dbde3dd36fd64193fc55e3e2308a6c8290975022c590a24570b30594d6601905

Sharing

Copy URL Twitter E-mail

General

Target

dbde3dd36fd64193fc55e3e2308a6c8290975022c590a24570b30594d6601905
Size

13.8MB
MD5

ff3712527bdddd1dcb74c5f40909cbce
SHA1

5049b4bb8944c1b4ee46ff0cdfff2d82a8ba8028
SHA256

dbde3dd36fd64193fc55e3e2308a6c8290975022c590a24570b30594d6601905
SHA512

7e436cc31c6f2a22d6e758a1cee54a9f9660a0aff19dbc8ee00dcbf5d72eaee51ea89d36928aeb007f8a7f670b0ec4b307dcfbaaaa3b5a65a32aacf8178f4eb0
SSDEEP

393216:ZXHZfO542nO9OMeUO1W8LkilOujxGCUH48elO+UAftZhd4t7o:FHVHh9Ox1W8QoxdA4TY+UAft7dco

Score

3^/10

Malware Config

Signatures

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Bin_240910_1st/Cim_Gem.dll
unpack001/Bin_240910_1st/EZGemPlusCS_64.dll
unpack001/Bin_240910_1st/GENESEM_MMI_EMI.exe
unpack001/Bin_240910_1st/GENESEM_MMI_EMI.exe.ini
unpack001/Bin_240910_1st/MenuLibrary.dll
unpack001/Bin_240910_1st/Multimedia.dll
unpack001/Bin_240910_1st/RadialGauge.dll
unpack001/Bin_240910_1st/ScreenLock.dll
unpack001/Bin_240910_1st/Slave.dll
unpack001/Bin_240910_1st/StripForm.dll
unpack001/Bin_240910_1st/es-MX/GENESEM_MMI_EMI.resources.dll
unpack001/Bin_240910_1st/intimedotnet_v4.dll
unpack001/Bin_240910_1st/ko-KR/GENESEM_MMI_EMI.resources.dll

Files

dbde3dd36fd64193fc55e3e2308a6c8290975022c590a24570b30594d6601905
.zip
Bin_240910_1st/Cim_Gem.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\장비 소스파일\SK Hynix\충칭 Attach\A3857\TRAY2RING_0206Base_SECSGEM_240822_1st_0313LotEnd점검\MMI\Cim_Gem\obj\Debug\Cim_Gem.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/Cim_Gem.pdb
Bin_240910_1st/Config/BtlVision.xml
Bin_240910_1st/Config/Error/ErrorNextActionType.xml
Bin_240910_1st/Config/Init.xml
Bin_240910_1st/Config/Login/User.xml
Bin_240910_1st/Config/Login/UserInfo -.xml
Bin_240910_1st/Config/Login/UserInfo.xml
Bin_240910_1st/Config/Menu/MenuList.xml
Bin_240910_1st/Config/SharedMemory.xml
Bin_240910_1st/Config/Transfer/Skyworks.xml
Bin_240910_1st/Config/UiSetting/FormAutoRun_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormBrush_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormBrush_Value.xml
Bin_240910_1st/Config/UiSetting/FormDeviceManager_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormExpandTable_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormExpandTable_Value.xml
Bin_240910_1st/Config/UiSetting/FormLoadingTable_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormLoadingTable_Value.xml
Bin_240910_1st/Config/UiSetting/FormLotNumberScan_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormMagazine_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormMagazine_Value.xml
Bin_240910_1st/Config/UiSetting/FormMotorCalibration_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormMotorPosition_Value.xml
Bin_240910_1st/Config/UiSetting/FormStatus_AccAuth.xml
Bin_240910_1st/Config/UiSetting/FormVacuum_Value.xml
Bin_240910_1st/Config/_A3857.mot
Bin_240910_1st/Config/mt - (2).mot
Bin_240910_1st/Config/mt - (3).mot
Bin_240910_1st/Config/mt - .mot
Bin_240910_1st/Config/mt - Copy.mot
Bin_240910_1st/Config/mt.mot
Bin_240910_1st/Config/mt_A3802.mot
Bin_240910_1st/Config/mt_inc.mot
Bin_240910_1st/EZGEM.RPT
Bin_240910_1st/EZGEMSTATUS.INI
Bin_240910_1st/EZGemPlusCS_64.dll
.dll windows:5 windows x64 arch:x64

f09f9aaed668990917cd08c7186dbfa8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mfc100

