4f06b9ee4bbbb74df927704e06dd8332918e80af32534d8c6748599422ab5839

Sharing

Copy URL Twitter E-mail

General

Target

4f06b9ee4bbbb74df927704e06dd8332918e80af32534d8c6748599422ab5839
Size

1.4MB
MD5

02a7ee4a5c0e2e385abb5e33e175c8f7
SHA1

2b464b318278bb59c7457aa878f00c27cbdf406b
SHA256

4f06b9ee4bbbb74df927704e06dd8332918e80af32534d8c6748599422ab5839
SHA512

83c4bdf3625660849bf3c1951c51dbb8655103f4f52cb06b6ef1d8ced01c3b34def761d43b64197819d35b7461aa21b4481b0ac39b1ee5cd6938dd668372ccad
SSDEEP

24576:bm+KpPG6KIzkQm1qQ33V1wNqSCHNCb5vQ/qpyr0kCFq6ZrNw2Uq2csjri3LZYPRY:eeQKqg3V1xFHuvQ/qpyr0kaDW2ZYPRp2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f06b9ee4bbbb74df927704e06dd8332918e80af32534d8c6748599422ab5839

Files

4f06b9ee4bbbb74df927704e06dd8332918e80af32534d8c6748599422ab5839
.dll windows:6 windows x86 arch:x86

2fa11ff394b22510217219a037ef1bc0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoA

kernel32

GetTickCount
WaitForMultipleObjects
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
CopyFileA
HeapAlloc
HeapFree
GetProcessHeap
Sleep
CreateEventA
GetExitCodeThread
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateDirectoryA
WaitForSingleObject
TerminateThread
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
GetSystemTimeAsFileTime
RtlUnwind
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
RaiseException
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
CloseHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
WriteFile
GetModuleFileNameW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
HeapSize
GetFileAttributesExW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
CompareStringW
LCMapStringW
SetConsoleCtrlHandler
FreeLibrary
OutputDebugStringW
SetStdHandle
WriteConsoleW
HeapReAlloc
CreateFileW
SetEndOfFile
SetEnvironmentVariableA
GetEnvironmentVariableW
DeleteFiber
GlobalMemoryStatus
ConvertFiberToThread
LoadLibraryW
ReadConsoleA
SetConsoleMode
ReadFile
CreateFileA
LoadLibraryA
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetLocalTime
GetCurrentThreadId
TerminateProcess

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
PostMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
MessageBoxA

advapi32

CryptSetHashParam
RegCloseKey
RegOpenKeyExA
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGetProvParam
CryptGetUserKey
CryptExportKey
RegQueryValueExA
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom

ws2_32

WSACleanup
WSAGetLastError
recv
send
WSASetLastError
closesocket
socket
getaddrinfo
freeaddrinfo
inet_ntop

kcc_api

KingStar_GetSystemInfo

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext

Exports

Exports

ChangePassword
ExecOrderAction
ExecOrderInsert
GetExchangeID
GetInvestor
GetInvestorEx
GetNameOfTradeSystem
GetServerCount
GetServerName
GetShortNameOfTradeSystem
GetTradeDate
GetTraderDllVersion
OptionSelfCloseAction
OptionSelfCloseInsert
OrderAction
OrderInsert
OrderInsertEx
ProcessCloseToday
QueryBank
QueryBankBalance
QueryBankBalanceEx
QueryBankTransferDetail
QueryBrokerNotice
QueryCFMMC
QueryContract
QueryExecOrder
QueryFutureToBankLimit
QueryInvestorPosition
QueryInvestorPositionDetail
QueryMarginRate
QueryMaxOrderVolume
QueryMoneyHistory
QueryOptionSelfClose
QueryOrder
QueryQuote
QuerySettlementInfo
QuerySingleOrder
QuerySinglePosition
QueryTrade
QueryTradeStatistics
QueryTradingAccount
QueryTradingAccountEx
QuoteInsert
SettlementInfoConfirm
TradeFinalize
TradeInitialize
TraderDllFree
TransferBankToFuture
TransferBankToFutureEx
TransferFutureToBank
TransferFutureToBankEx

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2fa11ff394b22510217219a037ef1bc0

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

advapi32

ws2_32

kcc_api

crypt32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 293KB - Virtual size: 292KB

.data Size: 24KB - Virtual size: 50KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 47KB - Virtual size: 46KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 293KB - Virtual size: 292KB

.data
Size: 24KB - Virtual size: 50KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 47KB - Virtual size: 46KB