51f3f610712cc750cc9f0c1f6fc620c0a46f302a773c2f883c63480766ab7433

Sharing

Copy URL Twitter E-mail

General

Target

51f3f610712cc750cc9f0c1f6fc620c0a46f302a773c2f883c63480766ab7433
Size

52KB
MD5

56e049e0743f5097b48c0cd4374309c1
SHA1

8c146e5a4148ef721be059b434eb9b85fe33eaf6
SHA256

51f3f610712cc750cc9f0c1f6fc620c0a46f302a773c2f883c63480766ab7433
SHA512

0fb3fd44febb444d5121f7528caab6f6712fb74472df81110e7d2547951c7040b54563746be3108e340e97c7b36e1b571bf265172715a1e47b8ec32246717eb8
SSDEEP

1536:e1qALPXY45crA1g9x+ozPODKQ8QhNjxl:egQA45/Gn+ozgKQhNjx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51f3f610712cc750cc9f0c1f6fc620c0a46f302a773c2f883c63480766ab7433

Files

51f3f610712cc750cc9f0c1f6fc620c0a46f302a773c2f883c63480766ab7433
.dll windows:6 windows x86

ff994d27c9274656aea4d7b777044e80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
CreateThread
CreateFileA
DeleteFileA
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
CreateProcessA
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpyA
lstrcatA
GetTempPathA
HeapAlloc
HeapFree
GetProcessHeap
VirtualProtect
EnterCriticalSection
GetComputerNameA
OutputDebugStringA
GetLastError
CreateMutexA
GetFileAttributesA
GetCurrentThreadId
lstrcmpiA
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
MapViewOfFile
GetModuleFileNameA
CreateFileMappingA
OpenFileMappingA
InitializeCriticalSection
LocalFree
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
CancelIo
CloseHandle
VirtualFree
lstrlenA
VirtualAlloc

user32

SetClipboardData
GetClipboardData
EmptyClipboard
GetLastInputInfo
OpenInputDesktop
CloseClipboard
CloseDesktop
GetThreadDesktop
GetUserObjectInformationA
wsprintfA
SetThreadDesktop
ExitWindowsEx
OpenClipboard

advapi32

OpenEventLogA
ClearEventLogA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseEventLog

shell32

ShellExecuteA

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

ws2_32

gethostname
inet_addr
WSAIoctl
WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
closesocket
connect
getsockname
htons
inet_ntoa
select
recv
send

msvcp120

?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

msvcr120

_amsg_exit
__CppXcptFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_except1
_onexit
__dllonexit
_calloc_crt
_unlock
_malloc_crt
malloc
_beginthreadex
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_localtime64
??0exception@std@@QAE@ABQBD@Z
memchr
strchr
strcat
realloc
free
strrchr
_initterm
_initterm_e
_stricmp
__clean_type_info_names_internal
_lock
?terminate@@YAXXZ
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strlen
memmove
strstr
ceil
_CxxThrowException
__CxxFrameHandler3
memset
rand
srand
??_V@YAXPAX@Z
_time64
exit
memcmp
strcpy
strncpy

