3723ac92c173bfc87d3517f502f8134faa592f7b6a20925f8737abb07883689e

Sharing

Copy URL Twitter E-mail

General

Target

3723ac92c173bfc87d3517f502f8134faa592f7b6a20925f8737abb07883689e
Size

3.8MB
MD5

1c51dfdc716b528257e8b29e00ab51ba
SHA1

9c160ecaa7f0a1a212780af835ea9a0c13403a99
SHA256

3723ac92c173bfc87d3517f502f8134faa592f7b6a20925f8737abb07883689e
SHA512

b37d1c094ac86edbdca489a8c804e10ba448b1b35fdaa482e34c1467a26f4d0e394479b09eed542244f5e097152cfdf8ee8256b3f3c36403d031393f2beb0a58
SSDEEP

98304:zEq6Wd5hSqhdj8d0GXKJiw64XNg5u6RdeYSRnbq1Z77itvno:g+q6djKAHdYvdnSkZ77itw

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

3723ac92c173bfc87d3517f502f8134faa592f7b6a20925f8737abb07883689e
.dll windows:6 windows x86

7d8421afd13284aa2e0054a575a6bfc0

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/08/2020, 00:00

Not After

30/08/2021, 12:00

Subject

CN=Wuhan SiTuoFu Technology Co.\, Ltd,O=Wuhan SiTuoFu Technology Co.\, Ltd,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

Issuer

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:7d:d2:3f:64:f5:90:88:2b:63:55:eb:42:ca:0d:60:ac:2f:28:9a:c4:09:eb:a3:a0:76:10:a9:58:13:f7:71
Signer

Actual PE Digest

de:7d:d2:3f:64:f5:90:88:2b:63:55:eb:42:ca:0d:60:ac:2f:28:9a:c4:09:eb:a3:a0:76:10:a9:58:13:f7:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mrtcomm

??1CSerialPort@@UAE@XZ
??1CDiskFirmware@@UAE@XZ
?MakeDirectoryEx@CLitCall@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?UIAddLogCheck@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0H@Z
?Close@CSerialPort@@UAEXXZ
?ClearReadBuffer@CSerialPort@@UAEXXZ
?OnCompletion@CSerialPort@@UAEXKKPAU_OVERLAPPED@@@Z
?ClsWorkThreadProc@CSerialPort@@MAEIXZ
?OpenEx@CSerialPort@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPort@@UAEKPAEK@Z
?Close@CSerialPortPro@@UAEXXZ
?ClearReadBuffer@CSerialPortPro@@UAEXXZ
?ClsWorkThreadProc@CSerialPortPro@@MAEIXZ
?OpenEx@CSerialPortPro@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPortPro@@UAEKPAEK@Z
?CancelReadDeviceByFirmware@CDiskFirmware@@UAEXXZ
?HeadMapEnter@CDiskFirmware@@UAEHXZ
?CreateHeadMap@CDiskFirmware@@UAEHPAVKernelFileMapping@@_K1P6AHPAX1@Z2AAE@Z
?SoftResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?HardwareResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?SetPowerStatusByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@EH@Z
??0CDataCenter@@QAE@XZ
??1CDataCenter@@QAE@XZ
?SetBasePath@CDataCenter@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetUserString@CDataCenter@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?SetUserLong@CDataCenter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@J@Z
?UIAddLogs@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?BinaryFind@CLitCall@@SAHPAEH0HH@Z
??0CDiskFirmware@@QAE@PAVCDiskDevice@@@Z
?GetAppPath@CLitCall@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
??0CDefectListLba@@QAE@XZ
??1CDefectListLba@@QAE@XZ
?NewList@CDefectListLba@@QAEXXZ
?UISetProgress@CDiskFirmware@@QAEXH@Z
?AddLba@CDefectListLba@@QAEX_KK@Z
?SaveToFile@CDefectListLba@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?ReadDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?BorderFindByDouble@CDiskFirmware@@QAE_K_K0AAE1@Z
?BorderFindByFast@CDiskFirmware@@QAE_K_K0KEAAE@Z
?GetUserLong@CDataCenter@@QAEJV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?DiskScanTask@CDiskFirmware@@SAHPAV1@PAUStrScanTaskParam@1@@Z
?WriteDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
??1CSerialPortPro@@UAE@XZ

mrtdatabase

??1CDbEncryptFile@@UAE@XZ
??0CDbManagerPage@@QAE@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCDataBaseManager@@PB_WPAUtagMSG@@H@Z
??1CDbFile@@UAE@XZ
??1CDataBaseManager@@UAE@XZ
?GetFilelength@CDbFile@@QAEKXZ
?Open@CDbFile@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HPB_WH@Z
?OpenSourceDb@CDataBaseManager@@QAEHHH@Z
??0CDbPathDlg@@QAE@PAVCDataBaseManager@@PB_WHPAVCWnd@@@Z
?EnumFileInFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$CArray@UDBFileInfo@@AAU1@@@@Z
?CreateFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??1CDbPathDlg@@UAE@XZ
?Write@CDbEncryptFile@@UAEHPAEKH@Z
?Read@CDbEncryptFile@@UAEHPAEKH@Z
?Read@CDbFile@@UAEHPAEKH@Z
?Write@CDbFile@@UAEHPAEKH@Z
??0CDbFile@@QAE@PAVCDataBaseManager@@@Z
??0CDataBaseManager@@QAE@PAVCDriverManager@@PB_W@Z

mrtmange

??0CMrtDocTemplate@@QAE@PAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUDocTemplateExtInfo@0@IPAUCRuntimeClass@@33@Z
?GetThisClass@CMrtBaseDocument@@SGPAUCRuntimeClass@@XZ
??0CMrtBaseDocument@@QAE@XZ
?OnNewDocument@CMrtBaseDocument@@UAEHXZ
?SetMrtInterface@CMrtBaseDocument@@UAEXKPAX@Z
?SwitchMrtInterface@CMrtBaseDocument@@UAEXK@Z
?AppendDataToWindow@CMrtBaseDocument@@UAEXPAUHWND__@@@Z
??1CMrtBaseDocument@@UAE@XZ

mrtuibal

??0CPathDlg@@QAE@XZ
??0CHexEditBase@@QAE@PAVCWnd@@@Z
??1CPathDlg@@QAE@XZ
?OpenDlg@CPathDlg@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUHWND__@@PB_W@Z
??1CReportCtrl@@UAE@XZ
??0CReportCtrl@@QAE@XZ
?SetGridLines@CReportCtrl@@QAEXH@Z
?SetEditable@CReportCtrl@@QAEXH@Z
?SetExtendedStyle@CReportCtrl@@QAEKK@Z
?DeleteAllItems@CReportCtrl@@QAEHK@Z
?SetColumnHeader@CReportCtrl@@QAEHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?InsertItem@CReportCtrl@@QAEHHPB_W@Z
?SetItemText@CReportCtrl@@QAEHHHPB_W@Z
?SetCheck@CReportCtrl@@QAEHHH@Z
?GetItemCount@CReportCtrl@@QBEHK@Z
??1CHexEditBase@@UAE@XZ
?SetShowColumnNum@CHexEditBase@@QAEX_N0@Z
?SetShowAddress@CHexEditBase@@QAEX_N0@Z
?SetShowAscii@CHexEditBase@@QAEX_N0@Z
?SetFontSize@CHexEditBase@@QAEXH@Z
?SetData@CHexEditBase@@QAEXPBEI_N1@Z
?GetData@CHexEditBase@@QAEIPAEI@Z
?SetCheckboxeStyle@CReportCtrl@@QAEXH@Z
?InsertColumn@CReportCtrl@@QAEHHPB_WHHH@Z
??1CToolBarEx@@UAE@XZ
??0CToolBarEx@@QAE@XZ
?LoadToolBarEx@CToolBarEx@@QAEHIPAUHINSTANCE__@@HIII@Z
?SetButton@CToolBarEx@@QAEXHH@Z
?DeleteItem@CReportCtrl@@QAEHHH@Z
?SaveToFile@CHexEditBase@@QAEIV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@II@Z
?OpenFile@CHexEditBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?OnGoto@CHexEditBase@@QAEXXZ
?DecOneColumns@CHexEditBase@@QAEXXZ
?AddOneColumns@CHexEditBase@@QAEXXZ
?OnEditFill@CHexEditBase@@QAEXXZ
?OnEditFind@CHexEditBase@@QAEXXZ
?OnEditFindNext@CHexEditBase@@QAEXXZ
?OnEditCopy@CHexEditBase@@QAEXXZ
?OnEditPaste@CHexEditBase@@QAEXXZ
??1CRichEditCtrlGS@@UAE@XZ
??0CRichEditCtrlGS@@QAE@XZ
?SetColour@CRichEditCtrlGS@@QAEXK@Z
?WriteRTF@CRichEditCtrlGS@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?SetImageList@CReportCtrl@@QAEPAVCImageList@@PAV2@@Z
?SetItemStates@CReportCtrl@@QAEHHK@Z
??1CScanRectWnd@@UAE@XZ
??1CUIBalScanDlg@@UAE@XZ
??1CScanGrapWnd@@UAE@XZ
??0CScanRectWnd@@QAE@XZ
??0CScanGrapWnd@@QAE@XZ
?Init@CScanRectWnd@@QAEXXZ
?Clear@CScanMapData@@QAEXXZ
?AddData@CScanMapData@@QAEX_KK@Z
??0CUIBalScanDlg@@QAE@PAVCWnd@@@Z

mfc140u

ord12560
ord316
ord1046
ord7107
ord458
ord1111
ord7493
ord10472
ord13473
ord9210
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord5228
ord5411
ord5252
ord5790
ord5525
ord9350
ord5760
ord5549
ord5249
ord12168
ord3265
ord3371
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12172
ord8965
ord14588
ord11936
ord3838
ord12089
ord9139
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2760
ord8210
ord3302
ord3305
ord13752
ord6218
ord3164
ord3403
ord3404
ord4092
ord11396
ord11015
ord9040
ord12131
ord7175
ord7511
ord558
ord1151
ord12106
ord9213
ord3940
ord5934
ord13700
ord9237
ord2557
ord4495
ord12180
ord3834
ord12081
ord2761
ord8209
ord13756
ord6220
ord3174
ord8400
ord5033
ord5034
ord6130
ord12460
ord1789
ord7692
ord13709
ord5939
ord13707
ord5938
ord11430
ord5956
ord8831
ord9352
ord11802
ord11795
ord5369
ord3843
ord4587
ord11495
ord10402
ord3191
ord11797
ord1692
ord5422
ord4477
ord5427
ord13225
ord12921
ord12220
ord6129
ord9209
ord6549
ord1476
ord1002
ord1133
ord2990
ord8754
ord14137
ord8360
ord2383
ord8746
ord4227
ord6607
ord3932
ord4225
ord9132
ord5984
ord6589
ord1180
ord2215
ord2526
ord8067
ord13337
ord1659
ord4885
ord14377
ord5173
ord5850
ord14657
ord12405
ord14604
ord2378
ord12348
ord6751
ord13257
ord13254
ord974
ord1450
ord484
ord1131
ord13471
ord3359
ord3237
ord6801
ord1405
ord3833
ord9468
ord2304
ord503
ord1144
ord4715
ord4735
ord8177
ord5590
ord5307
ord12763
ord500
ord1142
ord11962
ord14606
ord2885
ord5112
ord306
ord1689
ord5583
ord5109
ord5176
ord4886
ord12559
ord6973
ord5111
ord1653
ord3846
ord4664
ord3362
ord3246
ord6825
ord1433
ord13901
ord6901
ord2886
ord2268
ord2374
ord485
ord4323
ord555
ord1186
ord2405
ord11951
ord8188
ord5569
ord8800
ord2881
ord432
ord1093
ord11949
ord437
ord1097
ord2879
ord501
ord1143
ord4093
ord6316
ord3075
ord3069
ord4817
ord13253
ord1003
ord1477
ord13260
ord293
ord1532
ord1693
ord12884
ord13966
ord5886
ord12351
ord5887
ord5586
ord2991
ord309
ord5922
ord4666
ord7501
ord14065
ord12964
ord9212
ord10251
ord5765
ord3849
ord4703
ord12660
ord12418
ord13352
ord2843
ord7655
ord2558
ord8395
ord13832
ord2858
ord5609
ord6199
ord9081
ord3857
ord11024
ord11267
ord9197
ord12786
ord5577
ord12575
ord11252
ord9484
ord2718
ord12093
ord4138
ord4088
ord14511
ord5377
ord5368
ord10431
ord10721
ord11138