ord4050
ord4034
ord7033
ord4743
ord4740
ord957
ord411
ord10593
ord5003
ord10964
ord2440
ord955
ord1831
ord11428
ord4169
ord1948
ord409
ord11201
ord6914
ord4341
ord11312
ord11147
ord3991
ord12764
ord12758
ord12763
ord2076
ord11776
ord12358
ord12359
ord11775
ord1245
ord857
ord11777
ord868
ord4340
ord1929
ord1892
ord274
ord1293
ord887
ord1904
ord306
ord1275
ord322
ord1895
ord1844
ord1906
ord2048
ord2050
ord1914
ord396
ord2002
ord1945
ord2040
ord2012
ord2014
ord3285
ord321
ord2051
ord13144
ord893
ord1426
ord3697
ord4308
ord316
ord300
ord310
ord314
ord889
ord1291
ord1294
ord1457
ord1461
ord3284
ord6895
ord3990
ord7539
ord7576
ord11465
ord7190
ord2538
ord305
ord5035
ord2524
ord4124
ord266
ord265
ord1272
ord10961
ord12936
ord10984
ord12955
ord2022
ord2725
ord4162
ord5769
ord2018
ord1259
ord1274

msvcr100

_lock
_onexit
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__dllonexit
_unlock
?terminate@@YAXXZ
__C_specific_handler
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
__CxxFrameHandler3
isdigit
_strupr
sprintf
realloc
malloc
free
sscanf
memcpy
_splitpath
fseek
ftell
_findfirst64i32
_makepath
_localtime64_s
_fsopen
strstr
_time64
__iob_func
fwrite
fread
fopen
fputs
ldexp
memset
fprintf
fclose
strtok_s
fgets
fopen_s
strtok
_unlink
atoi
atof
atol
__FrameUnwindFilter
__CppXcptFilter
_cexit

kernel32

OutputDebugStringA
GetExitCodeThread
GetLastError
InitializeCriticalSectionAndSpinCount
SetThreadPriority
CreateEventA
TerminateThread
SetEvent
GetPrivateProfileStringA
SetLocalTime
GetLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
CloseHandle
SuspendThread
ResumeThread
CreateDirectoryA
ReadFile
CancelIo
ResetEvent
WriteFile
WaitForSingleObject
SetUnhandledExceptionFilter
lstrlenA
GetCurrentDirectoryA
WideCharToMultiByte
WritePrivateProfileStringA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
Sleep
DecodePointer
EncodePointer
LocalAlloc
LocalFree
GetTickCount
DeleteCriticalSection
CreateFileA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection

user32

UnregisterClassA
CreateWindowExA
TranslateMessage
PeekMessageA
DispatchMessageA
SetTimer
KillTimer
SendMessageA
LoadIconA
GetClassNameA
DestroyWindow
RegisterClassA
wsprintfA
DefWindowProcA
ShowWindow
PostMessageA
UpdateWindow
LoadCursorA

oleaut32

SysFreeString

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

gdi32

GetStockObject

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

SHFileOperationA

ws2_32

accept
WSAAsyncSelect
send
closesocket
WSASetLastError
__WSAFDIsSet
socket
bind
recv
WSACleanup
setsockopt
htons
WSAGetLastError
select
htonl
inet_addr
WSAStartup
inet_ntoa
connect
ioctlsocket
listen

mscoree

_CorDllMain

Sections

.text
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/Fonts/MALGUN.TTF
Bin_240910_1st/GEM/CEIDConf.ini
Bin_240910_1st/GEM/CommConf.ini
Bin_240910_1st/GEM/CommConf_FactorySet.ini
Bin_240910_1st/GEM/CommConf_Test.ini
Bin_240910_1st/GEM/CommConf___.ini
Bin_240910_1st/GEM/ECIDConf.ini
Bin_240910_1st/GEM/SVIDConf.ini
Bin_240910_1st/GENESEM_MMI_EMI.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\장비 소스파일\SK Hynix\충칭 Attach\A3857\TRAY2RING_0206Base_SECSGEM_240822_1st_0313LotEnd점검\MMI\MMI\obj\Debug\GENESEM_MMI_EMI.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/GENESEM_MMI_EMI.exe.config
.xml
Bin_240910_1st/GENESEM_MMI_EMI.exe.ini
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\장비 소스파일\SK Hynix\충칭 Attach\A3857\TRAY2RING_240104\MMI\MMI\obj\Debug\GENESEM_MMI_EMI.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/GENESEM_MMI_EMI.pdb
Bin_240910_1st/GENESEM_MMI_EMI.vshost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:e6:52:d6:dd:2c:c8:8c:44:ef:9d:c6:2d:d4:7c:ad:d9:fb:9c:a4:65:50:cd:d3:1e:d5:f3:1e:06:3d:c1:d2
Signer

Actual PE Digest

a5:e6:52:d6:dd:2c:c8:8c:44:ef:9d:c6:2d:d4:7c:ad:d9:fb:9c:a4:65:50:cd:d3:1e:d5:f3:1e:06:3d:c1:d2

