c560a7556e6e966f3e422e570cb992d63b3689ff954553a8314f295846a97fef

Sharing

Copy URL Twitter E-mail

General

Target

c560a7556e6e966f3e422e570cb992d63b3689ff954553a8314f295846a97fef
Size

267KB
MD5

47519c9dfd5636c8d1d8cd0fabdd7f14
SHA1

7a8339fc2f22d92373b6dd9ee19b63ca9c989656
SHA256

c560a7556e6e966f3e422e570cb992d63b3689ff954553a8314f295846a97fef
SHA512

be59b1c430ca93d4292cce5a32e666668d6b909c7d8e24de202793db43fbb1114fd008e2f76a34be16ef5b715ab9ac3e58719e71bd269bf800749549be6b4d35
SSDEEP

6144:WWuqP5A0rKNe1eoQie98eSJblKTeyQlMSQ/rY:WWuqSe1eCe98eSJblKTeyQlM7z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c560a7556e6e966f3e422e570cb992d63b3689ff954553a8314f295846a97fef

Files

c560a7556e6e966f3e422e570cb992d63b3689ff954553a8314f295846a97fef
.dll windows x86

bde5d8583bcce64061560925a8244bd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo

kernel32

InitializeSListHead
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
FreeLibrary
GetProcAddress
LocalFree
GetLastError
GetOverlappedResult
ResetEvent
WaitForSingleObject
WriteFile
ReadFile
CloseHandle
FormatMessageW
CreateEventA
LoadLibraryA
CreateFileA
CancelIo
Sleep
UnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

winmm

timeKillEvent
timeSetEvent

ws2_32

WSACleanup
socket
WSAStartup
select
recv
send
closesocket

vcruntime140

__std_terminate
memmove
_CxxThrowException
__CxxFrameHandler3
_purecall
strchr
__std_exception_copy
__std_exception_destroy
_except_handler4_common
__std_type_info_destroy_list
memcpy
memset
strstr

api-ms-win-crt-string-l1-1-0

strtok
_stricmp
strncmp
isalpha
isspace
isalnum
strncpy
_wcsdup
tolower

api-ms-win-crt-stdio-l1-1-0

putchar
fopen_s
ferror
__acrt_iob_func
fclose
__stdio_common_vsnprintf_s
ftell
fopen
__stdio_common_vfprintf
__stdio_common_vsprintf
fseek
fread
fputc
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
calloc
_callnewh

