f7c672b93671b1ef9df8ceb20740d37384949769c097be48860aee8f74fd317a

Sharing

Copy URL Twitter E-mail

General

Target

f7c672b93671b1ef9df8ceb20740d37384949769c097be48860aee8f74fd317a
Size

429KB
MD5

96022727e8f2e9d4a5be5d4e7a276fe9
SHA1

f27a444982cfb637c7d9e0298dd9d9fc587d1819
SHA256

f7c672b93671b1ef9df8ceb20740d37384949769c097be48860aee8f74fd317a
SHA512

89f1aa1ed2be9b9ad67e924fc5157eb54a60f8967e7de1b4bacdddd6a5e09d1f1eb39d901d354d68a88bb37646af762efa715576dd0eebc31262a89a8ddcdbf7
SSDEEP

12288:RPVQpmtulpp6uG03vAMgQXPxCaSm9PGHK+umxu9aI+R8+B/un8xLhNEKjpfmCkVe:RdQpmtulpp6uG03vAMgQXrOrwieIt61m

Score

1^/10

Malware Config

Signatures

Files

f7c672b93671b1ef9df8ceb20740d37384949769c097be48860aee8f74fd317a
.dll windows x86

79cd894fcbb567e7dae37023f7377bad

Code Sign

46:14:36:dd:0d:93:0d:d9:3f:21:98:a4:5a:4f:84:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/03/2019, 00:00

Not After

11/03/2022, 23:59

Subject

CN=Huawei Technologies Co.\, Ltd.,O=Huawei Technologies Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:9a:ed:45:bd:ca:4b:28:d3:c4:bc:72:81:ea:9f:6b:5a:8a:dd:f4:05:68:be:71:74:93:eb:a7:00:fa:5c:32
Signer

Actual PE Digest

06:9a:ed:45:bd:ca:4b:28:d3:c4:bc:72:81:ea:9f:6b:5a:8a:dd:f4:05:68:be:71:74:93:eb:a7:00:fa:5c:32

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

tup_os_adapter

TUP_Utf8ToLocale
TUP_StrMemFree
VTOP_PthreadJoin
VTOP_PthreadCreate
VTOP_PthreadSetName
VTOP_SleepMs
VTOP_CreateRelTimerM
VTOP_StartRelTimer
VTOP_StopRelTimer_Safe
VTOP_FreeRelTimer
VTOP_MemFreeD
VTOP_StrLen
VTOP_StrStr
TUP_Utf8ToUnicodeW
TUP_UnicodeToUtf8
VTOP_MemMallocD
VTOP_MutexInitRecursive
VTOP_StrrChr
VTOP_GetCwd
VTOP_OpenDir
VTOP_CloseDir
VTOP_ReadDir_S
VTOP_MkDir
VTOP_Access
VTOP_Remove
VTOP_Rename
VTOP_Fopen
VTOP_Fflush
VTOP_Fclose
VTOP_Fprintf
VTOP_Fseek
VTOP_Ftell
VTOP_MutexDestroy
VTOP_MutexLock
VTOP_StrCmp
VTOP_InetAddr
VTOP_GetSystemTime
VTOP_GetLastSocketErr
VTOP_GetLastErr
VTOP_MutexUnLock
VTOP_MemMallocS

securec

memset_s
strcpy_s
strncpy_s
sprintf_s
strcat_s
strncat_s
strtok_s
snprintf_s
memcpy_s
vsprintf_s
vswprintf_s

