4025cdef4f68c2f7bcc0ca71d130c580aebfe071e2e073fd1641af1416463287

Sharing

Copy URL Twitter E-mail

General

Target

4025cdef4f68c2f7bcc0ca71d130c580aebfe071e2e073fd1641af1416463287
Size

3.9MB
MD5

196b5f0dd2fb2875b24eb592cc3317a2
SHA1

8cbcd549b7c2a1fc421003ad30c35d6d2229c4d7
SHA256

4025cdef4f68c2f7bcc0ca71d130c580aebfe071e2e073fd1641af1416463287
SHA512

b153fda4ae637cb9da095b0f890ff4ee98464302331a7cf624794e8ac45c770f1847bd62dd8d0c0027697d9fa2b503547838035552facadd977e2d3cd3eda77e
SSDEEP

98304:2BBxxAyYKK2J6KPEugL2rcg7UPzSqdl9rXbQE1dDcmamY:2BBnAyYP2IKPE1L2rYzSqdlmE1umE

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

4025cdef4f68c2f7bcc0ca71d130c580aebfe071e2e073fd1641af1416463287
.dll windows:6 windows x86

1ee32d0ea4a7478c35e860ae89d57f59

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/08/2020, 00:00

Not After

30/08/2021, 12:00

Subject

CN=Wuhan SiTuoFu Technology Co.\, Ltd,O=Wuhan SiTuoFu Technology Co.\, Ltd,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

Issuer

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:e5:03:c9:f0:a4:ff:a8:26:9b:aa:bd:6d:ce:ed:15:5c:1f:2c:4c:fd:7b:52:97:34:b5:8c:40:33:b9:cf:72
Signer

Actual PE Digest

ac:e5:03:c9:f0:a4:ff:a8:26:9b:aa:bd:6d:ce:ed:15:5c:1f:2c:4c:fd:7b:52:97:34:b5:8c:40:33:b9:cf:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

drfile

?GetAddrAt@CFileTran@@QAEPAE_KPA_K@Z
??0CFileTran@@QAE@ABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@K_K1@Z

mrtcomm

??1CSerialPort@@UAE@XZ
??1CSerialPortPro@@UAE@XZ
??1CDiskFirmware@@UAE@XZ
?Close@CSerialPort@@UAEXXZ
?ClearReadBuffer@CSerialPort@@UAEXXZ
?OnCompletion@CSerialPort@@UAEXKKPAU_OVERLAPPED@@@Z
?ClsWorkThreadProc@CSerialPort@@MAEIXZ
?OpenEx@CSerialPort@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPort@@UAEKPAEK@Z
?Close@CSerialPortPro@@UAEXXZ
?ClearReadBuffer@CSerialPortPro@@UAEXXZ
?ClsWorkThreadProc@CSerialPortPro@@MAEIXZ
?OpenEx@CSerialPortPro@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPortPro@@UAEKPAEK@Z
?CancelReadDeviceByFirmware@CDiskFirmware@@UAEXXZ
?HeadMapEnter@CDiskFirmware@@UAEHXZ
?CreateHeadMap@CDiskFirmware@@UAEHPAVKernelFileMapping@@_K1P6AHPAX1@Z2AAE@Z
?SoftResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?HardwareResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?SetPowerStatusByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@EH@Z
??0CDataCenter@@QAE@XZ
??1CDataCenter@@QAE@XZ
?WriteCharAnsy@CSerialPort@@QAEHD@Z
?GetUserString@CDataCenter@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?SetFlowControl@CSerialPort@@QAEXKAAU_DCB@@@Z
?GetClipboardText@CLitCall@@SAXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetNotifiMsg@CSerialPort@@QAEXPAUHWND__@@I@Z
?WriteDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?ReadDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?SetVoltage@CSerialPort@@QAEHK@Z
?GetVoltage@CSerialPort@@QAEKXZ
?SetState@CSerialPort@@QAEXAAU_DCB@@@Z
?GetState@CSerialPort@@QAEXAAU_DCB@@@Z
?ExitSerialPortBinary@CSerialPortPro@@QAEHXZ
?EnterSerialPortBinary@CSerialPortPro@@QAEHXZ
?SetReadTimeout@CSerialPortPro@@QAEXK@Z
?GetReadTimeout@CSerialPortPro@@QAEKXZ
?ClearCommBuffer@CSerialPortPro@@QAEXXZ
?BinaryFind@CLitCall@@SAHPAEH0HH@Z
?WritePort@CSerialPort@@QAEHPAEKK@Z
?UISetProgress@CDiskFirmware@@QAEXH@Z
?UIAddLogCheck@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0H@Z
?GetAppPath@CLitCall@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
??0CDiskFirmware@@QAE@PAVCDiskDevice@@@Z
?UIAddLogs@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?Split@CLitCall@@SAHAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@AAVCStringArray@@@Z
?SetTimeouts@CSerialPort@@QAEXAAU_COMMTIMEOUTS@@@Z
?GetUserLong@CDataCenter@@QAEJV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?EnumSerialPorts@CLitCall@@SAXAAV?$CArray@USSerInfo@CLitCall@@AAU12@@@H@Z
?MakeDirectoryEx@CLitCall@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetUserLong@CDataCenter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@J@Z
?SetBasePath@CDataCenter@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z

