181ba9854b8d07e42c0c162f7fb6abbd669f1787334d572354464309ff615fdc[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

181ba9854b8d07e42c0c162f7fb6abbd669f1787334d572354464309ff615fdc.exe
Size

100KB
MD5

c4bb00f669090a258ded78cf86536c61
SHA1

41cc32e982fcaa8719f4a5e24862c73f3fd54240
SHA256

181ba9854b8d07e42c0c162f7fb6abbd669f1787334d572354464309ff615fdc
SHA512

8835e5f8ca5d147e11c63568287d1c8b9f6dc5ca980688c5c3e5be3116eecc3182c7658ebd7f7eb094f1d80ce1b496a37cdcafd0408489da12789338597d225d
SSDEEP

3072:uKAab71rQsS4CL+x/A/opfXunh0/3SwZpXc/s/q/LCV/N/m/LyoJx9jaq:FV8g/A/V0Kwg/s/q/LCV/N/o3jt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
181ba9854b8d07e42c0c162f7fb6abbd669f1787334d572354464309ff615fdc.exe

Files

181ba9854b8d07e42c0c162f7fb6abbd669f1787334d572354464309ff615fdc.exe
.dll windows:4 windows x86 arch:x86

e10d370e62462dfd4f903c95c9136488

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

kernel32

CreateDirectoryA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetVersion
HeapAlloc
HeapFree
LoadLibraryA

cc3270mt

@$bdele$qpv
@$bdla$qpv
@$bnew$qui
@$bnwa$qui
@_CatchCleanup$qv
@_InitTermAndUnexPtrs$qv
@_ReThrowException$quipuc
@_ThrowExceptionLDTC$qpvt1t1t1uiuiuipuct1
@std@_String_base@_Xlen$xqv
@std@_String_base@_Xran$xqv
@std@exception@$bdtr$qv
@std@exception@what$xqv
__ErrorExit
__ErrorMessage
__Return_unwind
___CRTL_MEM_UseBorMM
___CRTL_TLS_Alloc
___CRTL_TLS_ExitThread
___CRTL_TLS_Free
___CRTL_TLS_GetValue
___CRTL_TLS_InitThread
___CRTL_TLS_SetValue
____ExceptionHandler
__argv_default_expand
__free_heaps
__handle_exitargv
__handle_setargv
__handle_wexitargv
__handle_wsetargv
__startupd
__wargv_default_expand
__wmemchr
_memchr
_memcmp
_memcpy
_memmove
_memset
_strlen
_strncmp
_strtol
_strtoul

phstd

@PhDecodeString$qrx60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%o
@PhEncodeString$qrx60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%o
@PhFileExists$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@PhIncludeTrailingBackslash$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@Photomod@TPhDateTime@$bctr$qrx60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@Photomod@TPhDateTime@ToString$xqv
@Photomod@ssprintf$qpxce
@Photomod@string_vector@$bctr$qrx60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%c
@TPhFileStream@$bctr$qv
@TPhFileStream@$bdtr$qv
@TPhFileStream@Open$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%10phOpenModeul
@TPhIniFileManager@$bctr$qp9TPhStream10phOpenModeo
@TPhIniFileManager@$bdtr$qv
@TPhIniFileManager@Close$qv
@TPhIniFileManager@ReadSection$qr155std@%vector$60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%78std@%allocator$60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%%%
@TPhIniFileManager@ReadStdBinary$qpxc60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@TPhIniFileManager@ReadString$qpxct1
@TPhIniFileManager@SetSection$qpxc
@TPhIniFileManager@WriteSection$qpxco
@TPhIniFileManager@WriteStdBinary$qpxcrx60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@TPhStream@getLine$qpcul
@TPhStream@getOptions$xqv
@TPhStream@getState$xqv
@TPhStream@setOptions$qui
@TPhStream@setState$qui
@TPhStringStream@$bctr$qrx60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@TPhStringStream@$bctr$qv
@TPhStringStream@$bdtr$qv
@TPhStringStream@$oo$qv
@TPhStringStream@Read$qpvul
@TPhStringStream@Write$qpxvul
@TPhStringStream@getPosition$qv
@TPhStringStream@getSize$qv
@TPhStringStream@setPosition$qul
@TPhStringStream@setSize$qul
_PhStd_Finalize
_PhStd_Initialize

Exports

Exports

@BreakIdIntoParts$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@ExcludeTrailingDot$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetAbsoluteId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetAbsoluteObjectId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetAtIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetBlockId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%i
@GetBlockSchemeId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%i
@GetCoordSystemsIdMask$qv
@GetGlobalObjId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%i
@GetGlobalObjIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%i
@GetImageFeaturesId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetImageId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetModelId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetModelIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetModelsRootId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetModelsRootIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetObjectProjectId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetObjectsId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1i
@GetObjectsIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1i
@GetProjectACLId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetProjectId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetProjectIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetRasterId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetRasterInfoId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetRelativeId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetRelativeObjectId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@GetSolverIdF$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@GetTransformRasterId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1i
@GetVersionDependentName$qpxc
@IncludeTrailingDot$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@IsFileId$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@PhGetConfigString$qi
@Photomod@TPhResDescription@$basg$qrx26Photomod@TPhResDescription
@Photomod@TPhResDescription@$bctr$qrx26Photomod@TPhResDescription
@Photomod@TPhResDescription@$bctr$qv
@Photomod@TPhResDescription@$bdtr$qv
@Photomod@TPhResDescription@Clear$qv
@Photomod@TPhResDescription@Compress$qv
@Photomod@TPhResDescription@GetKeysList$xqv
@Photomod@TPhResDescription@ReadBool$xq60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%o
@Photomod@TPhResDescription@ReadFromString$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@Photomod@TPhResDescription@ReadInt$xq60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%i
@Photomod@TPhResDescription@ReadPhDateTime$xq60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%20Photomod@TPhDateTime
@Photomod@TPhResDescription@ReadSizeT$xq60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%ui
@Photomod@TPhResDescription@ReadString$xq60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@Photomod@TPhResDescription@SaveToString$xqv
@Photomod@TPhResDescription@WriteBool$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%o
@Photomod@TPhResDescription@WriteInt$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%i
@Photomod@TPhResDescription@WritePhDateTime$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%20Photomod@TPhDateTime
@Photomod@TPhResDescription@WriteSizeT$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%ui
@Photomod@TPhResDescription@WriteString$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1
@Photomod@TPhResDescription@update_buf$qrpcruiui
@TPhResDescription_Base@GetResourceDescrSize$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@TPhResDescription_Base@GetResourceDescription$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@TPhResDescription_Base@GetResourceDescriptionData$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%
@TPhResDescription_Base@SetResourceDescrSize$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%ui
@TPhResDescription_Base@SetResourceDescription$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%t1t1t1
@TPhResDescription_Base@SetResourceDescriptionData$q60std@%basic_string$c19std@%char_traits$c%17std@%allocator$c%%r26Photomod@TPhResDescription
@std@nothrow
_PhProjConsts_Finalize
_PhProjConsts_Initialize
___CPPdebugHook

Sections

.text
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e10d370e62462dfd4f903c95c9136488

Headers

File Characteristics

Imports

advapi32

kernel32

cc3270mt

phstd

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 68KB

.data Size: 16KB - Virtual size: 16KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 4KB

.edata Size: 5KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 4KB

.text
Size: 67KB - Virtual size: 68KB

.data
Size: 16KB - Virtual size: 16KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 4KB

.edata
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 4KB