hme-audio

HME_VqeSetParamPath
HME_SetJitterBufParams
HME_GetRemoteRtcpReports
HME_GetChannelStatistics
HME_GetRecAndPlayStats
HME_GetVQMResult
HME_SetAPPDataCallBack
HME_EnableRTCP
HME_StopRecordingAll
HME_PauseRecordingAll
HME_StartRecordingAll
HME_StopRecordingMicrophone
HME_StartRecordingMicrophone
HME_StopRecording
HME_PauseRecording
HME_StartRecording
HME_StopPlayingFileToRemote
HME_PlayPCMToRemote
HME_StopPlayingFile
HME_PlayPCM_StartDevice
HME_PlayPCM_CreateIndex
HME_PlayPCM
HME_SetChannelInputVolumeScale
HME_GetChannelOutputVolumeScale
HME_SetChannelOutputVolumeScale
HME_GetSpeakerVolumeScale
HME_SetSpeakerVolumeScale
HME_GetMicVolumeScale
HME_SetMicVolumeScale
HME_GetOutputLevel
HME_GetInputLevel
HME_GetWaveOutMute
HME_SetWaveOutMute
HME_EnumOutputDevices
HME_GetOutputDeviceNum
HME_EnumInputDevices
HME_RegKeyLogCallback
HME_SetLogFile
HME_GetVersion
HME_GetLastError
HME_GetErrorExplain
HME_SetSampleTracePoint
HME_SetSampleTraceStatus
HME_EnableSampleTraceDuration
HME_GetSampleTraceStatus
HME_AudioDataHook_Register
HME_AudioDataHook_UnRegister
HME_NotifyCallBack_Register
HME_Init
HME_Terminate
HME_SetParam
HME_CreateChannelEx
HME_DeleteChannel
HME_SetSendTransport
HME_PacketRecvEX
HME_GetCodecInfor
HME_GetNofCodecs
HME_SetSendCodec
HME_SetRecvPayloadType
HME_GetRecvCodec
HME_SetRTPTimeStampFormat
HME_StartListen
HME_StopListen
HME_StartPlayout
HME_StopPlayout
HME_StartSend
HME_StopSend
HME_SetChannelMute
HME_SetDTMFPayloadType
HME_SendDTMF
HME_SetDTMFFeedbackStatus
HME_SetNetATEParams
HME_GetNetATEParams
HME_SetRedundancyPT
HME_SetConferenceStatus
HME_EnableSRTPSend
HME_DisableSRTPSend
HME_EnableSRTPReceive
HME_DisableSRTPReceive
HME_EnableSRTPSendMKI
HME_DisableSRTPSendMKI
HME_EnableSRTPRecvMKI
HME_DisableSRTPRecvMKI
HME_SetUpVqeStatus
HME_GetUpVqeStatus
HME_SetDownVqeStatus
HME_GetdownVqeStatus
HME_SetAudioVqeMode
HME_EnableVoiceDetect
HME_External_Recording_SendData
HME_Open_BGM_Share
HME_Close_BGM_Share
HME_SetAudioDeviceParams
HME_EnableAudioEngine
HME_SetSpeakerVolume
HME_GetSpeakerVolume
HME_SetSpeakerMute
HME_GetSpeakerMute
HME_SetMicVolume
HME_GetMicVolume
HME_SetMicMute
HME_GetMicMute
HME_SetInputDevices
HME_SetOutputDevices
HME_GetInputDeviceNum
HME_EnableHowlingCheck

traffic

TcDeleteFilter
TcEnumerateInterfaces
TcOpenInterfaceW
TcCloseInterface
TcDeleteFlow
TcAddFlow
TcAddFilter
TcDeregisterClient
TcRegisterClient

ws2_32

htonl
socket
htons
inet_ntoa
setsockopt
ntohl
sendto
select
ntohs
__WSAFDIsSet
bind
closesocket
ioctlsocket
getsockopt
recvfrom

tup_track

MediaTrack_AddHmeErrorInfo
MediaTrack_AddAudioErrStatic
MediaTrack_AddAudioGlobalIndex
MediaTrack_AddAudioVqeMode
MediaTrack_AddAudioMuteStatus
track_media_error
Track_KeyLog
MediaTrack_AudioDotData

kernel32

GetLastError
WaitForSingleObject
CreateThread
TerminateThread
GetModuleFileNameW
GetPrivateProfileStringW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetModuleFileNameA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
CloseHandle
InitializeSListHead

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_terminate
memset
_CxxThrowException
__CxxFrameHandler3
memcpy
strchr
strrchr
strstr
memmove
__std_exception_copy
_purecall
__std_exception_destroy
_except_handler4_common
__std_type_info_destroy_list
__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_register_onexit_function
_crt_at_quick_exit
_cexit
_initialize_onexit_table
_initterm
_initterm_e
_initialize_narrow_environment
_crt_atexit
_invalid_parameter_noinfo_noreturn
_errno
_configure_narrow_argv
terminate
_seh_filter_dll

api-ms-win-crt-convert-l1-1-0

_wtoi
atoi

api-ms-win-crt-filesystem-l1-1-0

_splitpath

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-math-l1-1-0

_except1

Exports

Exports

MMAAddMutiCast
MMAClose
MMACloseChannel
MMACloseMutiCast
MMAConnectTC
MMADisConnectTC
MMADisableSrtpRecv
MMADisableSrtpSend
MMADoHmeNotify
MMAEnableAutoTest
MMAEnableChipEncrypt
MMAEnableHookFrames
MMAEnableSecsInfo
MMAEnableSrtpInfo
MMAEnableUpDownSpeed
MMAEnableVoiceDetect
MMAExit
MMAGetAudioMode
MMAGetAudioPktRedNumInStg
MMAGetChannel
MMAGetChannelStatis
MMAGetClockRate
MMAGetCodecCaps
MMAGetDeviceCaps
MMAGetDeviceVolumeScale
MMAGetDeviveStatus
MMAGetDownEqParams
MMAGetIPAddr
MMAGetIndex
MMAGetInputRoute
MMAGetMicDevMute
MMAGetMicInputLevel
MMAGetMicrophoneVolume
MMAGetNumCodecs
MMAGetNumDevices
MMAGetOutputRoute
MMAGetRecvPacketNum
MMAGetRouting
MMAGetRtcpUseRtpPortFlag
MMAGetSpeakerOutLevel
MMAGetSpeakerVolume
MMAGetSpkDevMute
MMAGetTCLog
MMAGetUpEqParams
MMAGetVersion
MMAGetWaveoutMute
MMAInit
MMAInitTunnel
MMALogSwitch
MMAModifyDevice
MMAModifyLocalPort
MMAModifyTrans
MMAModifyVolume
MMAMutePacket
MMAOpen
MMAOpenChannel
MMAOpenMutiCast
MMAPausePlayFileConf
MMAPlayFile
MMAPlayFileConf
MMAPlayFileEx
MMAPostClose
MMAPreOpen
MMARecordEx
MMARecordFileEx
MMARecordPause
MMARecordStart
MMARecordStop
MMAReleaseIndex
MMARemoveMutiCast
MMAResetOutputDevice
MMASelectMutiCast
MMASendAudioMix
MMASendAudioMixData
MMASetAecParams
MMASetAiModelParam
MMASetAllDecParams
MMASetAnr
MMASetAudioDeviceParams
MMASetAudioFec
MMASetAudioMixCallback
MMASetAudioMixState
MMASetAudioPktRedNumInStg
MMASetAudioPlayDelay
MMASetAudioPreviewMode
MMASetAudioTraceDuration
MMASetAudioTraceSwitch
MMASetAudioVqeModel
MMASetBoardAudioOptimize
MMASetCallback
MMASetChannelDownMix
MMASetChannelUpMix
MMASetClientKeepAlive
MMASetCloseWait
MMASetConfMute
MMASetDeviceVolumeScale
MMASetDotdataCollectDuration
MMASetDownAudioANR
MMASetDownAudioDisableVqeAgc
MMASetDownEqParams
MMASetEnabeAudioEngine
MMASetEnableAudioRoute
MMASetEnableECPkt
MMASetExtCaptureInput
MMASetGlobalMute
MMASetH460Type
MMASetHowlingCheck
MMASetHowlingControl
MMASetIcpClientAddr
MMASetInputRoute
MMASetJitBufParams
MMASetLinkType
MMASetLocalAddr
MMASetLocalAudioLoop
MMASetLog
MMASetMicDevMute
MMASetMicrophoneVolume
MMASetMixing
MMASetMultiplexMode
MMASetMutiCastCodec
MMASetMutiCastTimeout
MMASetNetAte
MMASetNetInterval
MMASetNetworkType
MMASetOpenSLESMode
MMASetOutSoundChannel
MMASetOutputRoute
MMASetProductType
MMASetQosInfo
MMASetRecordAllCallback
MMASetRecordCallBack
MMASetRecvMultiplexMode
MMASetRecvPacketNum
MMASetRedunLevel
MMASetRemoteAddr
MMASetRmtAudioLoop
MMASetRouting
MMASetRtcpUseRtpPortFlag
MMASetRtpBwLimitMode
MMASetSendEmptyAudioPktEnable
MMASetSendQos
MMASetSpeakerVolume
MMASetSpkDevMute
MMASetTouseRedPtValueSwitch
MMASetUpAudioDisableVqe
MMASetUpAudioTNR
MMASetUpAudioVAD
MMASetUpEqParams
MMASetVoipEncDec
MMASetVqeVersion
MMASetWaveoutMute
MMAShareBGM
MMAStart
MMAStartDevicetoPlayPCM
MMAStgBindSubTunnel
MMAStgInitSubTunnel
MMAStgUninitSubTunnel
MMAStop
MMAStopPlayFileConf
MMATraceSample
MMATriggerDTMF
MMAUpdateChanParams
MMAUpdateHmeLogParams
MMAUpdateLogParams

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79cd894fcbb567e7dae37023f7377bad

Code Sign

46:14:36:dd:0d:93:0d:d9:3f:21:98:a4:5a:4f:84:89Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

06:9a:ed:45:bd:ca:4b:28:d3:c4:bc:72:81:ea:9f:6b:5a:8a:dd:f4:05:68:be:71:74:93:eb:a7:00:fa:5c:32Signer

Headers

DLL Characteristics

File Characteristics

Imports

tup_os_adapter

securec

hme-audio

traffic

ws2_32

tup_track

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 340KB - Virtual size: 339KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 1024B - Virtual size: 15KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 23KB - Virtual size: 23KB

46:14:36:dd:0d:93:0d:d9:3f:21:98:a4:5a:4f:84:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

06:9a:ed:45:bd:ca:4b:28:d3:c4:bc:72:81:ea:9f:6b:5a:8a:dd:f4:05:68:be:71:74:93:eb:a7:00:fa:5c:32
Signer

.text
Size: 340KB - Virtual size: 339KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 1024B - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 23KB - Virtual size: 23KB