mrtdatabase

?StartThread@CDataBaseManager@@QAEHP6AKPAX0@Z00@Z
?SearchData@CDataBaseManager@@SAHPAV1@PAUStrFindParm@1@@Z
??0CDbManagerPage@@QAE@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCDataBaseManager@@PB_WPAUtagMSG@@H@Z
?GetFilelength@CDbFile@@QAEKXZ
?Open@CDbFile@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HPB_WH@Z
??0CDbFile@@QAE@PAVCDataBaseManager@@@Z
??0CDataBaseManager@@QAE@PAVCDriverManager@@PB_W@Z
??1CDataBaseManager@@UAE@XZ
??1CDbFile@@UAE@XZ
??1CDbEncryptFile@@UAE@XZ
??1CDbPathDlg@@UAE@XZ
?OpenSourceDb@CDataBaseManager@@QAEHHH@Z
?CreateFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0CDbPathDlg@@QAE@PAVCDataBaseManager@@PB_WHPAVCWnd@@@Z
?Read@CDbFile@@UAEHPAEKH@Z
?Write@CDbFile@@UAEHPAEKH@Z
?Read@CDbEncryptFile@@UAEHPAEKH@Z
?Write@CDbEncryptFile@@UAEHPAEKH@Z
?EnumFileInFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$CArray@UDBFileInfo@@AAU1@@@@Z
?GetProfBuf@CDbFile@@QAEPAEAAK@Z

mrtmange

??0CMrtDocTemplate@@QAE@PAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUDocTemplateExtInfo@0@IPAUCRuntimeClass@@33@Z
??1CMrtBaseDocument@@UAE@XZ
?GetThisClass@CMrtBaseDocument@@SGPAUCRuntimeClass@@XZ
??0CMrtBaseDocument@@QAE@XZ
?OnNewDocument@CMrtBaseDocument@@UAEHXZ
?SetMrtInterface@CMrtBaseDocument@@UAEXKPAX@Z
?AppendDataToWindow@CMrtBaseDocument@@UAEXPAUHWND__@@@Z
?SwitchMrtInterface@CMrtBaseDocument@@UAEXK@Z

