68163e8b925303c1c0f1599c3fd1f058c7ecf82d7274cc0335653254a07b01c4

Sharing

Copy URL Twitter E-mail

General

Target

68163e8b925303c1c0f1599c3fd1f058c7ecf82d7274cc0335653254a07b01c4
Size

3.1MB
MD5

4bc9f2f8a73231a70278d437cecdaee9
SHA1

422a688b336145b2a2154ea761c7df01543fca87
SHA256

68163e8b925303c1c0f1599c3fd1f058c7ecf82d7274cc0335653254a07b01c4
SHA512

01dd06f2c4fcdc747a9369a046471b23025bf9bb5ce75154cfbc66e097302cb9b75f076ec5a0782eaca44448ac1930ed421de76b885578deb6135eef01d133dd
SSDEEP

98304:urMLBT6gVzUCq52RE7wK8iHszmWFLOAkGkzdnEVEFoKGkh/:uQrLa/WFLOyEFoKGkh/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68163e8b925303c1c0f1599c3fd1f058c7ecf82d7274cc0335653254a07b01c4

Files

68163e8b925303c1c0f1599c3fd1f058c7ecf82d7274cc0335653254a07b01c4
.exe windows:5 windows x86 arch:x86

ef1fa30c9c1e3ebf591530c29d518d5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Code\EditCode\Printer\Release\PCLink.pdb

Imports

ws2_32

WSASocketW
WSAGetLastError
htons
bind
closesocket
getsockname
inet_addr
inet_ntoa
recvfrom
socket
sendto
listen
accept
recv
gethostbyname
gethostname
ntohs
WSACleanup
WSAJoinLeaf
WSAStartup

iphlpapi

GetTcpTable

kernel32

SetErrorMode
GetProfileIntW
SearchPathW
VirtualProtect
FindResourceExW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
WriteConsoleW
GetFileType
GetStdHandle
ExitThread
TlsFree
RtlUnwind
RaiseException
HeapReAlloc
GetSystemInfo
VirtualQuery
SetStdHandle
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LocalReAlloc
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
WriteConsoleA
GetConsoleOutputCP
GetProcessHeap
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
GlobalHandle
TlsGetValue
LocalAlloc
GetShortPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiW
GetStringTypeExW
MoveFileW
GetModuleHandleA
FileTimeToLocalFileTime
GetThreadLocale
InterlockedIncrement
GetDiskFreeSpaceW
GetFullPathNameW
GetTempFileNameW
GetFileTime
GetPrivateProfileIntW
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
SetThreadPriority
GlobalGetAtomNameW
GetCurrentProcessId
lstrcpyW
GlobalReAlloc
InterlockedExchange
InterlockedDecrement
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
LoadLibraryA
FreeLibrary
GetVersionExA
GetProcAddress
GetModuleHandleW
LoadLibraryW
FreeResource
SetLastError
CopyFileW
GlobalSize
MulDiv
CreateThread
GlobalFree
GlobalAlloc
lstrcpynW
GetTickCount
GetFileSize
FileTimeToSystemTime
SetFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
SetFilePointer
FindClose
FindFirstFileW
GetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileStringW
VirtualAlloc
VirtualFree
CreateDirectoryA
GlobalUnlock
GlobalLock
WaitForSingleObject
Sleep
lstrcmpW
DeleteFileW
GetModuleFileNameA
ReadFile
GetOverlappedResult
WriteFile
LocalFree
FormatMessageW
SuspendThread
ResumeThread
GetCommMask
WaitForMultipleObjects
ClearCommError
WaitCommEvent
PurgeComm
SetCommState
BuildCommDCBW
GetCommState
SetCommMask
SetCommTimeouts
CreateFileW
CreateEventW
ResetEvent
SetEvent
CreateDirectoryW
ExitProcess
CreateMutexW
GetLastError
CloseHandle
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetDriveTypeW
GetLogicalDriveStringsW
GetVersionExW
GetModuleFileNameW
GetSystemDefaultLangID
WideCharToMultiByte
LockResource
lstrlenA
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetFileAttributesExW
GetFileSizeEx
GetTempPathW
GlobalFlags
GlobalDeleteAtom
GetSystemTimeAsFileTime
LCMapStringA

