3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824

Sharing

Copy URL Twitter E-mail

General

Target
3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824
Size 75KB
Sample261030-knfpbsxwas
SHA256 3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824
MD5 641f4ceef2436b1887bd13282e9f855a
SHA1 526f45aa11e1d24ac3cb1cdead3e2ff07346046b
SHA512 95f8a376a17d97e9c63c84eb218bc338bb0bc631dc11146511f98dd0ab26811d3ad42876a5edc4a97177a436cabb20dafad1572ca8e3ea10f563edbbc693481f
SSDEEP 1536:AlJCCdNJPfsHbCLIs3erUdo+BwMJAYrdcPnIo2z:ArzNJMH+Es31do2JAYK/IT
TLSH
T164734C53F98C8079D06D0B374C5DAF65E83FB961B2A145A3B7882F0D48F99617B0A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824

File Explorer

3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824

.dll 75KB

3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824

IMPHASH f1d22f75ac2e3d887e426ffc0b94feb1
SHA256 3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824
MD5 641f4ceef2436b1887bd13282e9f855a
SHA1 526f45aa11e1d24ac3cb1cdead3e2ff07346046b
SHA512 95f8a376a17d97e9c63c84eb218bc338bb0bc631dc11146511f98dd0ab26811d3ad42876a5edc4a97177a436cabb20dafad1572ca8e3ea10f563edbbc693481f
SSDEEP 1536:AlJCCdNJPfsHbCLIs3erUdo+BwMJAYrdcPnIo2z:ArzNJMH+Es31do2JAYK/IT
TLSH
T164734C53F98C8079D06D0B374C5DAF65E83FB961B2A145A3B7882F0D48F99617B0A34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

rtl140.bpl

@System@initialization$qqrv @System@Finalization$qqrv @System@FreeMemory$qpv @System@GetMemory$qi @System@UnregisterModule$qqrp17System@TLibModule @System@RegisterModule$qqrp17System@TLibModule @System@@DynArrayClear$qqrrpvpv @System@@DynArraySetLength$qqrv @System@Pos$qqrx20System@UnicodeStringt1 @System@@UStrCatN$qqrv @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2 @System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString @System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus @System@@UStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$% @System@@UStrFromArray$qqrr20System@UnicodeStringpci @System@@UStrFromPWChar$qqrr20System@UnicodeStringpb @System@@UStrToPWChar$qqrx20System@UnicodeString @System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrArrayClr$qqrpvi @System@@UStrClr$qqrpv @System@@UStrAddRef$qqrpv @System@@LStrSetLength$qqrv @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$% @System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$% @System@@LStrAddRef$qqrpv @System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us @System@@LStrClr$qqrpv @System@@RunError$qqruc @System@@PackageUnload$qqrpx23System@PackageInfoTablep17System@TLibModule @System@@PackageLoad$qqrpx23System@PackageInfoTablep17System@TLibModule @System@@HandleFinally$qqrv @System@@BeforeDestruction$qqrp14System@TObjectzc @System@@AfterConstruction$qqrp14System@TObject @System@@ClassDestroy$qqrp14System@TObject @System@@ClassCreate$qqrp17System@TMetaClasso @System@TObject@Dispatch$qqrpv @System@TObject@BeforeDestruction$qqrv @System@TObject@AfterConstruction$qqrv @System@TObject@DefaultHandler$qqrpv @System@TObject@ToString$qqrv @System@TObject@SafeCallException$qqrp14System@TObjectpv @System@TObject@GetHashCode$qqrv @System@TObject@Equals$qqrp14System@TObject @System@TObject@$bdtr$qqrv @System@TObject@$bctr$qqrv @System@TObject@FreeInstance$qqrv @System@TObject@NewInstance$qqrv @System@@FillChar$qqrpvib @System@Move$qqrpxvpvi @$xp$16System@TDateTime @$xp$12System@PByte @$xp$15System@PInteger @$xp$14System@TObject @System@TObject@ @$xp$17System@AnsiString @$xp$13System@string @$xp$9PAnsiChar @$xp$5Int64 @$xp$8Cardinal @$xp$7Pointer @$xp$11System@Word @$xp$11System@Byte @$xp$7Integer @$xp$7Boolean @Sysutils@initialization$qqrv @Sysutils@Finalization$qqrv @Sysutils@StringOf$qqrx25System@%DynamicArray$tuc% @Sysutils@TEncoding@$bcdtr$qqrv @Sysutils@TLanguages@$bcdtr$qqrv @Sysutils@FreeAndNil$qqrpv @Sysutils@Exception@$bcdtr$qqrv @Sysutils@Exception@$bcctr$qqrv @Sysutils@Now$qqrv @Sysutils@StrLen$qqrpxc @Sysutils@ExtractFileName$qqrx20System@UnicodeString @Sysutils@DeleteFile$qqrx20System@UnicodeString @Sysutils@FileExists$qqrx20System@UnicodeString @Sysutils@FileClose$qqri @Sysutils@FileSeek$qqriii @Sysutils@FileWrite$qqripxvui @Sysutils@FileRead$qqripvui @Sysutils@FileCreate$qqrx20System@UnicodeString @Sysutils@FileOpen$qqrx20System@UnicodeStringui @Sysutils@IntToHex$qqrji @Sysutils@IntToStr$qqrj @Sysutils@IntToStr$qqri @Sysutils@CompareMem$qqrpvt1i @Sysutils@TEncoding@$bcctr$qqrv @$xp$15Sysutils@TBytes @Sysutils@TLanguages@$bcctr$qqrv @Classes@initialization$qqrv @Classes@Finalization$qqrv @Classes@TThread@NameThreadForDebugging$qqr27System@%AnsiStringT$us$i0$%ui @Classes@TThread@WaitFor$qqrv @Classes@TThread@Terminate$qqrv @Classes@TThread@DoTerminate$qqrv @Classes@TThread@AfterConstruction$qqrv @Classes@TThread@$bcdtr$qqrv @Classes@TThread@$bdtr$qqrv @Classes@TThread@$bcctr$qqrv @Classes@TThread@$bctr$qqro @$xp$15Classes@TThread @Classes@TThread@ @Typinfo@initialization$qqrv @Typinfo@Finalization$qqrv @Variants@initialization$qqrv @Variants@Finalization$qqrv @Varutils@initialization$qqrv @Varutils@Finalization$qqrv

kernel32

TlsSetValue TlsGetValue TlsFree TlsAlloc LocalFree LocalAlloc FreeLibrary WaitForSingleObject Sleep ReleaseMutex LeaveCriticalSection InitializeCriticalSection GetVersionExW GetFileSize FreeLibrary EnterCriticalSection DeleteCriticalSection CreateMutexW Sleep

packet

PacketIsLoopbackAdapter PacketGetMonitorMode PacketRequest PacketGetReadEvent PacketReceivePacket PacketSendPacket PacketSetMinToCopy PacketSetReadTimeout PacketSetBuff PacketSetHwFilter PacketSetLoopbackBehavior PacketFreePacket PacketInitPacket PacketAllocatePacket PacketCloseAdapter PacketOpenAdapter PacketGetAdapterNames

@$xp$12Ecfifo@TFIFO @$xp$12Ecslv@TSlave @$xp$12Ecslv@TSmCfg @$xp$14Eccmd@TEcatCmd @$xp$14Eccmd@TEcatPdu @$xp$14Eccoe@TEcatCoe @$xp$14Ecfoe@TEcatFoe @$xp$15Ecslv@TEcatFMMU @$xp$16Eccmd@PEcatFrame @$xp$16Eccmd@TEcatFrame @$xp$16Eccoe@POdListRes @$xp$16Eccoe@PUploadExp @$xp$16Eccoe@TOdListReq @$xp$16Eccoe@TOdListRes @$xp$16Eccoe@TUploadExp @$xp$16Eceeprom@TEcatSm @$xp$16Ecfifo@PFifoList @$xp$16Ecfifo@TFifoList @$xp$16Ecmaster@TMaster @$xp$17Eccoe@PObjDescRes @$xp$17Eccoe@PTransAbort @$xp$17Eccoe@TEcatCoeHdr @$xp$17Eccoe@TEcatMbxHdr @$xp$17Eccoe@TEcatSdoHdr @$xp$17Eccoe@TObjDescReq @$xp$17Eccoe@TObjDescRes @$xp$17Eccoe@TSdoInfoHdr @$xp$17Eccoe@TTransAbort @$xp$17Ecwinpcap@PPacket @$xp$17Ecwinpcap@TBpfHdr @$xp$17Ecwinpcap@TPacket @$xp$18Eccoe@TDownloadExp @$xp$18Eceeprom@TEepromOp @$xp$18Ecfoe@TFoeAckFrame @$xp$18Ecwinpcap@PAdapter @$xp$18Ecwinpcap@TAdapter @$xp$19Eccoe@PEntryDescRes @$xp$19Eccoe@TEntryDescReq @$xp$19Eccoe@TEntryDescRes @$xp$19Eccoe@TUploadNormal @$xp$19Ecfoe@TFoeBusyFrame @$xp$19Ecfoe@TFoeDataFrame @$xp$19Ecfoe@TPFoeAckFrame @$xp$19Ecnetdevop@TDevInfo @$xp$20Eceeprom@TEepromCtrl @$xp$20Ecfoe@TFoeErrorFrame @$xp$20Ecfoe@TFoeReadFreame @$xp$20Ecfoe@TPFoeDataFrame @$xp$21Eccmd@TEcatPdu14Bytes @$xp$21Eccoe@TDownloadNormal @$xp$21Ecfoe@TPFoeErrorFrame @$xp$21Ecfoe@TPFoeReadFreame @$xp$21Ecnetdevop@TNetDevOps @$xp$22Eccmd@PEcatFrameCyclic @$xp$22Eccmd@TEcatFrameCyclic @$xp$22Eccoe@PUploadNormalReq @$xp$22Ecnetdevop@PEcatHeader @$xp$22Ecnetdevop@TEcatHeader @$xp$23Eceeprom@TEepromCfgData @$xp$25Ecnetdevop@_TNetDevOps@_1 @$xp$26Eceeprom@TEepromAccessMode @$xp$26Ecwinpcap@PPACKET_OID_DATA @$xp$26Ecwinpcap@TPACKET_OID_DATA @$xp$27Eceeprom@TEepromDescInfoHdr @$xp$30Ecmaster@TMaster@TMasterThread @$xp$35Ecnetdevop@TNetDevOps@TNetDevThread @$xp$38Ecmaster@TMaster@TMasterWatchDogThread @Eccmd@Finalization$qqrv @Eccmd@TEcatCmd@ @Eccmd@TEcatCmd@$bctr$qqrv @Eccmd@TEcatCmd@$bdtr$qqrv @Eccmd@TEcatCmd@EcatCmd$qqrucususpucii @Eccmd@TEcatCmd@EcatCmdApmw$qqrususpuci @Eccmd@TEcatCmd@EcatCmdAprd$qqrususpuci @Eccmd@TEcatCmd@EcatCmdAprw$qqrususpuci @Eccmd@TEcatCmd@EcatCmdApwr$qqrususpuci @Eccmd@TEcatCmd@EcatCmdBrd$qqrususpuci @Eccmd@TEcatCmd@EcatCmdBrw$qqrususpuci @Eccmd@TEcatCmd@EcatCmdBwr$qqrususpuci @Eccmd@TEcatCmd@EcatCmdFpmw$qqrususpuci @Eccmd@TEcatCmd@EcatCmdFprd$qqrususpuci @Eccmd@TEcatCmd@EcatCmdFprw$qqrususpuci @Eccmd@TEcatCmd@EcatCmdFpwr$qqrususpuci @Eccmd@TEcatCmd@EcatCmdLrd$qqruipuci @Eccmd@TEcatCmd@EcatCmdLrw$qqruipuci @Eccmd@TEcatFrame@$bctr$qqrpv @Eccmd@TEcatFrameCyclic@$bctr$qqrpv @Eccmd@TEcatPdu14Bytes@GetNext1bit$qqrv @Eccmd@TEcatPdu14Bytes@GetPduLen11bit$qqrv @Eccmd@TEcatPdu14Bytes@SetNext1bit$qqri @Eccmd@TEcatPdu14Bytes@SetPduLen11bit$qqri @Eccmd@TEcatPdu@GetNext1bit$qqrv @Eccmd@TEcatPdu@GetPduLen11bit$qqrv @Eccmd@TEcatPdu@SetNext1bit$qqri @Eccmd@TEcatPdu@SetPduLen11bit$qqri @Eccmd@initialization$qqrv @Eccoe@Finalization$qqrv @Eccoe@MbxMutex @Eccoe@MbxMutexInitFlag @Eccoe@TDownloadExp@$bctr$qqrpv @Eccoe@TDownloadNormal@$bctr$qqrpv @Eccoe@TEcatCoe@ @Eccoe@TEcatCoe@$bctr$qqri @Eccoe@TEcatCoe@$bdtr$qqrv @Eccoe@TEcatCoe@CheckTransAbort$qqrpuc @Eccoe@TEcatCoe@DownloadExp$qqrusucpuci @Eccoe@TEcatCoe@DownloadNormal$qqrusucpuci @Eccoe@TEcatCoe@DownloadNormal$qqrusucpucii @Eccoe@TEcatCoe@GetEntryDesc$qqrusucpuspi @Eccoe@TEcatCoe@GetLogicInBitSize$qqrv @Eccoe@TEcatCoe@GetLogicOutBitSize$qqrv @Eccoe@TEcatCoe@GetObjDesc$qqruspuspucpc @Eccoe@TEcatCoe@GetOdList$qqruspuspi @Eccoe@TEcatCoe@MbxParamCheck$qqrv @Eccoe@TEcatCoe@MbxParamSet$qqriiii @Eccoe@TEcatCoe@UploadExp$qqrusucpucpi @Eccoe@TEcatCoe@UploadNormal$qqrusucpucpi @Eccoe@TEcatCoeHdr@GetService$qqrv @Eccoe@TEcatCoeHdr@SetService$qqri @Eccoe@TEcatSdoHdr@GetCa$qqrv @Eccoe@TEcatSdoHdr@GetCs$qqrv @Eccoe@TEcatSdoHdr@GetDs$qqrv @Eccoe@TEcatSdoHdr@GetSi$qqrv @Eccoe@TEcatSdoHdr@GetTt$qqrv @Eccoe@TEcatSdoHdr@SetCa$qqri @Eccoe@TEcatSdoHdr@SetCs$qqri @Eccoe@TEcatSdoHdr@SetDs$qqri @Eccoe@TEcatSdoHdr@SetSi$qqri @Eccoe@TEcatSdoHdr@SetTt$qqri @Eccoe@TEntryDescReq@$bctr$qqrpv @Eccoe@TObjDescReq@$bctr$qqrpv @Eccoe@TOdListReq@$bctr$qqrpv @Eccoe@TUploadExp@$bctr$qqrpv @Eccoe@TUploadNormal@$bctr$qqrpv @Eccoe@initialization$qqrv @Ecconst@ErrLogShow$qqr20System@UnicodeString @Ecconst@Finalization$qqrv @Ecconst@LogShow$qqr20System@UnicodeString @Ecconst@initialization$qqrv @Eceeprom@Finalization$qqrv @Eceeprom@TEepromAccessMode@GetCurAccess$qqrv @Eceeprom@TEepromAccessMode@GetEcatAccess$qqrv @Eceeprom@TEepromAccessMode@GetPdiAccessing$qqrv @Eceeprom@TEepromAccessMode@SetCurAccess$qqri @Eceeprom@TEepromAccessMode@SetEcatAccess$qqri @Eceeprom@TEepromCtrl@GetAddrSize$qqrv @Eceeprom@TEepromCtrl@GetBusy$qqrv @Eceeprom@TEepromCtrl@GetBytesSupport$qqrv @Eceeprom@TEepromCtrl@GetCmdErr$qqrv @Eceeprom@TEepromCtrl@GetCrcValid$qqrv @Eceeprom@TEepromCtrl@GetDevInfoValid$qqrv @Eceeprom@TEepromCtrl@GetWrEnErr$qqrv @Eceeprom@TEepromCtrl@SetReadBit$qqri @Eceeprom@TEepromCtrl@SetReloadBit$qqri @Eceeprom@TEepromCtrl@SetWrBit$qqri @Eceeprom@TEepromCtrl@SetWrEn$qqri @Eceeprom@TEepromOp@ @Eceeprom@TEepromOp@$bctr$qqri @Eceeprom@TEepromOp@$bdtr$qqrv @Eceeprom@TEepromOp@CalcCrc$qqrpvi @Eceeprom@TEepromOp@GetEepromCfgData$qqrv @Eceeprom@TEepromOp@GetEepromData$qqrpi @Eceeprom@TEepromOp@GetSmDescInfo$qqrv @Eceeprom@TEepromOp@ReLoad$qqrv @Eceeprom@TEepromOp@ReadBytes$qqripuci @Eceeprom@TEepromOp@ReadCtrlBytes$qqrv @Eceeprom@TEepromOp@ReadDword$qqripi @Eceeprom@TEepromOp@SetAccess$qqri @Eceeprom@TEepromOp@SetEepromData$qqrpus @Eceeprom@TEepromOp@WriteBytes$qqripvi @Eceeprom@TEepromOp@WriteCtrlBytes$qqrv @Eceeprom@TEepromOp@WriteWord$qqripus @Eceeprom@initialization$qqrv @Ecerrinfo@Finalization$qqrv @Ecerrinfo@GetAlErrInfo$qqrui @Ecerrinfo@GetSdoAbortInfo$qqrui @Ecerrinfo@initialization$qqrv @Ecfifo@Finalization$qqrv @Ecfifo@TFIFO@ @Ecfifo@TFIFO@$bctr$qqrv @Ecfifo@TFIFO@$bdtr$qqrv @Ecfifo@TFIFO@Clear$qqrv @Ecfifo@TFIFO@Read$qqrpucuirui @Ecfifo@TFIFO@Write$qqrpucui @Ecfifo@initialization$qqrv @Ecfoe@Finalization$qqrv @Ecfoe@TEcatFoe@ @Ecfoe@TEcatFoe@$bctr$qqri @Ecfoe@TEcatFoe@$bdtr$qqrv @Ecfoe@TEcatFoe@FoeAckReq$qqripucriruio @Ecfoe@TEcatFoe@FoeDataReq$qqripucirui @Ecfoe@TEcatFoe@FoeRead$qqr20System@UnicodeStringuirui @Ecfoe@TEcatFoe@FoeReadReq$qqr27System@%AnsiStringT$us$i0$%uipucrirui @Ecfoe@TEcatFoe@FoeWrite$qqr20System@UnicodeStringuirui @Ecfoe@TEcatFoe@FoeWriteReq$qqr27System@%AnsiStringT$us$i0$%uirui @Ecfoe@TEcatFoe@MbxParamSet$qqriiii @Ecfoe@initialization$qqrv @Ecmaster@Finalization$qqrv @Ecmaster@TMaster@ @Ecmaster@TMaster@$bctr$qqrv @Ecmaster@TMaster@$bdtr$qqrv @Ecmaster@TMaster@SetAllSlavesToInit$qqrv @Ecmaster@TMaster@SetAllSlavesToOP$qqrv @Ecmaster@TMaster@SetAllSlavesToPreOP$qqrv @Ecmaster@TMaster@SetAllSlavesToSafeOP$qqrv @Ecmaster@TMaster@SlavesCntDetect$qqrv @Ecmaster@TMaster@StartCyclicThread$qqrv @Ecmaster@TMaster@StopCyclicThread$qqrv @Ecmaster@TMaster@TMasterThread@ @Ecmaster@TMaster@TMasterThread@$bctr$qqrp16Ecmaster@TMaster @Ecmaster@TMaster@TMasterThread@Execute$qqrv @Ecmaster@TMaster@TMasterWatchDogThread@ @Ecmaster@TMaster@TMasterWatchDogThread@$bctr$qqrp16Ecmaster@TMaster @Ecmaster@TMaster@TMasterWatchDogThread@Execute$qqrv @Ecmaster@TMaster@___SetAllSlavesToOP$qqrv @Ecmaster@initialization$qqrv @Ecnetdevop@Finalization$qqrv @Ecnetdevop@NetDevOps @Ecnetdevop@TEcatHeader@GetFrameLen11bit$qqrv @Ecnetdevop@TEcatHeader@GetProtocol4bit$qqrv @Ecnetdevop@TEcatHeader@GetRes1bit$qqrv @Ecnetdevop@TEcatHeader@SetFrameLen11bit$qqri @Ecnetdevop@TEcatHeader@SetProtocol4bit$qqri @Ecnetdevop@TEcatHeader@SetRes1bit$qqri @Ecnetdevop@TNetDevOps@ @Ecnetdevop@TNetDevOps@$bctr$qqrv @Ecnetdevop@TNetDevOps@$bdtr$qqrv @Ecnetdevop@TNetDevOps@GetAllNetDevInfo$qqrv @Ecnetdevop@TNetDevOps@NetDevClose$qqrv @Ecnetdevop@TNetDevOps@NetDevCyclicRecv$qqrpucuirui @Ecnetdevop@TNetDevOps@NetDevOpen$qqr27System@%AnsiStringT$us$i0$% @Ecnetdevop@TNetDevOps@NetDevRecv$qqrpucuirui @Ecnetdevop@TNetDevOps@NetDevSend$qqrpucui @Ecnetdevop@TNetDevOps@StartRecvThread$qqrv @Ecnetdevop@TNetDevOps@TNetDevThread@ @Ecnetdevop@TNetDevOps@TNetDevThread@$bctr$qqrp21Ecnetdevop@TNetDevOps @Ecnetdevop@TNetDevOps@TNetDevThread@Execute$qqrv @Ecnetdevop@initialization$qqrv @Ecslv@Ec4516SeriesType @Ecslv@EcBLTHeadSeriesType @Ecslv@EcRxBuf @Ecslv@EcRxBufCs @Ecslv@EcTxBuf @Ecslv@EcTxBufCs @Ecslv@Finalization$qqrv @Ecslv@TSlave@ @Ecslv@TSlave@$bctr$qqri @Ecslv@TSlave@$bdtr$qqrv @Ecslv@TSlave@ClearFMMU$qqrv @Ecslv@TSlave@ClearSM$qqrv @Ecslv@TSlave@GetSlaveNameAndVID$qqrv @Ecslv@TSlave@Is4516Series$qqrv @Ecslv@TSlave@IsBLTHeadSeries$qqrv @Ecslv@TSlave@ReadAlState$qqrv @Ecslv@TSlave@ReadErrCode$qqrv @Ecslv@TSlave@ReadRxbuff$qqriipv @Ecslv@TSlave@ReadTxbuff$qqriipv @Ecslv@TSlave@SetInOutDataAddr$qqrpuct1 @Ecslv@TSlave@SetLogicAddr$qqrii @Ecslv@TSlave@SetStateInit$qqrv @Ecslv@TSlave@SetStatePreOP$qqrv @Ecslv@TSlave@SetStateSafeOP$qqrv @Ecslv@TSlave@SetWatchDogTimeOut$qqrus @Ecslv@TSlave@WriteAlCtrl$qqri @Ecslv@TSlave@WriteFMMU$qqrv @Ecslv@TSlave@WriteSM12$qqrv @Ecslv@TSlave@WriteSM34$qqrv @Ecslv@TSlave@WriteTxbuff$qqriipxv @Ecslv@initialization$qqrv @Ecwinpcap@Finalization$qqrv @Ecwinpcap@PacketWordAlign$qqrui @Ecwinpcap@initialization$qqrv @GetPackageInfoTable @Wecprotocol@@GetPackageInfoTable$qqrv @Wecprotocol@@PackageLoad$qqrv @Wecprotocol@@PackageUnload$qqrv @Wecprotocol@initialization$qqrv Finalize Initialize

Name

.text

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3616a3e213d5ccd43e7c120afce31522a23ee294c4bb9b8c359068f638b42824

rtl140.bpl

kernel32

packet

generic