f37d030929ed35b4075f2e2a890b61aa96209375c4c8ec0e5eb06817de9ad281

Sharing

Copy URL Twitter E-mail

General

Target

f37d030929ed35b4075f2e2a890b61aa96209375c4c8ec0e5eb06817de9ad281
Size

1.3MB
MD5

ec3fc3b87d037b210c2620d35ce11c74
SHA1

bd8b2727d02e367f7344d59d01857147322b4fa2
SHA256

f37d030929ed35b4075f2e2a890b61aa96209375c4c8ec0e5eb06817de9ad281
SHA512

2728c51e5e3a5a4267648243eac0a130c5a94292189f24e94214f2e96f56c01dcc49fe8fd737e548466caeda9cf58a0b639e9294bcb6d2ef3ecaa378ba9f1ff9
SSDEEP

24576:AY0YLznQPEyYT2iDPfy/RtDRP0IfLvj8NZp6BbQ0Vx/UT/zgFAW:HnJyYK+Pfc8pWcTcFh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f37d030929ed35b4075f2e2a890b61aa96209375c4c8ec0e5eb06817de9ad281

Files

f37d030929ed35b4075f2e2a890b61aa96209375c4c8ec0e5eb06817de9ad281
.dll windows:4 windows x86 arch:x86

9b1efc5f90784adb5fdc78b941b87566

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord826
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord2820
ord356
ord2770
ord2781
ord3010
ord3178
ord4058
ord3181
ord1980
ord668
ord6877
ord3811
ord3337
ord2859
ord2405
ord5227
ord3693
ord283
ord3706
ord3663
ord323
ord1640
ord5785
ord640
ord1641
ord5875
ord6171
ord3619
ord472
ord2860
ord5787
ord2414
ord3626
ord287
ord6139
ord610
ord4204
ord941
ord939
ord5683
ord6876
ord6662
ord2915
ord2764
ord4278
ord2614
ord5710
ord4202
ord923
ord922
ord926
ord1601
ord539
ord6663
ord2818
ord1200
ord2763
ord4129
ord4277
ord540
ord858
ord823
ord924
ord860
ord535
ord2725
ord1205
ord1168
ord1134
ord3953
ord6467
ord537
ord800
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord825
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord269

msvcrt

mktime
perror
fgetc
_getcwd
_errno
putc
_stricmp
toupper
free
sprintf
__CxxFrameHandler
wcslen
_close
_lseek
_write
_read
_setmode
_unlink
_open
_ftol
atoi
getenv
exit
strtok
vfprintf
strchr
_iob
strrchr
fprintf
__mb_cur_max
_isctype
_pctype
abort
vsprintf
tmpnam
isprint
printf
strncmp
longjmp
__CxxLongjmpUnwind
_setjmp3
_swab
tmpfile
realloc
_CIfmod
calloc
ceil
rand
qsort
fgets
getc
fputc
fflush
ftell
_purecall
_strnicmp
ldiv
memmove
fscanf
fwrite
_except_handler3
fopen
fread
fseek
fclose
floor
_mbscmp
_mbsicmp
atof
strstr
_vsnprintf
malloc
localtime
time
sscanf
_CIpow
_CIacos
atol
strncpy
_snprintf
gmtime
strtod
strcpy
strlen
memcpy
memset
pow
exp
log
sqrt
fabs
atan2
_EH_prolog
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_CxxThrowException
islower

kernel32

lstrlenA
ResumeThread
LocalAlloc
FormatMessageA
GlobalAlloc
GlobalFree
InterlockedDecrement
LocalFree
SetEvent
CancelIo
WaitForSingleObject
GetOverlappedResult
CreateEventA
CreateMutexA
GetTempPathA
FreeLibrary
GetVersionExA
DeleteFileA
GetTickCount
WideCharToMultiByte
OutputDebugStringA
GetPrivateProfileStringA
CloseHandle
CreateFileA
GetProcAddress
LoadLibraryA
GetCurrentDirectoryA
WriteFile
LockResource
LoadResource
GetLastError
FindResourceA
WritePrivateProfileStringA
CreateDirectoryA
GetFileSize
FlushFileBuffers
SetFilePointer
GetLocalTime
GetModuleFileNameA
GetLongPathNameA
MultiByteToWideChar
GetShortPathNameA
PurgeComm
SetCommMask
SetCommTimeouts
SetCommState
GetCommState
ReadFile
Sleep
GetPrivateProfileIntA
CopyFileA
RemoveDirectoryA
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
ReleaseMutex

user32

MessageBoxA
LoadBitmapA
FillRect
GetDC
GetSysColor
SendMessageTimeoutA
FindWindowA
SendMessageA
ReleaseDC

gdi32

GetTextExtentPoint32A
GetStockObject
SelectObject
SetEnhMetaFileBits
GetEnhMetaFileHeader
SetWinMetaFileBits
GetDeviceCaps
DeleteEnhMetaFile
ExtTextOutA
GetEnhMetaFilePaletteEntries
SelectPalette
PlayEnhMetaFile
SetBkColor
Ellipse
RealizePalette
GetDIBits
DeleteDC
CreatePalette
CreateCompatibleBitmap
DeleteObject
Polyline
CreatePen
Rectangle
CreatePolygonRgn
FillRgn
GetObjectA
CreateCompatibleDC
BitBlt
CreateFontA

ole32

CoUninitialize
CoInitialize
CoCreateGuid
CoTaskMemFree
CoCreateInstance
OleRun

oleaut32

VariantChangeType
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantCopy
SysFreeString
VariantClear
GetErrorInfo

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

iphlpapi

GetAdaptersInfo

hid

HidD_GetProductString
HidD_GetHidGuid

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

shlwapi

PathFileExistsA

ws2_32

ntohs
htonl
ntohl
htons

Exports

Exports

?MergeImage@@YGHPBD00@Z
?StopStampeUrgent@@YGHPBD@Z
AutoAdjust
AutoStamp
BeeperSwitch
BeginStamp
BindPC
Capture
CheckMachineInfo
CreateTaskID
DoImageShow
EndStamp
GenerateCodeImage
GetBindPC
GetDeviceSN
GetDeviceStatus
GetErrMsg
GetLockStatus
GetPaperDoorStatus
GetSafeDoorStauts
GetSealHandNum
GetSealLabelInfo
GetSealPos
GetSlotsStatus
GetSpareOrMain
GetStampStatus
HandleNotieBeepe
ImageCapture
ImageCaptureData
ImageOCR
Init
LockDevice
OCRImageByArea
OpenPSBDoor
QueryBeeperSwitch
QueryMachinePassword
Release
RotateSealToDoor
SafeDoorSwitch
SafeDoorSwitchBak
SetBeeperSwitch
SetCodeLength
SetGuid
SetMachinePassword
SetPCB
StampByIndex
StampByRFID
StampRotate
SwitchSafeDoor
TemplateOCR
TestImageWrite
UnBindPC
UnLockDevice
Verify
VocherMatch
VocherMatchInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b1efc5f90784adb5fdc78b941b87566

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

ole32

oleaut32

msvcp60

iphlpapi

hid

setupapi

shlwapi

ws2_32

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 164KB - Virtual size: 161KB

.data Size: 84KB - Virtual size: 112KB

.rsrc Size: 40KB - Virtual size: 36KB

.reloc Size: 48KB - Virtual size: 44KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 164KB - Virtual size: 161KB

.data
Size: 84KB - Virtual size: 112KB

.rsrc
Size: 40KB - Virtual size: 36KB

.reloc
Size: 48KB - Virtual size: 44KB