00135425207626826b456daba8023a309467725aab8a18269f47d785f9489435

Sharing

Copy URL Twitter E-mail

General

Target

00135425207626826b456daba8023a309467725aab8a18269f47d785f9489435
Size

352KB
MD5

aa7eb2edc2438e3d522ee5e6e21e40fb
SHA1

d4e37b1041775a509e92c6e8bc53162ec320de2e
SHA256

00135425207626826b456daba8023a309467725aab8a18269f47d785f9489435
SHA512

d71e2c3a831d9acd41d43345968466ceafa79735df033b7cdd0189d4bf7d96581e89b7f7ae3f3f31d0da0b8b828495b63c5cb71afe00cb7261abd0c48424ea21
SSDEEP

6144:TyU/lMZzgHYzUtg9EPN5M1qsKBhcFM6eMhyweNMwsr9C7F9Tnktbc1Qf:Ty4MZzg4zUtgKF6Ys1+6eMElNMdr9CxG

Score

N/A

Malware Config

Signatures

Files

00135425207626826b456daba8023a309467725aab8a18269f47d785f9489435
.dll windows x86

519390911d46e7dad98a931dc098737b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

commmgr

Connect
SetHWnd
SetBaudrate
SetComPort
SetTransMethod
Disconnect
IsConnected
SetBackupTool
BTConnection
SetBTDeviceAddress
BTDisconnection
ClosePortHandle
GetReqTimeout
SetReqTimeout
GetNextSeqNum
??0CGenPacket@@QAE@EEHEGPAEG@Z
PktSend
??1CGenPacket@@UAE@XZ
??0CGenPacket@@QAE@XZ
GetPhoneInfo
PktRead

shlwapi

PathFindExtensionW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsPrefixW
PathFileExistsW
PathFindFileNameW

backupdf

BACKUP_CloseBackupDataFile
BACKUP_WriteBackupFileInfo
BACKUP_ReadBackupFileStream
BACKUP_ReadBackupFileInfo
BACKUP_ReadBackupFileHeader
BACKUP_OpenBakupDataFile
BACKUP_WriteBackupFileHeader
BACKUP_WriteBackupFileStream

mfc42u

ord825
ord2756
ord551
ord3806
ord1971
ord3313
ord665
ord5180
ord354
ord6006
ord3122
ord5647
ord3611
ord350
ord3121
ord3608
ord3658
ord942
ord4199
ord922
ord4124
ord5679
ord6381
ord1197
ord6867
ord1165
ord860
ord1184
ord3696
ord500
ord772
ord6138
ord4197
ord5706
ord925
ord668
ord1972
ord2762
ord356
ord3314
ord2773
ord5857
ord2755
ord6773
ord3176
ord3173
ord539
ord3982
ord3785
ord5438
ord5579
ord6665
ord6149
ord5446
ord6390
ord5436
ord6379
ord2776
ord536
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3948
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord815
ord2717
ord1594
ord6654
ord6655
ord5856
ord2440
ord5830
ord2036
ord1240
ord1194
ord1563
ord1248
ord1250
ord6466
ord1571
ord600
ord826
ord269
ord4272
ord4273
ord823
ord538
ord2910
ord5568
ord541
ord2057
ord6874
ord6139
ord801
ord2810
ord861
ord535
ord540
ord2606
ord537
ord940
ord800
ord858
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord5604

msvcrt

_CxxThrowException
memcpy
wcschr
wcscmp
wcscpy
wcslen
_wtoi
__CxxFrameHandler
sprintf
_itoa
_ftol
_atoi64
strcpy
strlen
memset
_wsplitpath
wcscat
_wcsicmp
wcstok
malloc
wcsncpy
wprintf
_EH_prolog
??1type_info@@UAE@XZ
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
memmove

kernel32

GetLastError
lstrlenW
WideCharToMultiByte
LocalFree
lstrlenA
Sleep
OutputDebugStringW
GetUserDefaultLCID
GetModuleFileNameW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
CloseHandle
CreateDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
MultiByteToWideChar
SetFileTime
SystemTimeToFileTime
CreateFileW
LocalAlloc
InterlockedDecrement
FormatMessageW

user32

IsCharAlphaW
SendMessageW
wsprintfW
IsWindow

ole32

CoUninitialize
CLSIDFromProgID
CoCreateInstance
CoInitialize
OleRun

oleaut32

VariantCopy
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
VariantInit
SysFreeString
SysAllocString
GetErrorInfo

msvcp60

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z

Exports

Exports

CreatePhoneDirectory
TrDll_AddFileInfos
TrDll_AddFolderInfo
TrDll_AddPlaylist
TrDll_AddSoundFileArray
TrDll_BACKUPTOOL_CheckPass
TrDll_BACKUPTOOL_GetBackupfileCount
TrDll_BACKUPTOOL_GetRestorefileCount
TrDll_BACKUPTOOL_InitPhone
TrDll_BACKUPTOOL_Restore
TrDll_BACKUP_Backup
TrDll_BACKUP_BackupInfo
TrDll_BACKUP_Connect
TrDll_BACKUP_ConnectU
TrDll_BACKUP_Disconnect
TrDll_BACKUP_Getlist
TrDll_BTConnection
TrDll_BTDisconnection
TrDll_BackupToolConfig
TrDll_Connect
TrDll_DeletePhoneFile
TrDll_DeletePlaylist
TrDll_Disconnect
TrDll_EditPlaylist
TrDll_GetAllSoundFiles
TrDll_GetExtraMemoryName
TrDll_GetFileAndFolderInfo
TrDll_GetFileManVersion
TrDll_GetList
TrDll_GetModelName
TrDll_GetPlayList
TrDll_GetPlayListContents
TrDll_GetPlayListInfo
TrDll_GetSoundFileTag
TrDll_GetTopList
TrDll_GetTotalSpace
TrDll_Initalize
TrDll_InitalizeU
TrDll_JavaInstaller_Initalize
TrDll_Java_Connect
TrDll_Java_DeleteFile
TrDll_Java_DisConnect
TrDll_Java_InstallCommand
TrDll_Java_IsFileExist
TrDll_Java_SendFile
TrDll_OpenFolder
TrDll_RenamePhoneFile
TrDll_RenamePlaylist
TrDll_ResumfileDownLoad
TrDll_SPP_BTConnect
TrDll_SPP_BTDisconnect
TrDll_SendToPC
TrDll_SendToPhone
TrDll_TransferCancle
TrDll_UpdateFreeSize

Sections

.text
Size: 224KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

519390911d46e7dad98a931dc098737b

Headers

File Characteristics

Imports

commmgr

shlwapi

backupdf

mfc42u

msvcrt

kernel32

user32

ole32

oleaut32

msvcp60

Exports

Exports

Sections

.text Size: 224KB - Virtual size: 222KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 80KB - Virtual size: 87KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 224KB - Virtual size: 222KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 80KB - Virtual size: 87KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 12KB - Virtual size: 10KB