculationLifeBase@@QAEPAVLifeCoverageBase@@XZ
?Coverage@CalculationLifeBase@@QAE?AVLifeCoverageBase@@XZ
?CoverageType@CoverageBase@@QBE?AW4RECORD_TYPE@@XZ
?Dividend@TraditionalLifeCoverage@@QBE?AW4DIVIDEND_USES@@XZ
?DlbrAmount@TraditionalLifeCoverage@@QAEJXZ
?Dumpin@AnnuityCoverageBase@@QAENXZ
?Durations@CoverageBase@@QBEHXZ
?FaceAmount@LifeCoverageBase@@QBENXZ
?FirstName@CoverageBase@@QAEPADXZ
?GpoAmount@TraditionalLifeCoverage@@QAEJXZ
?InitialAccumBalance@TraditionalLifeCoverage@@QBENXZ
?InitialInterest@AnnuityCoverageBase@@QAENXZ
?InitialLoanBalance@TraditionalLifeCoverage@@QBENXZ
?InitialLoanRate@TraditionalLifeCoverage@@QBENXZ
?InitialPeriod@AnnuityCoverageBase@@QAEHXZ
?InitialPuaBalance@TraditionalLifeCoverage@@QBENXZ
?Interest@AnnuityCoverageBase@@QAENXZ
?IsInforce@CoverageBase@@QBEHXZ
?IsMec@CalculationLifeBase@@QAEHXZ
?IssueAge@CoverageBase@@QBEHXZ
?IssueDate@TraditionalLifeCoverage@@QAE?AUportableDate@@XZ
?IssueTreasuryRate@AnnuityCoverageBase@@QAENXZ
?LastName@CoverageBase@@QAEPADXZ
?ModalPremium@AnnuityCoverageBase@@QAENXZ
?Next@CalculationLifeBase@@QAEPAV1@XZ
?NextCoverage@TraditionalLifeCoverage@@QAEPAV1@XZ
?PayorBirthDate@TraditionalLifeCoverage@@QAE?AUportableDate@@XZ
?PermFlatRating@TraditionalLifeCoverage@@QAENXZ
?PermTableRating@TraditionalLifeCoverage@@QBE?AW4EXTRA_RATING@@XZ
?PolicyNumber@TraditionalLifeCoverage@@QAEPADXZ
?Premium1035@TraditionalLifeCoverage@@QAENXZ
?PremiumMode@AnnuityCoverageBase@@QAE?AW4PREMIUM_MODE@@XZ
?PremiumMode@LifeCoverageBase@@QBE?AW4PREMIUM_MODE@@XZ
?ProjectionDate@CoverageBase@@QBE?AUportableDate@@XZ
?PuarLimitYears@TraditionalLifeCoverage@@QBEJXZ
?PuarLumpPremiumAmount@TraditionalLifeCoverage@@QAENXZ
?PuarMode@TraditionalLifeCoverage@@QAE?AW4PREMIUM_MODE@@XZ
?PuarPayYears@TraditionalLifeCoverage@@QBEJXZ
?PuarPremiumAmount@TraditionalLifeCoverage@@QBENXZ
?PuarPremiumType@TraditionalLifeCoverage@@QBE?AW4PuarPremiumEnum@@XZ
?PuarUsage@TraditionalLifeCoverage@@QAE?AW4PuarUsageEnum@@XZ
?Reports@TraditionalLifeCoverage@@QAEJXZ
?ResetPeriod@AnnuityCoverageBase@@QAEHXZ
?RetirementAge@AnnuityCoverageBase@@QAEFXZ
?Riders@AnnuityCoverageBase@@QAEJXZ
?Riders@LifeCoverageBase@@QBEJXZ
?SetDividend@TraditionalLifeCoverage@@QAEXW4DIVIDEND_USES@@@Z
?SetDumpinPremium@AnnuityCoverageBase@@QAEXN@Z
?SetDurations@CoverageBase@@QAEXH@Z
?SetFaceAmount@LifeCoverageBase@@QAEXN@Z
?SetInterest@AnnuityCoverageBase@@QAEXN@Z
?SetModalPremium@AnnuityCoverageBase@@QAEXN@Z
?SetNext@CalculationLifeBase@@QAEXPAV1@@Z
?SetPremiumMode@LifeCoverageBase@@QAEXW4PREMIUM_MODE@@@Z
?SetPuarLimitYears@TraditionalLifeCoverage@@QAEXJ@Z
?SetPuarLumpPremiumAmount@TraditionalLifeCoverage@@QAEXN@Z
?SetPuarPayYears@TraditionalLifeCoverage@@QAEXJ@Z
?SetPuarPremiumAmount@TraditionalLifeCoverage@@QAEXN@Z
?SetPuarPremiumType@TraditionalLifeCoverage@@QAEXW4PuarPremiumEnum@@@Z
?SetRiders@LifeCoverageBase@@QAEXJ@Z
?Sex@CoverageBase@@QBE?AW4SEX@@XZ
?SolveCoverage@TraditionalLifeCoverage@@QAEJXZ
?SolveForMix@TraditionalLifeCoverage@@QAEJXZ
?SolvePremium@TraditionalLifeCoverage@@QAENXZ
?SolvePremiumYears@AnnuityCoverageBase@@QAEFXZ
?SolveTarget@AnnuityCoverageBase@@QAEJXZ
?SolveTermType@TraditionalLifeCoverage@@QAE?AW4RECORD_TYPE@@XZ
?StartMonth@TraditionalLifeCoverage@@QBEHXZ
?State@CoverageBase@@QAE?AW4STATES@@XZ
?SurrenderTreasuryRate@AnnuityCoverageBase@@QAENXZ
?TaxQualified@AnnuityCoverageBase@@QAE?AW4TAX_QUALIFICATION@@XZ
?TempFlatRating@TraditionalLifeCoverage@@QAENXZ
?TempFlatYears@TraditionalLifeCoverage@@QAEJXZ
?TempTableRating@TraditionalLifeCoverage@@QBE?AW4EXTRA_RATING@@XZ
?TempTableYears@TraditionalLifeCoverage@@QAEJXZ
?TimeStamp@CoverageBase@@QAEJXZ
?UwClass@LifeCoverageBase@@QBE?AW4UNDERWRITING_CLASS@@XZ
?VanishYear@TraditionalLifeCoverage@@QAEJXZ
?Version@CoverageBase@@QAEJXZ
?WaiverRating@TraditionalLifeCoverage@@QAE?AW4EXTRA_RATING@@XZ
BuildPreview
BuildReport
_BuildPreview@12
_BuildReport@12

Sections

.text
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4eda78bf8f43ec8b20f802911345e02c

Headers

File Characteristics

Imports

kernel32

clc_base

cov_base

rpt

rpt_util

trm_calc

msvcrt

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 177KB

.rdata Size: 140KB - Virtual size: 137KB

.data Size: 16KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 180KB - Virtual size: 177KB

.rdata
Size: 140KB - Virtual size: 137KB

.data
Size: 16KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 10KB