api-ms-win-crt-convert-l1-1-0

strtol
strtod
_itoa
atoi

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-time-l1-1-0

_time64

Exports

Exports

?CWitmodHid_highPrecisionTimerInit@@YAXXZ
?CWitmodHid_highPrecisionTimerRuning@@YAXK@Z
?CWitmodHid_highPrecisionTimerStart@@YAXXZ
?CWitmodHid_highPrecisionTimerStop@@YAXXZ
CWitmodHid_Close
CWitmodHid_FirmwareUpgrade
CWitmodHid_GetCurrentAutoRippleLightConfig
CWitmodHid_GetCurrentRippleLightColor
CWitmodHid_GetHidAndFirmwareInfoStu
CWitmodHid_GetHidInfoList
CWitmodHid_GetHidInfoStuMapList
CWitmodHid_GetSideCollisionLightRuningConfig
CWitmodHid_GetSupportInfoList
CWitmodHid_HidReadBuff
CWitmodHid_HidWriteBuff
CWitmodHid_Init
CWitmodHid_OpenPath
CWitmodHid_SetKeyboardColorInfoDataStu
CWitmodHid_SetKeyboardColorInfoDataStuHaveChanged
CWitmodHid_SetNonblocking
CWitmodHid_SetSideColorInfoDataStu
CWitmodHid_SetSideColorInfoDataStuHaveChanged
CWitmodHid_highPrecisionTimerInit
CWitmodHid_highPrecisionTimerRuning
CWitmodHid_highPrecisionTimerStart
CWitmodHid_highPrecisionTimerStop
CWitmodHid_keyClickedSendXY
CWitmodHid_keyboardLightColorRuning
CWitmodHid_lightColorMix
CWitmodHid_sideLightColorRuning
CWitmodLight_Init
CWitmodSDK_VersionStr
CWitmodXML_AddKeyOrMouseEventItem
CWitmodXML_AddProFileBindMacroItem
CWitmodXML_AddProFileCustomLightDataInfo
CWitmodXML_AddProFileCustomLightNode
CWitmodXML_AddProFileFunctionInfo
CWitmodXML_AddProFileLightInfoItem
CWitmodXML_AddProFileMacroWithKeyInfoItem
CWitmodXML_AddProFileMacroWithKeyInfoItemStu
CWitmodXML_ClearProFileCustomLightNode
CWitmodXML_CreateMacroXmlParentNode
CWitmodXML_CreateProFileXmlParentNode
CWitmodXML_CreateXMLFile
CWitmodXML_DeleteEventItem
CWitmodXML_DeleteMacroNode
CWitmodXML_DeleteProFileBindMacroNode
CWitmodXML_DeleteProFileCustomLightNode
CWitmodXML_DeleteProFileMacroWithKeyInfoItem
CWitmodXML_DeleteProFileSelectedNode
CWitmodXML_FindCustomIndex
CWitmodXML_GetCreateXMLFileProfileIndex
CWitmodXML_GetProFileFunctionInfo
CWitmodXML_GetProFileIntoSleepTimeInfo
CWitmodXML_GetProFileValueNum
CWitmodXML_Init
CWitmodXML_IsExistenceSelectCustomLightNode
CWitmodXML_IsExistenceSelectMacroNode
CWitmodXML_IsExistenceSelectProfileNode
CWitmodXML_IsProFileAlreadyHaveLightInfo
CWitmodXML_IsProFileCurrentKeyLinkCustomEvent
CWitmodXML_IsSupportHid
CWitmodXML_KeyboardKeyCodeAndCharacterListMapInit
CWitmodXML_KeyboardKeyCodeMatrixInit
CWitmodXML_MacroEventItemUpOrDownOperate
CWitmodXML_ModifyMacroNodeName
CWitmodXML_ModifyProFileCustomLightNodeName
CWitmodXML_ModifyProFileCustomLightNodeUsingStatus
CWitmodXML_ModifyProFileLightInfoItem
CWitmodXML_ModifyProFileLightSynchronizeStatus
CWitmodXML_ModifyProFileLightTypeRuningStatus
CWitmodXML_ModifyProFileMouseLightUsingIndex
CWitmodXML_ModifyProfileNodeInfo
CWitmodXML_ModifyXMLFileProfileIndex
CWitmodXML_OnboardEditMacroWriteDeal
CWitmodXML_ProFileCustomLightInfoSelectAll
CWitmodXML_ProFileCustomLightInfoSelectAll_Using
CWitmodXML_ProFileExport
CWitmodXML_ProFileImport
CWitmodXML_ProFileKeyInfoSelectAll
CWitmodXML_ProFileMacroWithKeyInfoSelectAll
CWitmodXML_ProFilesDataDeal_CustomEventKey
CWitmodXML_ProFilesDataDeal_CustomLightRGB
CWitmodXML_ProFilesDataDeal_LightConfigInfo
CWitmodXML_ProFilesDataDeal_MacrosDataInfo
CWitmodXML_SelectAllKeyOrMouseEvent
CWitmodXML_SelectMacroAllNodes
CWitmodXML_SelectMacroNodeStuDataInfo
CWitmodXML_SelectProFileAllNodes
CWitmodXML_SelectProFileCustomLightAllNodes
CWitmodXML_SelectProFileKeyOperateInfo
CWitmodXML_SelectProFileLightSynchronizeStatus
CWitmodXML_SelectProFileLightTypeRuningStatus
CWitmodXML_SelectProFileMouseLightTypeUsingIndex
CWitmodXML_SelectProfileColorDataInfo
CWitmodXML_SelectProfileNodeInfo
CWitmodXML_SetProFileIntoSleepTimeInfo
CWitmodXML_UpdateEventItem
CWitmodXML_XmlCustomLightInfoSelectAll

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bde5d8583bcce64061560925a8244bd5

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

kernel32

msvcp140

winmm

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 150KB

.rdata Size: 94KB - Virtual size: 94KB

.data Size: 1024B - Virtual size: 11KB

.gfids Size: 512B - Virtual size: 68B

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 151KB - Virtual size: 150KB

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 1024B - Virtual size: 11KB

.gfids
Size: 512B - Virtual size: 68B

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 9KB - Virtual size: 9KB