mrtuibal

?SetShowAddress@CHexEditBase@@QAEX_N0@Z
?SetShowColumnNum@CHexEditBase@@QAEX_N0@Z
??1CHexEditBase@@UAE@XZ
?SetAddressSize@CHexEditBase@@QAEXE_N@Z
?SetBytesPerRow@CHexEditBase@@QAEXI_N0@Z
?SetData@CHexEditBase@@QAEXPBEI_N1@Z
??1CToolBarEx@@UAE@XZ
?GetItemCount@CReportCtrl@@QBEHK@Z
??0CToolBarEx@@QAE@XZ
?LoadToolBarEx@CToolBarEx@@QAEHIPAUHINSTANCE__@@HIII@Z
?SetButton@CToolBarEx@@QAEXHH@Z
?SetEditable@CReportCtrl@@QAEXH@Z
?SetShowAscii@CHexEditBase@@QAEX_N0@Z
??1CReportCtrl@@UAE@XZ
?DeleteItem@CReportCtrl@@QAEHHH@Z
?GetData@CHexEditBase@@QAEIPAEI@Z
?SaveToFile@CHexEditBase@@QAEIV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@II@Z
?OnGoto@CHexEditBase@@QAEXXZ
?DecOneColumns@CHexEditBase@@QAEXXZ
?AddOneColumns@CHexEditBase@@QAEXXZ
?OnEditFill@CHexEditBase@@QAEXXZ
?OnEditFind@CHexEditBase@@QAEXXZ
?OnEditFindNext@CHexEditBase@@QAEXXZ
?OnEditCopy@CHexEditBase@@QAEXXZ
?OnEditPaste@CHexEditBase@@QAEXXZ
??1CRichEditCtrlGS@@UAE@XZ
??0CRichEditCtrlGS@@QAE@XZ
?SetColour@CRichEditCtrlGS@@QAEXK@Z
??0CHexEditBase@@QAE@PAVCWnd@@@Z
??0CReportCtrl@@QAE@XZ
?SetGridLines@CReportCtrl@@QAEXH@Z
?SetExtendedStyle@CReportCtrl@@QAEKK@Z
?WriteRTF@CRichEditCtrlGS@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?SetImageList@CReportCtrl@@QAEPAVCImageList@@PAV2@@Z
?SortItems@CReportCtrl@@QAEXHH@Z
?SetColumnHeader@CReportCtrl@@QAEHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?OpenFile@CHexEditBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0CPathDlg@@QAE@XZ
??1CPathDlg@@QAE@XZ
?OpenDlg@CPathDlg@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUHWND__@@PB_W@Z
?DeleteAllItems@CReportCtrl@@QAEHK@Z
?InsertItem@CReportCtrl@@QAEHHPB_W@Z
?SetItemText@CReportCtrl@@QAEHHHPB_W@Z
?SetItemBkColor@CReportCtrl@@QAEXHHKH@Z
?SetCheck@CReportCtrl@@QAEHHH@Z

mfc140u

ord8744
ord4222
ord3147
ord6220
ord13756
ord2761
ord9128
ord12220
ord6129
ord9209
ord6497
ord1476
ord1002
ord1070
ord3697
ord5422
ord4477
ord5427
ord2383
ord8746
ord4227
ord6607
ord3932
ord4225
ord9132
ord5984
ord6589
ord1180
ord2215
ord2526
ord8754
ord8067
ord13337
ord4885
ord14377
ord5173
ord5850
ord13225
ord14657
ord12405
ord14604
ord2378
ord12348
ord6751
ord1530
ord1692
ord12921
ord14137
ord1689
ord7175
ord7511
ord558
ord1151
ord12106
ord9213
ord3940
ord5934
ord13700
ord9237
ord2557
ord4495
ord12180
ord3834
ord12081
ord8209
ord3174
ord8400
ord5033
ord5034
ord6130
ord12460
ord1789
ord7692
ord13709
ord5939
ord13707
ord5938
ord11430
ord5956
ord8831
ord9352
ord11802
ord11795
ord5369
ord3843
ord4587
ord11495
ord10402
ord3191
ord11797
ord3849
ord500
ord1142
ord11962
ord14606
ord2885
ord5886
ord12351
ord5112
ord306
ord484
ord1131
ord14234
ord13961
ord13254
ord5882
ord3359
ord3237
ord6801
ord1405
ord3833
ord9468
ord12584
ord4664
ord8360
ord974
ord1450
ord503
ord1144
ord4715
ord4735
ord8177
ord5583
ord5586
ord13544
ord13654
ord5307
ord5590
ord5887
ord2886
ord7820
ord2268
ord2374
ord485
ord4886
ord13028
ord8817
ord8757
ord4323
ord555
ord1186
ord432
ord1093
ord11949
ord437
ord1097
ord2405
ord11951
ord8188
ord5569
ord1659
ord8800
ord2881
ord2879
ord2477
ord1687
ord12090
ord290
ord2304
ord2479
ord4817
ord13258
ord13257
ord3010
ord305
ord5922
ord5118
ord300
ord310
ord1533
ord1697
ord2991
ord14408
ord8759
ord6978
ord2996
ord3846
ord12763
ord12884
ord14404
ord2750
ord8345
ord4663
ord8712
ord1532
ord498
ord501
ord1143
ord6225
ord4093
ord6316
ord5582
ord12765
ord5117
ord12559
ord1527
ord7501
ord14065
ord12964
ord261
ord9212
ord10251
ord5765
ord4703
ord12660
ord12418
ord13352
ord2843
ord7655
ord2558
ord8395
ord13832
ord2858
ord5609
ord6199
ord9081
ord3857
ord11024
ord11267
ord9197
ord12786
ord5577
ord12575
ord11252
ord9484
ord2718
ord12093
ord4138
ord4088
ord14511
ord5377
ord5368
ord10431
ord10721
ord11138
ord11139
ord9363
ord2993
ord9979
ord2257
ord7137
ord7504
ord511
ord1149
ord930
ord1076
ord12123
ord9301
ord10504
ord12859
ord6300
ord4466
ord13319
ord1815
ord8773
ord13940
ord14239
ord5954
ord3961
ord364
ord4143
ord11581
ord12793
ord12711
ord1928
ord9226
ord3173
ord2680
ord6876
ord5027
ord5026
ord5029
ord5025
ord5024
ord12176
ord12088
ord13754
ord6219
ord8304
ord11275
ord11278
ord9509
ord9524
ord9514
ord9986
ord9991
ord9526
ord11117
ord8920
ord8912
ord11746
ord9528
ord11122
ord9011
ord11146
ord10047
ord10048
ord7787
ord7378
ord914
ord1408
ord968
ord1447
ord7626
ord13628
ord13804
ord13806
ord6268
ord13800
ord6249
ord11000
ord12216
ord11021
ord9042
ord8977
ord11235
ord11333
ord10570
ord11169
ord11932
ord11935
ord11933
ord11934
ord6309
ord293
ord5110
ord6248
ord1653
ord5109
ord2945
ord6559
ord3882
ord6566
ord2522
ord13944
ord5580
ord277
ord540
ord1171
ord3869
ord3182
ord8225
ord6894
ord13646
ord7891
ord5813
ord4881
ord8719
ord7379
ord924
ord1411
ord7627
ord5037
ord9225
ord3054
ord9253
ord12217
ord3238
ord4108
ord10498
ord2594
ord7391
ord6815
ord1424
ord7654
ord509
ord4094
ord5319
ord5371
ord13438
ord9039
ord11014
ord5962
ord6499
ord365
ord4091
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord5249
ord5549
ord5760
ord9350
ord5525
ord5790
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10255
ord9210
ord13473
ord10472
ord7493
ord1111
ord458
ord7107
ord1046
ord316
ord12560
ord5111
ord1654
ord5921
ord285
ord3009
ord6501
ord2246
ord286
ord1141
ord2385
ord2389
ord1452
ord14405
ord2990
ord2172
ord266
ord265
ord4815
ord1526
ord1525
ord1511
ord296
ord1523
ord1045
ord280
ord1513
ord3872
ord12131
ord9040
ord11015
ord11396
ord4092
ord3404
ord3403
ord3164
ord6218
ord13752
ord3305
ord3302
ord8210
ord2760
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord11936
ord14588
ord8965

kernel32

GetProcAddress
DeviceIoControl
QueryPerformanceCounter
GetTickCount
GetCurrentProcess
GetModuleHandleW
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionEx
CreateFileW
ExitProcess
FlushViewOfFile
GetLastError
CloseHandle
FindNextFileW
FindClose
FreeLibrary
LoadLibraryW
FindResourceW
SizeofResource
LoadResource
LockResource
GetModuleFileNameW
MultiByteToWideChar
GetFileAttributesW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FindFirstFileW
OutputDebugStringW
ResumeThread
SuspendThread
TerminateThread
WaitForSingleObject
UnmapViewOfFile
Sleep
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindow
GetWindowRect
MessageBoxW
SetWindowTextW
GetClientRect
GetMenuItemCount
DeleteMenu
InsertMenuW
GetMenu
GetMenuItemID
GetCursorPos
LoadIconW
CreatePopupMenu
AppendMenuW
CheckMenuItem
SetForegroundWindow
GetMessagePos
ScreenToClient
GetDC
TranslateMessage
KillTimer
SetTimer
GetParent
PostMessageW
EnableWindow
LoadMenuW
SendMessageW
wsprintfW
GetSubMenu
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetTextMetricsW
CreateFontW
GetStockObject
GetObjectW
CreateFontIndirectW

shell32

ShellExecuteW

comctl32

ImageList_ReplaceIcon

shlwapi

PathIsDirectoryW

oleaut32

VariantClear

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

imm32

ImmAssociateContext

vcruntime140

memmove
_purecall
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
memcpy
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

_wcstoui64
wcstol
wcstoul

api-ms-win-crt-time-l1-1-0

_localtime64_s
wcsftime
_time64

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_configure_narrow_argv
_cexit
_invalid_parameter_noinfo
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
terminate
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

wcscat_s
wcscpy_s

api-ms-win-crt-math-l1-1-0

_except1
_libm_sse2_sin_precise

Exports

Exports

??0CDataBaseManager@@QAE@ABV0@@Z
??0CDataCenter@@QAE@ABV0@@Z
??0CDataStore@@QAE@ABV0@@Z
??0CDbEncryptFile@@QAE@ABV0@@Z
??0CDbFile@@QAE@ABV0@@Z
??0CDiskFirmware@@QAE@ABV0@@Z
??0CPathDlg@@QAE@ABV0@@Z
??0CSerialPort@@QAE@ABV0@@Z
??0CSerialPortPro@@QAE@ABV0@@Z
??1CSerialException@@UAE@XZ
??4CDataBaseManager@@QAEAAV0@ABV0@@Z
??4CDataCenter@@QAEAAV0@ABV0@@Z
??4CDataStore@@QAEAAV0@ABV0@@Z
??4CDbEncryptFile@@QAEAAV0@ABV0@@Z
??4CDbFile@@QAEAAV0@ABV0@@Z
??4CDiskFirmware@@QAEAAV0@ABV0@@Z
??4CLitCall@@QAEAAV0@ABV0@@Z
??4CPathDlg@@QAEAAV0@ABV0@@Z
??4CSerialPort@@QAEAAV0@ABV0@@Z
??4CSerialPortPro@@QAEAAV0@ABV0@@Z
??8CFileTran@@QBEHABV0@@Z
??9CFileTran@@QBEHABV0@@Z
??ACFileTran@@QAEAAE_K@Z
??BCFileTran@@QBEHXZ
??BCSerialPort@@QBEPAXXZ
??_7CDataBaseManager@@6B@
??_7CDbEncryptFile@@6B@
??_7CDbFile@@6B@
??_7CDiskFirmware@@6B@
??_7CSerialPort@@6B@
??_7CSerialPortPro@@6B@
??_FCFileTran@@QAEXXZ
??_FCHexEditBase@@QAEXXZ
?GameOver@CFileTran@@AAEHXZ
?GetAt@CFileTran@@QAEE_K@Z
?GetBytesPerRow@CHexEditBase@@QAEIXZ
?GetCurrentPage@CFileTran@@QBE_KXZ
?GetDataBuffer@CHexEditBase@@QBEPAEXZ
?GetDataSize@CHexEditBase@@QBEIXZ
?INVALID_ID@CFileTran@@2IB
?IsModified@CHexEditBase@@QBEHXZ
?IsOpen@CSerialPort@@QBEHXZ
?IsValid@CFileTran@@QBEHXZ
?OnExtendContextMenu@CHexEditBase@@UAEXAAVCMenu@@@Z
?SetContextCopyStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetContextPasteStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetModifiedFlag@CHexEditBase@@QAEXH@Z
?WM_UM_SEARCHDATACOMPELE@CDbExplorerPage@@2IB
?WM_UM_WRITECHAR@CSerialPort@@1IB
?btDefault@?1???ACFileTran@@QAEAAE_K@Z@4EA
MrtCommonSystem

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 868KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ee32d0ea4a7478c35e860ae89d57f59

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:abCertificate

Extended Key Usages

Key Usages

ac:e5:03:c9:f0:a4:ff:a8:26:9b:aa:bd:6d:ce:ed:15:5c:1f:2c:4c:fd:7b:52:97:34:b5:8c:40:33:b9:cf:72Signer

Headers

DLL Characteristics

File Characteristics

Imports

drfile

mrtcomm

mrtdatabase

mrtmange

mrtuibal

mfc140u

kernel32

user32

gdi32

shell32

comctl32

shlwapi

oleaut32

msvcp140

imm32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 216KB

.data Size: - Virtual size: 12KB

.gfids Size: - Virtual size: 32B

.tls Size: - Virtual size: 9B

.vmp0 Size: - Virtual size: 1.8MB

.vmp1 Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 868KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2
Certificate

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

1e:b1:32:d5:08:9c:51:ab
Certificate

ac:e5:03:c9:f0:a4:ff:a8:26:9b:aa:bd:6d:ce:ed:15:5c:1f:2c:4c:fd:7b:52:97:34:b5:8c:40:33:b9:cf:72
Signer

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 216KB

.data
Size: - Virtual size: 12KB

.gfids
Size: - Virtual size: 32B

.tls
Size: - Virtual size: 9B

.vmp0
Size: - Virtual size: 1.8MB

.vmp1
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 868KB