21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a

Sharing

Copy URL Twitter E-mail

General

Target
21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a
Size 162KB
Sample260716-e7d2ysds3j
SHA256 21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a
MD5 876fe3db178b4de7b619ee67a831dd1e
SHA1 debfc764d483e33776f8372ff1061a03bf5c301b
SHA512 d7814baa09197406f295bb5b9eb47de7294329f2d7886573265b70044dd2f6767daac251a6f9364599d2724b7b7a43157abbe7d5820cef087339c5460cb2b37a
SSDEEP 3072:KYQ/TYWS7TEG0xrDCbLru8I9eJqFNMUTKN/AU7Bi08ge71sen+f+/H:KYgmc4M96N/AU7Bi08ge2feH
TLSH
T121F35A53E10595B4DB9A00FA14B62FD79FAA513C0F6210C3B3647DF689B42D0BBBE209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a

File Explorer

21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a

.dll 162KB

21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a

IMPHASH e58b7b72d8e51514d129164267feead2
SHA256 21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a
MD5 876fe3db178b4de7b619ee67a831dd1e
SHA1 debfc764d483e33776f8372ff1061a03bf5c301b
SHA512 d7814baa09197406f295bb5b9eb47de7294329f2d7886573265b70044dd2f6767daac251a6f9364599d2724b7b7a43157abbe7d5820cef087339c5460cb2b37a
SSDEEP 3072:KYQ/TYWS7TEG0xrDCbLru8I9eJqFNMUTKN/AU7Bi08ge71sen+f+/H:KYgmc4M96N/AU7Bi08ge2feH
TLSH
T121F35A53E10595B4DB9A00FA14B62FD79FAA513C0F6210C3B3647DF689B42D0BBBE209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

113495

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\git\ATS_Station_Management_17\Release\ATS_Station_Managment.pdb

kernel32

GetLocalTime GetProcessHeap CreateProcessA GetPrivateProfileStringA GetExitCodeProcess AcquireSRWLockExclusive CloseHandle CreateFileA GetLastError GetTickCount64 Sleep WaitForSingleObject HeapFree GetModuleFileNameA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId HeapAlloc ReadFile GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent ReleaseSRWLockExclusive

user32

MessageBoxA

advapi32

CryptGetHashParam InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext

shell32

SHCreateDirectoryExA

msvcp140

?tolower@?$ctype@D@std@@QBEDD@Z ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??Bid@locale@std@@QAEIXZ ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z _Strxfrm ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

wininet

InternetReadFile InternetCloseHandle InternetOpenA HttpQueryInfoA InternetOpenUrlA

iphlpapi

GetAdaptersInfo

shlwapi

PathFileExistsA PathRemoveFileSpecA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

ociliba

_OCI_GetLob@8 _OCI_SetAutoCommit@8 _OCI_ErrorGetOCICode@4 _OCI_GetRowCount@4 _OCI_ReleaseResultsets@4 _OCI_StatementCreate@4 _OCI_GetResultset@4 _OCI_LobRead@12 _OCI_ExecuteStmt@8 _OCI_GetLastError@0 _OCI_GetString@8 _OCI_GetSql@4 _OCI_ConnectionFree@4 _OCI_GetString2@8 _OCI_Initialize@12 _OCI_ErrorGetString@4 _OCI_Commit@4 _OCI_Cleanup@0 _OCI_GetColumnCount@4 _OCI_StatementFree@4 _OCI_FetchNext@4 _OCI_Rollback@4 _OCI_ErrorGetStatement@4 _OCI_GetInt@8 _OCI_IsNull@8 _OCI_ConnectionCreate@16

vcruntime140

_except_handler4_common memset __std_type_info_destroy_list memmove _CxxThrowException memcpy strchr strstr __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free

api-ms-win-crt-string-l1-1-0

strcspn strncpy strcpy_s toupper _stricmp strcat_s

api-ms-win-crt-stdio-l1-1-0

fputs __stdio_common_vfprintf_s __stdio_common_vsprintf fwrite fseek fopen __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s fflush fclose

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-convert-l1-1-0

strtol atol

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _execute_onexit_table _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _crt_atexit _cexit _invalid_parameter_noinfo_noreturn _initialize_onexit_table _initialize_narrow_environment

?ATS_InsertFailCode_V3@@YAHPAD0000H@Z ?ATS_InsertTestResult_V3@@YAHPAD000000H00@Z ?ATS_InsertTestResult_V4@@YAHPAD000000H000000000H00@Z ?device_use_count@@YAHPAD0@Z ATS_CALL_IT_SQL_API ATS_InsertDataRow ATS_InsertDataRow_JIG ATS_InsertDataRow_JIG_V2 ATS_InsertDataRow_JIG_V3 ATS_InsertDataRow_OFFLINE_V2 ATS_InsertErrorData ATS_InsertFailCode ATS_InsertFailCode_V2 ATS_InsertJIGNumber ATS_InsertRoutMaintain ATS_InsertTestData ATS_InsertTestResult ATS_InsertTestResult_V2 ATS_OffLine_InsertResult_V2 ATS_SelectATSStationName ATS_SelectMaterialCode ATS_SelectSONYInfo ATS_SelectTestYorN ATS_SelectTestYorN_Batch ATS_SelectTestYorN_Batch_LineName ATS_SelectTestYorN_Batch_MD5 Ali_GetBatch Ali_GetSNRange BtSpkCheckSN GetData GetDataOrderBy GetDbTime GetDbTimeStamp Get_ExePath HW_InsertDataRow InsertData InsertOneRowData InsertTwoData Insert_WisillicaData MES_GetMACorSN_OrderByData MES_OnlyInsertDataRow Product_BindSNGet_NewSN Product_BindSN_GetBINKEY Product_BindSN_GetKEY Product_GetKEYBinbyMAC Product_GetKEY_DBHashValue Product_GetSNorMAC Product_GetScriptContent Product_GetTwoSNorMAC Product_OvercodeGet_MAC Product_SN_GetBINKEY Product_SN_GetBINKEY_SaveFile Product_SN_GetKEY Product_SnBD_BindSN Product_SnGet_BindSN Product_SnMacBind SelectOneRowData TestConnect UpdateData UpdateDataTwoCondition UpdateOneDataTwoCondition UpdateOneRowData WriteLog p_CheckSeqResult query_dut set_station

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

shared

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

21d5746d8220f02169054c96745a952995964f09fb186e2188938f2e9bd11f3a

kernel32

user32

advapi32

shell32

msvcp140

wininet

iphlpapi

shlwapi

version

ociliba

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic