b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d

Sharing

Copy URL Twitter E-mail

General

Target

b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d
Size

144KB
MD5

55d659a566b8bdbbf22689d68af61f6b
SHA1

32ed3d857620150667a674da71c4a7aceee83d18
SHA256

b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d
SHA512

815a2bb7d3283d59ea0c6f3a33fa1e8efb178571d1ee78b0af0e1b104ae757782c7255a76c7d7a55348c52465e143f816928f53515bb67fbe7cddc5d457e6317
SSDEEP

1536:dcLBbXwFNIkBwpwGGGERmDexHnU3JBzBz3efnC8NTqjGOWEwV4ZbphvdU993Du7g:dMAikewx0ZBlzuff2jL9ZVhv6T3Du7V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d

Files

b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d
.dll windows:4 windows x86 arch:x86

793bb053267694f0a59814384efa6c1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\360云盘\DriversProjects\PLCDrivers\OUT\emudrivers\Schneider_TELWAY.pdb

Imports

kernel32

ReleaseMutex
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
CreateMutexA
CreateEventA
ResumeThread
InterlockedIncrement
InterlockedDecrement
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
Sleep
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
InitializeCriticalSection
LoadLibraryA
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

Exports

Exports

PLC_Init

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

793bb053267694f0a59814384efa6c1f

Headers

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 4KB - Virtual size: 3KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 3KB

.rmnet
Size: 60KB - Virtual size: 60KB