0cd9e9ebfa8f504d126fb405a9f3171bdfbbffe85c686458fe2b37936f9384d7

Sharing

Copy URL Twitter E-mail

General

Target

0cd9e9ebfa8f504d126fb405a9f3171bdfbbffe85c686458fe2b37936f9384d7
Size

500KB
MD5

62e57a303aa5e758903b0da0728aadf8
SHA1

f0d939afe42a4a87c9f335d3481d1efa3529f988
SHA256

0cd9e9ebfa8f504d126fb405a9f3171bdfbbffe85c686458fe2b37936f9384d7
SHA512

190e18a328e441c2a328e4608285dfaa9c20e8ac773343dcba4d811e03957f7dddb6737507aef2991c62bcebdfc4c5c2d73376e4380f7c08ca8fb4c727e46b8c
SSDEEP

12288:8Zygb/epK+IQwSEg2kO4qsHirZ+PT8vusv:8ZHb/UKBfg2kO4qsHiUPT/sv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cd9e9ebfa8f504d126fb405a9f3171bdfbbffe85c686458fe2b37936f9384d7

Files

0cd9e9ebfa8f504d126fb405a9f3171bdfbbffe85c686458fe2b37936f9384d7
.exe windows:4 windows x86 arch:x86

83381aaccf569c413707b02442da9a6c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wflicensemaglib

?IsValidDongle@SS_ADSDongle@@QAE_NXZ
?IsActivated@SS_ADSDongle@@QAE_NXZ
?HasADSDongleInstalled@SS_ADSDongle@@QAE_NXZ
??0SS_ADSDongle@@QAE@XZ
??1SS_ADSDongle@@QAE@XZ
?RecoveryLicense@@YAHPAVSS_ADSDongle@@PAUtagLIENCESE_INFO@@@Z
?CancelLicense@SS_ADSDongle@@QAEHH@Z
?DongleEncrypt@SS_ADSDongle@@QAEIPAD0I@Z
?GetLicenseNum@SS_ADSDongle@@QAEHXZ
?GetBeginYear@SS_ADSDongle@@QAEHXZ
?GetBeginMonth@SS_ADSDongle@@QAEHXZ
?GetBeginDay@SS_ADSDongle@@QAEHXZ
?GetEndYear@SS_ADSDongle@@QAEHXZ
?GetEndMonth@SS_ADSDongle@@QAEHXZ
?SetUsedLicense@SS_ADSDongle@@QAEHH_N@Z
?GetEndDay@SS_ADSDongle@@QAEHXZ
?GetLicenseVerInfo@SS_ADSDongle@@QAEPADXZ
?IsTrialLicense@SS_ADSDongle@@QAE_NXZ

rsacrypt

?WFRSAEncryptString@@YAXPAD00@Z
?WFSHA256String@@YAXPAD0@Z
?WFRSADecryptString@@YAXPAD00@Z

ws2_32

htons
bind
closesocket
socket
WSAStartup
WSACleanup
htonl
sendto
__WSAFDIsSet
select
recvfrom
ntohl
WSAGetLastError
inet_ntoa
inet_addr
setsockopt
ntohs
gethostname
listen
accept
connect
send
recv
getpeername
WSASetLastError

kernel32

SetLastError
TlsAlloc
TlsSetValue
GetVersion
GetStartupInfoA
TlsGetValue
GetSystemTime
GetTimeZoneInformation
RaiseException
HeapAlloc
HeapFree
RtlUnwind
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
GetModuleHandleA
Sleep
GetTickCount
InterlockedDecrement
GetCurrentThreadId
GetLastError
CloseHandle
GetCurrentProcess
GetCurrentThread
GetPrivateProfileStringA
GetModuleFileNameA
lstrcmpiA
GetCommandLineA
lstrlenA
HeapReAlloc
CreateFileA
GetDriveTypeA
GetLogicalDrives
WritePrivateProfileStringA
DeleteFileA
GlobalMemoryStatus
ReadFile
WriteFile
MultiByteToWideChar
CreateDirectoryA
WideCharToMultiByte
ResetEvent
CreateThread
SetEvent
InterlockedExchange
CreateEventA
CopyFileA
GetDiskFreeSpaceExA
InterlockedIncrement
FindClose
FindNextFileA
GetFileAttributesA
FindFirstFileA
SetCurrentDirectoryA
InterlockedExchangeAdd
FlushFileBuffers
IsBadWritePtr
TerminateProcess
GetLocalTime
lstrcpynA
lstrcmpA
lstrcpyA
SetThreadExecutionState
SetEnvironmentVariableA
SystemTimeToFileTime
FreeLibrary
GetSystemDirectoryA
GetWindowsDirectoryA
DeviceIoControl
SetFilePointer
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
HeapSize
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
WaitForSingleObject
GetACP

user32

PostThreadMessageA
GetMessageA
DispatchMessageA
PeekMessageA
CharNextA
MessageBoxA
SystemParametersInfoA
LoadStringA

advapi32

RegOpenKeyExA
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetLengthSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetServiceStatus
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
CreateServiceA
DeleteService
ControlService
StartServiceCtrlDispatcherA
StartServiceA
GetTokenInformation

shell32

ShellExecuteExA

ole32

CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateGuid

atl

ord20
ord18
ord23
ord57
ord16
ord17

Sections

.text
Size: 404KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83381aaccf569c413707b02442da9a6c

Headers

File Characteristics

Imports

wflicensemaglib

rsacrypt

ws2_32

kernel32

user32

advapi32

shell32

ole32

atl

Sections

.text Size: 404KB - Virtual size: 402KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 32KB - Virtual size: 63KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 404KB - Virtual size: 402KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 32KB - Virtual size: 63KB

.rsrc
Size: 4KB - Virtual size: 2KB