Exports

Exports

CallOneToOne
CallRobot24
CheckBatteryPlanStatus
CheckCameraStatus
CheckEyeProtectionMode
CheckMicphoneStatus
CheckNetState
CheckSettingHost
ClearMemory
CloseMicphone
CloudInitConfig
CloudSyncDeviceIdLogin
CloudSyncGenDeviceId
ContrlTopSpeedMode
CreateCamera
CreateDirByPath
CreateFileIcon
DecrpyData
DeleteFileEx
DestroyCamera
DisableServiceEx
DoTask
EncrptyData
GarbageStopAnyOperator
GetAPSStatus
GetAllProjectorSettings
GetAppChannel
GetAppVersion
GetAutoDisable
GetAutomaticModeSetting
GetBackCameraFriendlyName
GetBrightness
GetBrightnessRange
GetBrowserPolicy
GetCPUFrequency
GetCPUThermal
GetCPUUsage
GetCallRobotData
GetCallRobotParam
GetCameraAbility
GetColorEffectCapability
GetConfig
GetConfigByKey
GetContrast
GetContrastRange
GetCoolQuiteAbilityBySettingHost
GetCoolQuiteSetting
GetCurrentMode
GetDeviceMac
GetDeviceSN
GetDeviceSNHash
GetDualFanCommand
GetExposure
GetExposureRange
GetFileIcon
GetFileMd5
GetFlipOpenStatus
GetFrontCameraFriendlyName
GetGarbageCleanSize
GetGarbageSize
GetHotWordChannel
GetHotwordUpdateInterval
GetITSAbility
GetITSVersion
GetInputCapility
GetInstallPath
GetIntelligentSmartSettings
GetIsSupportLogodiy
GetIsSupportSR2
GetKeyboardLightCapacity
GetKeyboardLightStatus
GetLUDPMacAddress
GetLastModuleCapility
GetLocalToken
GetMMCCAbility
GetMMCCapableMode
GetMTM
GetMachineType
GetMemoryRatio
GetMicroftAccountId
GetNetworkSpeed
GetNumberofHDDs
GetOLEDCapility
GetOLEDSettings
GetPSensorCapability
GetPSensorSetting
GetPathForLog
GetPenCapability
GetPenDelayTime
GetPenInputSetting
GetPicoPJAbility
GetPicoPJPopupWndCloseOption
GetPicoPJPopupWndOpenOption
GetPicoPJPreventSleepWhenOn
GetPicoProjectorBatteryLevel
GetPicoProjectorBatteryStatus
GetPicoProjectorColorMode
GetPicoProjectorDisplayDimMins
GetPrivacy
GetProgramDataPath
GetRealmKey
GetRealmString
GetSensitivityRange
GetSensitivityRequestLevel
GetSettingsModuleCapility
GetSmartHibernationCommand
GetSnoozeEnableDisable
GetSnoozeTime
GetSpeedBallAPI
GetThermalDownTimeStableToUnstable
GetThermalDownTimeUnstableToStable
GetThermalFeatureAbility
GetThermalFeatureSetting
GetTouchCapability
GetTouchInputSetting
GetUpdateDriver
GetUpdateSoftware
GetWarrantyInfo
GetWidgetDefaultModeChannel
GetXiangxiuPolicy
HttpForSecurity
Initialize
InitializeCancelDelay
InitializeWithContext
IsAPSDriverLoaded
IsAPSEnabled
IsAlwaysOnUsbCapability
IsCameraAccessDenied
IsDictoryExists
IsEMDriverInstalled
IsLenovoAppsChannel
IsLenovoMachine
IsLenovoSignature
IsNoteBookPC
IsPCMParentProcess
IsPCMServerAllowLeWindow
IsPMDriverInstalled
IsPreloadChannel
IsShowAppStoreEntry
IsSupportColorTemperature
IsSupportPen
IsSystemCamera
IsThinkPadComputer
IsThinpadSMB
IsV3Version
IsWelcomeAllowPop
IsWindowsNewOS
IsXiaoXinPC
IsZhengJiuZhePC
JsPluginRequest
LAV_GetLockedPage
LAV_LockedPage
LAV_ShowLav
LanguageGetCurrent
LanguageLoadString
LaunchCPL
LoadAPSDriver
LoadPowerPlugin
MoveCameraArea
OnReceiveGraphEvent
OpenHumanService
OpenMicphone
PCM_HttpsPost
QueryBatteryInfo
QueryBatteryStretch
QueryChargeThreshold
QueryDualFanCapability
QueryGaugeResetCapability
QueryGaugeResetStatus
QuerySmartHibernationCapability
QueryUSB
QuitSettingHost
ResetOLEDsettings
ResetPicoProjectorSettings
RestoreColorEffect
RobotXgjEncodeData
SMBIOS_GetSysEnclosureType
SaveHIconToPngFile
SendNotifyOfTSModeChanged
SetAPSEnableDisable
SetAccessedCamera
SetAutoDisable
SetAutomaticMode
SetBalanceMode
SetBatterySavingMode
SetBatteryStretch
SetBrightness
SetCameraNormalMode
SetCameraPrivacyMode
SetChargeThreshold
SetClickZoneReverse
SetColorEffectState
SetContrast
SetCoolQuiteAbilityBySettingHost
SetCoolQuiteSetting
SetDYTCMode
SetDualFanCommand
SetExposure
SetEyeProtectionMode
SetFlipOpenStatus
SetFnKeyLocation
SetFnLock
SetFnStickKey
SetForceHighPerformanceMode
SetGaugeResetCommand
SetKeyboardLightStatus
SetLastModuleCapility
SetManualModeControlMode
SetManualSensitivitySetting
SetMiddleButtonAction
SetNormalMode
SetOLEDmode
SetOLEDsettings
SetPSensorSetting
SetPenDelayTime
SetPenInputSetting
SetPicoPJPopupWndCloseOption
SetPicoPJPopupWndOpenOption
SetPicoPJPreventSleepWhenOn
SetPicoProjectorColorMode
SetPicoProjectorDisplayDimMins
SetPrimaryFunction
SetPrivacy
SetSettingValueChangedCallback
SetSmartHibernationCommand
SetSmartSenseSettings
SetSnoozeEnableDisable
SetSnoozeTime
SetThermalDownTimeStableToUnstable
SetThermalDownTimeUnstableToStable
SetThermalFeatureSetting
SetTouchEnable
SetTouchInputSetting
SetTouchSpeed
SetTrackPoint
SetTrackPointSpeed
SetUSB
SnoozeNow
StartCapture
StartNetStateMoniter
StartServiceEx
StopCapture
SyncUploadFile
SysGetMachinePenCapability
TakeLocalColorEffect
TestFun
UnloadAPSDriver
UnloadPowerPlugin
UseHotWord
UseLongtimeReminder
UseOfficeReminder
UseSearchPanel
WP_AllowDrag
WP_Auth_IsPCM
WP_DeletePoint
WP_DownloadFile
WP_GetAppName
WP_GetConfigApiNew
WP_GetCtsToken
WP_GetGlobalConfigNew
WP_GetGlobalData
WP_GetHardwareInfo
WP_GetLUDPUUID
WP_GetLenovoIdLoginInfo
WP_GetMachineMarketingName
WP_GetMarketingName
WP_GetModuleConfigNew
WP_GetModuleConfigVersionNew
WP_GetOSName
WP_GetOpenAccessToken
WP_GetRegistryPath
WP_GetSettingsConfig
WP_GetSmartHomePath
WP_GetSoftwareUpdateCount
WP_GetStoragePath
WP_HttpRequest
WP_InitlizeLenovoId
WP_IsOpenServerAlived
WP_IsShowExtendWarranty
WP_LenovoIdLogin
WP_LenovoIdLogout
WP_PCM_Auth
WP_Plugin_Auth
WP_Plugin_Get_Paramter
WP_Plugin_Paramter_Init
WP_RefreshAccessToken
WP_SetGlobalData
WelcomeAllowPopFlag
WrapIsServiceRunning
WrapStartService
isThinkMachine
pcm_plugin_action
pcm_plugin_buffer_allocate
pcm_plugin_buffer_free
pcm_plugin_ininitialize

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff994d27c9274656aea4d7b777044e80

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

msvcp120

msvcr120

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 11KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 11KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB