b5b12bac32991a5de14576fc91796c18846606e639dc67770875ccaee8f1b33d

Sharing

Copy URL Twitter E-mail

General

Target

b5b12bac32991a5de14576fc91796c18846606e639dc67770875ccaee8f1b33d
Size

6.4MB
MD5

b8943111e470369ac33428ba9ec88060
SHA1

b7cb4698d2654f4205c65cc7d153935b179fa4c3
SHA256

b5b12bac32991a5de14576fc91796c18846606e639dc67770875ccaee8f1b33d
SHA512

21fce132dcb75ade25843795638c4b2a7bf378fc5cfeecc69fb7e54f2066c3f9f4c992c2e6787965d268b0802743ab1abfdf366021b5b5b8b841adfb071ce5a1
SSDEEP

98304:roFXUvvUVIwUxh8K/OWyUptvKQLsm4Wd/GTKp9x3BsG550TNxSzhJrTqG+lOkbNy:cFXUHSghUU6QLsm4WRTghDA5ml/8

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

b5b12bac32991a5de14576fc91796c18846606e639dc67770875ccaee8f1b33d
.dll windows:6 windows x86

3004e3fd727dce9d30e27abdaa194454

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/08/2020, 00:00

Not After

30/08/2021, 12:00

Subject

CN=Wuhan SiTuoFu Technology Co.\, Ltd,O=Wuhan SiTuoFu Technology Co.\, Ltd,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

Issuer

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:37:de:07:2c:87:e9:0d:10:12:45:62:e8:e2:3f:45:13:2f:bc:1b:a1:0c:b7:8e:c8:b9:87:ec:e4:8e:ee:8a
Signer

Actual PE Digest

8e:37:de:07:2c:87:e9:0d:10:12:45:62:e8:e2:3f:45:13:2f:bc:1b:a1:0c:b7:8e:c8:b9:87:ec:e4:8e:ee:8a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

drfile

?GetAddrAt@CFileTran@@QAEPAE_KPA_K@Z
??0CFileTran@@QAE@ABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@K_K1@Z

mrtcomm

??1CSerialPort@@UAE@XZ
??1CSerialPortPro@@UAE@XZ
??1CDiskFirmware@@UAE@XZ
?Close@CSerialPort@@UAEXXZ
?ClearReadBuffer@CSerialPort@@UAEXXZ
?OnCompletion@CSerialPort@@UAEXKKPAU_OVERLAPPED@@@Z
?ClsWorkThreadProc@CSerialPort@@MAEIXZ
?OpenEx@CSerialPort@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPort@@UAEKPAEK@Z
?Close@CSerialPortPro@@UAEXXZ
?ClearReadBuffer@CSerialPortPro@@UAEXXZ
?ClsWorkThreadProc@CSerialPortPro@@MAEIXZ
?OpenEx@CSerialPortPro@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPortPro@@UAEKPAEK@Z
?CancelReadDeviceByFirmware@CDiskFirmware@@UAEXXZ
?HeadMapEnter@CDiskFirmware@@UAEHXZ
?CreateHeadMap@CDiskFirmware@@UAEHPAVKernelFileMapping@@_K1P6AHPAX1@Z2AAE@Z
?SoftResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?HardwareResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?SetPowerStatusByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@EH@Z
??0CDataCenter@@QAE@XZ
??1CDataCenter@@QAE@XZ
?SetBasePath@CDataCenter@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetUserLong@CDataCenter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@J@Z
?UIAddLogs@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?UISetProgress@CDiskFirmware@@QAEXH@Z
?EnumSerialPorts@CLitCall@@SAXAAV?$CArray@USSerInfo@CLitCall@@AAU12@@@H@Z
?GetUserLong@CDataCenter@@QAEJV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetTimeouts@CSerialPort@@QAEXAAU_COMMTIMEOUTS@@@Z
?SetUserString@CDataCenter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?GetUserString@CDataCenter@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?MakeDirectoryEx@CLitCall@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?UIAddLogCheck@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0H@Z
?StopMonitoring@CSerialPort@@QAEXXZ
?SetState@CSerialPort@@QAEXAAU_DCB@@@Z
?SetFlowControl@CSerialPort@@QAEXKAAU_DCB@@@Z
?GetState@CSerialPort@@QAEXAAU_DCB@@@Z
?WriteDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?ReadDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?DiskScanTask@CDiskFirmware@@SAHPAV1@PAUStrScanTaskParam@1@@Z
?GetAppPath@CLitCall@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?WritePortByChar@CSerialPort@@QAEHPAEK@Z
?ClearWriteBuffer@CSerialPort@@QAEXXZ
?WritePort@CSerialPort@@QAEHPAEKK@Z
??0CDiskFirmware@@QAE@PAVCDiskDevice@@@Z
?StartMonitoring@CSerialPort@@QAEHXZ
?ClearError@CSerialPort@@QAEHAAK@Z
?Setup@CSerialPort@@QAEHKK@Z
?Purge@CSerialPort@@QAEHK@Z

mrtdatabase

??0CDbFile@@QAE@PAVCDataBaseManager@@@Z
??0CDbManagerPage@@QAE@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCDataBaseManager@@PB_WPAUtagMSG@@H@Z
?GetFilelength@CDbFile@@QAEKXZ
?Open@CDbFile@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HPB_WH@Z
??1CDbFile@@UAE@XZ
??1CDbEncryptFile@@UAE@XZ
?Read@CDbFile@@UAEHPAEKH@Z
?Write@CDbFile@@UAEHPAEKH@Z
?Read@CDbEncryptFile@@UAEHPAEKH@Z
?Write@CDbEncryptFile@@UAEHPAEKH@Z
??1CDbPathDlg@@UAE@XZ
??1CDataBaseManager@@UAE@XZ
?OpenSourceDb@CDataBaseManager@@QAEHHH@Z
??0CDataBaseManager@@QAE@PAVCDriverManager@@PB_W@Z
?EnumFileInFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$CArray@UDBFileInfo@@AAU1@@@@Z
??0CDbFileDlg@@QAE@PAVCDataBaseManager@@PB_WHHPAVCWnd@@@Z
??1CDbFileDlg@@UAE@XZ
??0CDbPathDlg@@QAE@PAVCDataBaseManager@@PB_WHPAVCWnd@@@Z
?CreateFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z

mrtmange

??0CMrtDocTemplate@@QAE@PAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUDocTemplateExtInfo@0@IPAUCRuntimeClass@@33@Z
??1CMrtBaseDocument@@UAE@XZ
?GetThisClass@CMrtBaseDocument@@SGPAUCRuntimeClass@@XZ
??0CMrtBaseDocument@@QAE@XZ
?OnNewDocument@CMrtBaseDocument@@UAEHXZ
?SetMrtInterface@CMrtBaseDocument@@UAEXKPAX@Z
?SwitchMrtInterface@CMrtBaseDocument@@UAEXK@Z
?AppendDataToWindow@CMrtBaseDocument@@UAEXPAUHWND__@@@Z

mrtuibal

??0CHexEditBase@@QAE@PAVCWnd@@@Z
??0CUIBalScanDlg@@QAE@PAVCWnd@@@Z
??1CReportCtrl@@UAE@XZ
??0CReportCtrl@@QAE@XZ
?SetGridLines@CReportCtrl@@QAEXH@Z
?SetExtendedStyle@CReportCtrl@@QAEKK@Z
?SetColumnHeader@CReportCtrl@@QAEHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?InsertItem@CReportCtrl@@QAEHHPB_W@Z
?SetItemText@CReportCtrl@@QAEHHHPB_W@Z
??0CPathDlg@@QAE@XZ
??1CPathDlg@@QAE@XZ
?OpenDlg@CPathDlg@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUHWND__@@PB_W@Z
?GetItemCount@CReportCtrl@@QBEHK@Z
?SetCheck@CReportCtrl@@QAEHHH@Z
??0CScanRectWnd@@QAE@XZ
??0CScanGrapWnd@@QAE@XZ
?Init@CScanRectWnd@@QAEXXZ
?DeleteAllItems@CReportCtrl@@QAEHK@Z
?Clear@CScanMapData@@QAEXXZ
?AddData@CScanMapData@@QAEX_KK@Z
??1CHexEditBase@@UAE@XZ
??1CToolBarEx@@UAE@XZ
?SetShowColumnNum@CHexEditBase@@QAEX_N0@Z
?SetShowAddress@CHexEditBase@@QAEX_N0@Z
?SetShowAscii@CHexEditBase@@QAEX_N0@Z
?SetData@CHexEditBase@@QAEXPBEI_N1@Z
??1CRichEditCtrlGS@@UAE@XZ
?OpenFile@CHexEditBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SaveToFile@CHexEditBase@@QAEIV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@II@Z
?GetData@CHexEditBase@@QAEIPAEI@Z
?AddOneColumns@CHexEditBase@@QAEXXZ
?DecOneColumns@CHexEditBase@@QAEXXZ
?OnEditFind@CHexEditBase@@QAEXXZ
?OnEditFindNext@CHexEditBase@@QAEXXZ
?OnGoto@CHexEditBase@@QAEXXZ
?OnEditCopy@CHexEditBase@@QAEXXZ
?OnEditPaste@CHexEditBase@@QAEXXZ
?SetItemData@CReportCtrl@@QAEHHK@Z
?SetItemBkColor@CReportCtrl@@QAEXHHKH@Z
??0CToolBarEx@@QAE@XZ
??0CRichEditCtrlGS@@QAE@XZ
?LoadToolBarEx@CToolBarEx@@QAEHIPAUHINSTANCE__@@HIII@Z
?GetItemData@CReportCtrl@@QBEKH@Z
?SetBytesPerRow@CHexEditBase@@QAEXI_N0@Z
?SetDataNewSize@CHexEditBase@@QAEHKE@Z
?SetColour@CRichEditCtrlGS@@QAEXK@Z
?WriteRTF@CRichEditCtrlGS@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?SetButton@CToolBarEx@@QAEXHH@Z
??1CScanRectWnd@@UAE@XZ
??1CUIBalScanDlg@@UAE@XZ
??1CScanGrapWnd@@UAE@XZ

mfc140u

ord1111
ord7493
ord10472
ord13473
ord9210
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord5228
ord5411
ord5252
ord5790
ord5525
ord9350
ord5760
ord5549
ord5249
ord12168
ord3265
ord3371
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12172
ord8965
ord14588
ord11936
ord3838
ord12089
ord9139
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2760
ord8210
ord3302
ord3305
ord13752
ord6218
ord3164
ord3403
ord3404
ord4092
ord11396
ord11015
ord9040
ord12131
ord5427
ord7175
ord7511
ord558
ord1151
ord12106
ord9213
ord3940
ord5934
ord13700
ord9237
ord2557
ord4495
ord12180
ord3834
ord12081
ord2761
ord8209
ord13756
ord6220
ord3174
ord8400
ord5033
ord5034
ord6130
ord12460
ord1789
ord7692
ord13709
ord5939
ord13707
ord5938
ord11430
ord5956
ord8831
ord9352
ord11802
ord11795
ord5369
ord3843
ord4587
ord11495
ord10402
ord3191
ord11797
ord2383
ord14657
ord12405
ord14604
ord2378
ord12348
ord6751
ord3872
ord2993
ord8744
ord4222
ord3147
ord9128
ord12220
ord6129
ord9209
ord6497
ord1476
ord1002
ord1070
ord3697
ord8754
ord3849
ord8746
ord4227
ord6607
ord3932
ord5422
ord4477
ord2215
ord2526
ord4885
ord14377
ord5173
ord5850
ord13225
ord1692
ord12921
ord13471
ord5425
ord13260
ord1003
ord1477
ord6486
ord2304
ord3882
ord6566
ord2522
ord8773
ord3957
ord5110
ord1689
ord501
ord1143
ord4093
ord6316
ord503
ord1144
ord4715
ord4735
ord8177
ord5590
ord5307
ord5887
ord2886
ord4663
ord8360
ord2268
ord2374
ord485
ord12884
ord8712
ord4817
ord974
ord500
ord1142
ord11962
ord2885
ord7860
ord13258
ord13257
ord290
ord3010
ord305
ord300
ord5922
ord5112
ord5118
ord310
ord458
ord1532
ord1534
ord4666
ord14408
ord281
ord2996
ord4664
ord8757
ord3359
ord3237
ord6801
ord1405
ord9468
ord3833
ord5109
ord7378
ord914
ord1408
ord7626
ord4466
ord13319
ord2945
ord6559
ord12793
ord13028
ord8817
ord13944
ord12559
ord5580
ord11000
ord12216
ord11021
ord9042
ord8977
ord11235
ord11333
ord10570
ord11169
ord11932
ord11935
ord11933
ord11934
ord6309
ord277
ord7379
ord924
ord1411
ord1928
ord7627
ord4886
ord5037
ord9225
ord3054
ord9253
ord12217
ord3238
ord4108
ord10498
ord2594
ord14606
ord12584
ord4323
ord432
ord1093
ord437
ord1097
ord2405
ord11949
ord11951
ord8188
ord5569
ord2881
ord8800
ord2879
ord484
ord1131
ord2463
ord13961
ord3069
ord2461
ord4324
ord1530
ord1533
ord1531
ord1700
ord1697
ord3847
ord498
ord5886
ord12351
ord7501
ord14065
ord12964
ord9212
ord10251
ord5765
ord4703
ord12660
ord12418
ord13352
ord2843
ord7655
ord2558
ord8395
ord13832
ord2858
ord5609
ord6199
ord9081
ord3857
ord11024
ord11267
ord9197
ord12786
ord5577
ord12575
ord11252
ord9484
ord2718
ord12093
ord4138
ord4088
ord14511
ord5377
ord5368
ord10431
ord10721
ord11138
ord11139
ord9363
ord11743
ord9979
ord7137
ord7504
ord511
ord1149
ord930
ord1076
ord12123
ord10504
ord12859
ord6300
ord1815
ord13940
ord14239
ord14234
ord5954
ord3961
ord11581
ord9301
ord12711
ord9226
ord3173
ord2680
ord6876
ord5027
ord5026
ord5029
ord5025
ord5024
ord12176
ord12088
ord13754
ord6219
ord8304
ord11275
ord11278
ord9509
ord9524
ord9514
ord9986
ord9991
ord9526
ord11117
ord8920
ord8912
ord11746
ord9528
ord11122
ord9011
ord11146
ord10047
ord10048
ord7787
ord968
ord1447
ord13628
ord13804
ord6268
ord13800
ord13806
ord6249
ord4225
ord9132
ord5984
ord6589
ord1180
ord8067
ord5583
ord2753
ord14573
ord3874
ord2994
ord8745
ord4224
ord3189
ord9131
ord6588
ord1179
ord13654
ord13544
ord7027
ord5882
ord7820
ord6248
ord3068
ord14405
ord2990
ord2172
ord266
ord265
ord4815
ord1526
ord1525
ord1511
ord296
ord1523
ord1045
ord280
ord1513
ord7107
ord1046
ord316
ord12560
ord5111
ord1654
ord5921
ord285
ord3009
ord6501
ord13960
ord1067
ord360
ord2246
ord286
ord1141
ord2385
ord2389
ord306
ord1452
ord1450

kernel32

OutputDebugStringW
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetModuleHandleW
GetProcAddress
DeviceIoControl
QueryPerformanceCounter
GetTickCount
GetCurrentProcess
ResumeThread
FlushViewOfFile
UnmapViewOfFile
GetModuleFileNameW
InitializeCriticalSectionEx
FindFirstFileW
FindNextFileW
FindClose
FreeLibrary
LoadLibraryW
FindResourceW
SizeofResource
LoadResource
SuspendThread
TerminateThread
WaitForSingleObject
LockResource
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindowRect
GetMenuItemCount
GetParent
InvalidateRect
EnableWindow
SendMessageW
LoadMenuW
GetCursorPos
GetSubMenu
LoadBitmapW
GetClientRect
PostMessageW
SetWindowTextW
SetTimer
KillTimer
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetStockObject
CreateFontW
GetObjectW

shell32

SHGetFileInfoW
ShellExecuteW

shlwapi

PathFileExistsW
PathIsDirectoryW

oleaut32

VariantClear

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

vcruntime140

_purecall
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
memcpy
_CxxThrowException
memmove

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

wcstol
_wcstoui64
atoi
wcstoul

api-ms-win-crt-time-l1-1-0

wcsftime
_time64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_crt_atexit
terminate
_seh_filter_dll
_configure_narrow_argv
_execute_onexit_table
_initialize_onexit_table
_register_onexit_function
_cexit

api-ms-win-crt-string-l1-1-0

wcscpy_s
wcscat_s

api-ms-win-crt-math-l1-1-0

_except1
_libm_sse2_sin_precise

Exports

Exports

??0CDataBaseManager@@QAE@ABV0@@Z
??0CDataCenter@@QAE@ABV0@@Z
??0CDataStore@@QAE@ABV0@@Z
??0CDbEncryptFile@@QAE@ABV0@@Z
??0CDbFile@@QAE@ABV0@@Z
??0CDiskFirmware@@QAE@ABV0@@Z
??0CPathDlg@@QAE@ABV0@@Z
??0CSerialPort@@QAE@ABV0@@Z
??0CSerialPortPro@@QAE@ABV0@@Z
??1CSerialException@@UAE@XZ
??4CDataBaseManager@@QAEAAV0@ABV0@@Z
??4CDataCenter@@QAEAAV0@ABV0@@Z
??4CDataStore@@QAEAAV0@ABV0@@Z
??4CDbEncryptFile@@QAEAAV0@ABV0@@Z
??4CDbFile@@QAEAAV0@ABV0@@Z
??4CDiskFirmware@@QAEAAV0@ABV0@@Z
??4CLitCall@@QAEAAV0@ABV0@@Z
??4CPathDlg@@QAEAAV0@ABV0@@Z
??4CSerialPort@@QAEAAV0@ABV0@@Z
??4CSerialPortPro@@QAEAAV0@ABV0@@Z
??8CFileTran@@QBEHABV0@@Z
??9CFileTran@@QBEHABV0@@Z
??ACFileTran@@QAEAAE_K@Z
??BCFileTran@@QBEHXZ
??BCSerialPort@@QBEPAXXZ
??_7CDataBaseManager@@6B@
??_7CDbEncryptFile@@6B@
??_7CDbFile@@6B@
??_7CDiskFirmware@@6B@
??_7CSerialPort@@6B@
??_7CSerialPortPro@@6B@
??_FCFileTran@@QAEXXZ
??_FCHexEditBase@@QAEXXZ
??_FCUIBalScanDlg@@QAEXXZ
?GameOver@CFileTran@@AAEHXZ
?GetAt@CFileTran@@QAEE_K@Z
?GetBytesPerRow@CHexEditBase@@QAEIXZ
?GetCurrentPage@CFileTran@@QBE_KXZ
?GetDataBuffer@CHexEditBase@@QBEPAEXZ
?GetDataSize@CHexEditBase@@QBEIXZ
?INVALID_ID@CFileTran@@2IB
?IsModified@CHexEditBase@@QBEHXZ
?IsOpen@CSerialPort@@QBEHXZ
?IsValid@CFileTran@@QBEHXZ
?OnExtendContextMenu@CHexEditBase@@UAEXAAVCMenu@@@Z
?SetContextCopyStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetContextPasteStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetModifiedFlag@CHexEditBase@@QAEXH@Z
?WM_UM_SEARCHDATACOMPELE@CDbExplorerPage@@2IB
?WM_UM_WRITECHAR@CSerialPort@@1IB
?btDefault@?1???ACFileTran@@QAEAAE_K@Z@4EA
MrtCommonSystem

Sections

.text
Size: - Virtual size: 797KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 13.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3004e3fd727dce9d30e27abdaa194454

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:abCertificate

Extended Key Usages

Key Usages

8e:37:de:07:2c:87:e9:0d:10:12:45:62:e8:e2:3f:45:13:2f:bc:1b:a1:0c:b7:8e:c8:b9:87:ec:e4:8e:ee:8aSigner

Headers

DLL Characteristics

File Characteristics

Imports

drfile

mrtcomm

mrtdatabase

mrtmange

mrtuibal

mfc140u

kernel32

user32

gdi32

shell32

shlwapi

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 797KB

.rdata Size: - Virtual size: 118KB

.data Size: - Virtual size: 5KB

.gfids Size: - Virtual size: 32B

.tls Size: - Virtual size: 9B

.vmp0 Size: - Virtual size: 1.8MB

.vmp1 Size: 6.4MB - Virtual size: 6.4MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 16KB - Virtual size: 13.6MB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:f7:3f:19:80:04:4b:b5:ba:0d:36:16:b9:75:4e:f2
Certificate

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

1e:b1:32:d5:08:9c:51:ab
Certificate

8e:37:de:07:2c:87:e9:0d:10:12:45:62:e8:e2:3f:45:13:2f:bc:1b:a1:0c:b7:8e:c8:b9:87:ec:e4:8e:ee:8a
Signer

.text
Size: - Virtual size: 797KB

.rdata
Size: - Virtual size: 118KB

.data
Size: - Virtual size: 5KB

.gfids
Size: - Virtual size: 32B

.tls
Size: - Virtual size: 9B

.vmp0
Size: - Virtual size: 1.8MB

.vmp1
Size: 6.4MB - Virtual size: 6.4MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 16KB - Virtual size: 13.6MB