Digest Algorithm

sha256

PE Digest Matches

true

02:ee:13:28:e6:01:69:6f:e5:72:19:59:cb:88:5c:98:97:c3:d0:47
Signer

Actual PE Digest

02:ee:13:28:e6:01:69:6f:e5:72:19:59:cb:88:5c:98:97:c3:d0:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\binaries\Intermediate\vsproject\vshostneutral.csproj__520862691\objr\x86\vshost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/GENESEM_MMI_EMI.vshost.exe.config
.xml
Bin_240910_1st/GENESEM_MMI_EMI.vshost.exe.manifest
Bin_240910_1st/LOG/20240814/GEM_20240814_[0001].LOG
Bin_240910_1st/LOG/20240826/GEM_20240826_[0001].LOG
Bin_240910_1st/LOG/20240827/GEM_20240827_[0001].LOG
Bin_240910_1st/LOG/20240904/GEM_20240904_[0001].LOG
Bin_240910_1st/LOG/20240905/GEM_20240905_[0001].LOG
Bin_240910_1st/LOG/20240909/GEM_20240909_[0001].LOG
Bin_240910_1st/LOG/20240910/GEM_20240910_[0001].LOG
Bin_240910_1st/MenuLibrary.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\_MyData\Work\개발소스\EMI\01_PlungerPin\EmiUnLoader\MMI\MenuLibrary\obj\Debug\MenuLibrary.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/MenuLibrary.pdb
Bin_240910_1st/Multimedia.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/Multimedia.pdb
Bin_240910_1st/RadialGauge.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\_MyData\Work\개발소스\EMI\01_PlungerPin\EmiUnLoader\MMI\RadialGauge\obj\Debug\RadialGauge.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/RadialGauge.pdb
Bin_240910_1st/ScreenLock.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\_MyData\Work\개발소스\공통\ScreenLock\obj\Debug\ScreenLock.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/ScreenLock.pdb
Bin_240910_1st/Slave.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\장비 소스파일\SK Hynix\충칭 Attach\A3857\TRAY2RING_0206Base_SECSGEM_240822_1st_0313LotEnd점검\MMI\MMI\User Control\Main_Animation\Slave\Slave\obj\x64\Debug\Slave.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/Slave.pdb
Bin_240910_1st/StripForm.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\_MyData\Work\개발소스\공통\StripForm\StripForm\obj\Debug\StripForm.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/StripForm.pdb
Bin_240910_1st/df
Bin_240910_1st/es-MX/GENESEM_MMI_EMI.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/intimedotnet_v4.dll
.dll windows:6 windows x86 arch:x86

4e3eccce9c7e7f1f09496a3516ebf7fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr110

__clean_type_info_names_internal
_except_handler4_common
_onexit
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__dllonexit
_calloc_crt
_unlock
_lock
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
_cexit
__FrameUnwindFilter
__CppXcptFilter

kernel32

Sleep
IsProcessorFeaturePresent
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer

ntx

ord25
ord8
ord18
ord10
ord2
ord9
ord4
ord19
ord11
ord7
ord15
ord17
ord12
ord14
ord16
ord26
ord70
ord71
ord72
ord63
ord1
ord43
ord73
ord75
ord38
ord3
ord22
ord24
ord23
ord13

ntxext

ord2
ord9
ord7
ord23
ord10
ord8
ord79
ord77
ord80
ord46
ord45
ord67
ord71
ord64
ord65
ord70
ord66
ord74
ord61
ord76
ord75
ord68
ord72
ord50
ord51
ord49
ord4
ord1
ord3
ord22
ord11

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 834B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin_240910_1st/ko-KR/GENESEM_MMI_EMI.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 54KB - Virtual size: 54KB

.rsrc Size: 1024B - Virtual size: 872B

.reloc Size: 512B - Virtual size: 12B

f09f9aaed668990917cd08c7186dbfa8

Headers

DLL Characteristics

File Characteristics

Imports

mfc100

msvcr100

kernel32

user32

oleaut32

setupapi

gdi32

advapi32

shell32

ws2_32

mscoree

Sections

.text Size: 323KB - Virtual size: 323KB

.nep Size: 512B - Virtual size: 32B

.rdata Size: 156KB - Virtual size: 155KB

.data Size: 4KB - Virtual size: 29KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 2KB - Virtual size: 2KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70Certificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

a5:e6:52:d6:dd:2c:c8:8c:44:ef:9d:c6:2d:d4:7c:ad:d9:fb:9c:a4:65:50:cd:d3:1e:d5:f3:1e:06:3d:c1:d2Signer

02:ee:13:28:e6:01:69:6f:e5:72:19:59:cb:88:5c:98:97:c3:d0:47Signer

Headers

.text
Size: 54KB - Virtual size: 54KB

.rsrc
Size: 1024B - Virtual size: 872B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 323KB - Virtual size: 323KB

.nep
Size: 512B - Virtual size: 32B

.rdata
Size: 156KB - Virtual size: 155KB

.data
Size: 4KB - Virtual size: 29KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.4MB - Virtual size: 2.4MB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

a5:e6:52:d6:dd:2c:c8:8c:44:ef:9d:c6:2d:d4:7c:ad:d9:fb:9c:a4:65:50:cd:d3:1e:d5:f3:1e:06:3d:c1:d2
Signer

02:ee:13:28:e6:01:69:6f:e5:72:19:59:cb:88:5c:98:97:c3:d0:47
Signer

.text
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 792B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 688B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 792B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 792B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 3.1MB - Virtual size: 3.1MB

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 512B - Virtual size: 12B