ord11139
ord9363
ord11743
ord9979
ord7137
ord7504
ord511
ord1149
ord930
ord1076
ord12123
ord9301
ord10504
ord12859
ord6300
ord4466
ord13319
ord1815
ord8773
ord13940
ord14239
ord14234
ord11581
ord12793
ord13028
ord8817
ord12711
ord1928
ord9226
ord3173
ord2680
ord6876
ord5027
ord5026
ord5029
ord5025
ord5024
ord12176
ord12088
ord13754
ord6219
ord8304
ord11275
ord11278
ord9509
ord9524
ord9514
ord9986
ord9991
ord9526
ord11117
ord8920
ord8912
ord11746
ord9528
ord11122
ord9011
ord11146
ord10047
ord10048
ord7787
ord7378
ord914
ord1408
ord968
ord1447
ord7626
ord2945
ord13628
ord13804
ord13806
ord6268
ord13800
ord2865
ord11000
ord12216
ord11021
ord9042
ord8977
ord11235
ord11333
ord10570
ord11169
ord11932
ord11935
ord11933
ord11934
ord6309
ord6249
ord6248
ord5110
ord6559
ord3882
ord6566
ord2522
ord13944
ord5580
ord277
ord8712
ord540
ord1171
ord3869
ord3182
ord8225
ord5037
ord8062
ord13649
ord7379
ord924
ord1411
ord7627
ord4108
ord10498
ord9225
ord3054
ord9253
ord12217
ord3238
ord2594
ord2172
ord266
ord265
ord4815
ord1526
ord1525
ord1511
ord296
ord1523
ord1045
ord280
ord1513
ord1654
ord5921
ord285
ord3009
ord6501
ord13960
ord1067
ord360
ord2246
ord286
ord1141
ord2385
ord2389
ord1452
ord7820
ord14405
ord3697

kernel32

lstrcpynW
GetLastError
DeleteCriticalSection
TerminateProcess
ExitProcess
InitializeCriticalSectionEx
EnterCriticalSection
GetCurrentProcess
LeaveCriticalSection
OutputDebugStringW
QueryPerformanceCounter
DeviceIoControl
GetProcAddress
GetModuleHandleW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ResumeThread
SuspendThread
WaitForSingleObject
TerminateThread
GetTickCount
Sleep
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetClientRect
GetWindowRect
MessageBoxW
SetWindowTextW
GetClassNameW
GetWindow
PostMessageW
GetParent
SetTimer
GetSubMenu
GetCursorPos
LoadMenuW
SendMessageW
EnableWindow
wsprintfW
LoadIconW
CheckMenuItem
InvalidateRect
KillTimer
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetStockObject
GetObjectW
CreateFontW

shell32

SHGetFileInfoW
ShellExecuteW

comctl32

ImageList_ReplaceIcon

shlwapi

PathIsDirectoryW

oleaut32

VariantClear

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

_purecall
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
memcpy
_CxxThrowException
memmove

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

wcstoul
_wcstoi64
_wcstoui64

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
wcsftime

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_invalid_parameter_noinfo
_errno

api-ms-win-crt-math-l1-1-0

_except1
_libm_sse2_sin_precise

Exports

Exports

??0CDataBaseManager@@QAE@ABV0@@Z
??0CDataCenter@@QAE@ABV0@@Z
??0CDataStore@@QAE@ABV0@@Z
??0CDbEncryptFile@@QAE@ABV0@@Z
??0CDbFile@@QAE@ABV0@@Z
??0CDiskFirmware@@QAE@ABV0@@Z
??0CPathDlg@@QAE@ABV0@@Z
??0CSerialPort@@QAE@ABV0@@Z
??0CSerialPortPro@@QAE@ABV0@@Z
??1CSerialException@@UAE@XZ
??4CDataBaseManager@@QAEAAV0@ABV0@@Z
??4CDataCenter@@QAEAAV0@ABV0@@Z
??4CDataStore@@QAEAAV0@ABV0@@Z
??4CDbEncryptFile@@QAEAAV0@ABV0@@Z
??4CDbFile@@QAEAAV0@ABV0@@Z
??4CDiskFirmware@@QAEAAV0@ABV0@@Z
??4CLitCall@@QAEAAV0@ABV0@@Z
??4CPathDlg@@QAEAAV0@ABV0@@Z
??4CSerialPort@@QAEAAV0@ABV0@@Z
??4CSerialPortPro@@QAEAAV0@ABV0@@Z
??BCSerialPort@@QBEPAXXZ
??_7CDataBaseManager@@6B@
??_7CDbEncryptFile@@6B@
??_7CDbFile@@6B@
??_7CDiskFirmware@@6B@
??_7CSerialPort@@6B@
??_7CSerialPortPro@@6B@
??_FCHexEditBase@@QAEXXZ
??_FCUIBalScanDlg@@QAEXXZ
?GetBytesPerRow@CHexEditBase@@QAEIXZ
?GetDataBuffer@CHexEditBase@@QBEPAEXZ
?GetDataSize@CHexEditBase@@QBEIXZ
?IsModified@CHexEditBase@@QBEHXZ
?IsOpen@CSerialPort@@QBEHXZ
?OnExtendContextMenu@CHexEditBase@@UAEXAAVCMenu@@@Z
?SetContextCopyStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetContextPasteStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetModifiedFlag@CHexEditBase@@QAEXH@Z
?WM_UM_SEARCHDATACOMPELE@CDbExplorerPage@@2IB
?WM_UM_WRITECHAR@CSerialPort@@1IB
MrtCommonSystem

Sections

.text
Size: - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d8421afd13284aa2e0054a575a6bfc0

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:abCertificate

Extended Key Usages

Key Usages

de:7d:d2:3f:64:f5:90:88:2b:63:55:eb:42:ca:0d:60:ac:2f:28:9a:c4:09:eb:a3:a0:76:10:a9:58:13:f7:71Signer

Headers

DLL Characteristics

File Characteristics

Imports

mrtcomm

mrtdatabase

mrtmange

mrtuibal

mfc140u

kernel32

user32

gdi32

shell32

comctl32

shlwapi

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 364KB

.rdata Size: - Virtual size: 148KB

.data Size: - Virtual size: 4KB

.gfids Size: - Virtual size: 32B

.tls Size: - Virtual size: 9B

.vmp0 Size: - Virtual size: 1.8MB

.vmp1 Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 28KB - Virtual size: 1.1MB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2
Certificate

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

1e:b1:32:d5:08:9c:51:ab
Certificate

de:7d:d2:3f:64:f5:90:88:2b:63:55:eb:42:ca:0d:60:ac:2f:28:9a:c4:09:eb:a3:a0:76:10:a9:58:13:f7:71
Signer

.text
Size: - Virtual size: 364KB

.rdata
Size: - Virtual size: 148KB

.data
Size: - Virtual size: 4KB

.gfids
Size: - Virtual size: 32B

.tls
Size: - Virtual size: 9B

.vmp0
Size: - Virtual size: 1.8MB

.vmp1
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 28KB - Virtual size: 1.1MB