432525b82733c47aa3c3e1e53ef41ae7e2a404485702ecf547b3e7cbf44a9b35

Sharing

Copy URL Twitter E-mail

General

Target

432525b82733c47aa3c3e1e53ef41ae7e2a404485702ecf547b3e7cbf44a9b35
Size

92KB
MD5

881d141c30daca567fc9d576ee3c94c3
SHA1

3d1e1880010762e1e4ec914748bc346b3d123a57
SHA256

432525b82733c47aa3c3e1e53ef41ae7e2a404485702ecf547b3e7cbf44a9b35
SHA512

c51d85671a878188157e180926ebe521fc9ff94532dc12fcf8a774e49d05f6a29ce6c84f701058ecd26b0d8c4eab782840beafb15368470b7d0b3d7fd572d50a
SSDEEP

1536:/3GXPlX2SWAFJqJ6QGfBnPYFfiPRWu4T6/yPTbU+sCGBULHm3DOFA5eKEjwGCq2d:/3g2SW2UUQGfBnPKkd4T6/yPTbjMULH+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
432525b82733c47aa3c3e1e53ef41ae7e2a404485702ecf547b3e7cbf44a9b35

Files

432525b82733c47aa3c3e1e53ef41ae7e2a404485702ecf547b3e7cbf44a9b35
.exe windows:5 windows x86 arch:x86

1cc5d5ea835bc1567ff598b0a42be18f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Source\openoffice\main\cpputools\wntmsci12.pro\bin\regcomp.pdb

Imports

sal3

sal_detail_initialize
sal_detail_deinitialize
osl_getThreadTextEncoding
osl_setEnvironment
rtl_allocateMemory
rtl_freeMemory
rtl_str_getLength
osl_getProcessWorkingDir
osl_getFileURLFromSystemPath
osl_getAbsoluteFileURL
osl_getGlobalMutex
osl_releaseMutex
osl_acquireMutex
rtl_uString_newFromAscii
rtl_uString_getToken
rtl_uString_newConcat
rtl_uString_newFromStr_WithLength
rtl_ustr_indexOfStr_WithLength
rtl_ustr_lastIndexOfChar_WithLength
rtl_ustr_indexOfChar_WithLength
rtl_ustr_ascii_shortenedCompare_WithLength
rtl_ustr_ascii_compare_WithLength
rtl_ustr_reverseCompare_WithLength
rtl_uString_assign
rtl_uString_release
rtl_string2UString
rtl_uString_acquire
rtl_uString_new
rtl_str_valueOfInt32
rtl_stringbuffer_insert
rtl_string_new
rtl_string_new_WithLength
rtl_string_newConcat
rtl_string_release
rtl_uString2String
rtl_string_newFromStr
rtl_string_acquire

cppu3

typelib_typedescription_new
typelib_static_type_getByTypeClass
typelib_typedescriptionreference_new
typelib_typedescription_newStruct
typelib_typedescription_newMIInterface
typelib_typedescription_newExtendedInterfaceAttribute
typelib_typedescription_newInterfaceMethod
typelib_typedescription_newEnum
typelib_typedescriptionreference_release
typelib_typedescription_register
typelib_typedescription_release
typelib_static_sequence_type_init
uno_any_destruct
uno_type_any_construct

cppuhelper3msc

?loadSharedLibComponentFactory@cppu@@YA?AV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@ABVOUString@rtl@@00ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@3456@ABV?$Reference@VXRegistryKey@registry@star@sun@com@@@3456@@Z
?createRegistryServiceFactory@cppu@@YA?AV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABVOUString@rtl@@0E0@Z

msvcr90

_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__argv
__argc
exit
strncmp
fopen
fseek
ftell
fscanf
fclose
printf
??2@YAPAXI@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
__CxxFrameHandler3
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
fprintf
__iob_func
_invalid_parameter_noinfo

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

v��K�u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1cc5d5ea835bc1567ff598b0a42be18f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sal3

cppu3

cppuhelper3msc

msvcr90

msvcp90

kernel32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 4KB - Virtual size: 3KB

v��K�u� Size: 16KB - Virtual size: 20KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 4KB - Virtual size: 3KB

v��K�u�
Size: 16KB - Virtual size: 20KB