user32

GetTabbedTextExtentA
IsCharLowerW
MapVirtualKeyExW
GetWindowRgn
UpdateLayeredWindow
EnableScrollBar
UnionRect
CharUpperW
DestroyCursor
EndPaint
BeginPaint
GetWindowDC
CharNextW
ShowOwnedPopups
PostThreadMessageW
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
WaitMessage
PostQuitMessage
SetClassLongW
GetMessageW
TranslateMessage
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
SetRect
DrawFocusRect
DrawEdge
GetWindowThreadProcessId
GetDoubleClickTime
SetParent
LockWindowUpdate
ValidateRect
BringWindowToTop
MessageBeep
IsClipboardFormatAvailable
SetMenuDefaultItem
DestroyAcceleratorTable
NotifyWinEvent
IsMenu
GetAsyncKeyState
WindowFromPoint
GetSystemMenu
DeleteMenu
DrawIconEx
IsZoomed
GetSysColorBrush
EmptyClipboard
CloseClipboard
SetClipboardData
DestroyIcon
CopyImage
OpenClipboard
SetRectEmpty
DrawStateW
ReleaseCapture
SetCursor
LoadCursorW
SetCapture
SetWindowRgn
DrawIcon
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
CreateMenu
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetForegroundWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
GetWindow
MapVirtualKeyW
GetKeyNameTextW
ReleaseDC
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
GetMenuItemCount
RemoveMenu
LoadBitmapW
LoadImageW
IsRectEmpty
DrawFrameControl
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
CopyRect
GetDesktopWindow
PostMessageW
IsWindow
FillRect
GetDC
SetTimer
KillTimer
GetWindowTextW
GetClassNameW
FindWindowExW
InflateRect
GetNextDlgGroupItem
InvalidateRgn
FrameRect
CopyIcon
GetIconInfo
SubtractRect
GetUpdateRect
EnumChildWindows
CharUpperBuffW
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
OffsetRect
GetClientRect
GetParent
GetWindowRect
wsprintfW
ClientToScreen
MessageBoxW
IsIconic
GetLastActivePopup
FindWindowW
TrackPopupMenu
DefFrameProcW
GetMenuDefaultItem
SetCursorPos
CreateAcceleratorTableW
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
GetClassLongW
UnregisterClassW
GetSubMenu
IsWindowVisible
InvalidateRect
UpdateWindow
RedrawWindow
ModifyMenuW
LoadMenuW
LoadIconW
TrackPopupMenuEx
SetForegroundWindow
GetCursorPos
InsertMenuW
CreatePopupMenu
SetWindowLongW
SendMessageW
EnableWindow
GetFocus
GetKeyboardState

gdi32

RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
CreateFontW
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
SaveDC
GetObjectType
CreateRoundRectRgn
SetRectRgn
GetMapMode
GetViewportOrgEx
GetCharWidthW
OffsetRgn
GetRgnBox
EnumFontFamiliesExW
CreatePalette
GetPaletteEntries
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetTextExtentPoint32A
GetWindowOrgEx
ExtFloodFill
SetPaletteEntries
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetNearestPaletteIndex
GetSystemPaletteEntries
SetPixelV
GetTextCharsetInfo
EnumFontFamiliesW
CreatePatternBrush
AbortDoc
SetAbortProc
CreateDIBitmap
CreateDIBSection
SetPixel
GetPixel
CombineRgn
SelectPalette
CreateRectRgnIndirect
CreateDCW
CopyMetaFileW
GetTextExtentPoint32W
StretchBlt
DeleteObject
RoundRect
Rectangle
Polygon
GetObjectW
CreateRectRgn
GetStockObject
CreatePen
CreateSolidBrush
PtVisible
RectVisible
ExtTextOutW
Escape
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EndDoc
EndPage
TextOutW
StartPage
Polyline
GetTextColor
GetBkColor
CreatePolygonRgn
StartDocW
GetTextMetricsW
RealizePalette
GetDIBits
SetDIBColorTable
Ellipse
LPtoDP
DPtoLP
CreateEllipticRgn
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
GetDeviceCaps
CreateFontIndirectW
SelectObject
DeleteDC
PatBlt
CreateHatchBrush

msimg32

AlphaBlend
TransparentBlt

comdlg32

PrintDlgW
GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter
EnumPrinterDriversW
GetJobW

advapi32

RegQueryValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumValueW
RegSetValueW
RegCreateKeyExW
RegEnumKeyExW
RegCreateKeyW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW

shell32

SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteW
SHAppBarMessage
DragFinish
DragQueryFileW
SHGetFileInfoW
ExtractIconW
SHBrowseForFolderW
Shell_NotifyIconW

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathFileExistsW
PathFileExistsA
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW

oledlg

OleUIBusyW

ole32

OleLockRunning
CoGetClassObject
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateStreamOnHGlobal
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard

oleaut32

SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
VariantCopy
OleCreateFontIndirect
SysAllocStringLen
VariantChangeType
VariantClear
VariantInit
SysStringLen
SysFreeString

wsock32

WSASetLastError

gdiplus

GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCloneImage

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Exports

Exports

?adsGetStdText@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VCBinary@@@Z
?adsGetStdText_CString@@YA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@VCBinary@@@Z
?adsGetTextFromTextLib@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VCBinary@@@Z
?adsGetTextFromTextLibEx@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VCBinary@@ABV12@@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 358KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ef1fa30c9c1e3ebf591530c29d518d5a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wsock32

gdiplus

setupapi

imm32

winmm

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 358KB - Virtual size: 357KB

.data Size: 32KB - Virtual size: 125KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 358KB - Virtual size: 357KB

.data
Size: 32KB - Virtual size: 125KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB