fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f

Sharing

Copy URL

Twitter E-mail

General

Target

fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f
Size

1.9MB
MD5

04de8d92babf00aebea4b4e00efa1e2c
SHA1

173ed8d10491f255ab771f4cd79281c431f68bab
SHA256

fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f
SHA512

90a54fd2ae65a2906a1b4219fc26b588106fe813d9805398c1b0859e6d0545e5c72216f8c4106a1dee6524e118ba4b786a123a649fccf0dbc67ee098ef3bacf2
SSDEEP

49152:QOhuR//9nZ6sJm77KmgubMvX1HvN0BurwMUTdg1mAWjSsF:xc7nZ6sJm77Kmgu29GBurt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f

Files

fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f
.dll windows:6 windows x86 arch:x86

d1e5e12f765dd742d47d1499ad089702

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
DeleteFileA
WaitForSingleObject
TerminateThread
CreateProcessA
GetLocalTime
CopyFileA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
ResetEvent
CreateEventA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReadFile
WriteFile
CreatePipe
FindResourceExW
LoadResource
LockResource
SizeofResource
GetStartupInfoA
FindResourceW
GetExitCodeProcess
OutputDebugStringA
WaitForSingleObjectEx
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentThreadId
MoveFileA
AreFileApisANSI
ReleaseMutex
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetPrivateProfileStringA
WritePrivateProfileStringA
GetSystemTime
GetVersionExA
GlobalDeleteAtom
GlobalAddAtomA
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
CreateFileA
GetOverlappedResult
SetupComm
PurgeComm
SetCommMask
SetCommState
SetCommTimeouts
CreateMutexA
TryEnterCriticalSection
RtlCaptureContext
SetUnhandledExceptionFilter
GetCurrentProcess
VirtualQueryEx
LoadLibraryW
CreateFileW
ReleaseSemaphore
CreateSemaphoreW
GetProcessId
CloseHandle
WaitForMultipleObjects
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
SetEndOfFile
PeekNamedPipe
FileTimeToLocalFileTime
WriteConsoleW
SetStdHandle
GetPrivateProfileIntA
GetTickCount
SetEvent
CreateThread
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
CreateDirectoryA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetFileType
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
GetDriveTypeW
MoveFileExW
GetCurrentDirectoryW
GetFullPathNameW
DeleteFileW
GetCPInfo
GetCommandLineA
SystemTimeToTzSpecificLocalTime
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
LoadLibraryExW
ExitThread
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetSystemTimeAsFileTime
RtlUnwind
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
EncodePointer
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW

user32

LoadCursorA
FindWindowA
SetCursor
SetParent
SendMessageA
PostMessageA
MessageBoxA

advapi32

RegSetKeyValueA
RegEnumKeyA
RegOpenKeyA
RegQueryInfoKeyA
RegQueryValueExA
RegCreateKeyExA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyValueA
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA

ole32

CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance
PropVariantClear

rpcrt4

UuidFromStringA

sqlite3

sqlite3_exec
sqlite3_free
sqlite3_open
sqlite3_close

shlwapi

StrStrA

ws2_32

inet_ntoa
inet_ntop
gethostbyname
WSAStartup
gethostname
WSACleanup
inet_addr
connect
ioctlsocket
htons
recv
shutdown
WSAGetLastError
socket

setupapi

SetupDiGetDevicePropertyW
CM_Get_Parent
CM_Get_Device_IDA
SetupDiSetClassInstallParamsA
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiOpenClassRegKey

rasapi32

RasGetEntryDialParamsA
RasDialA
RasEnumEntriesA
RasDeleteEntryA
RasSetEntryPropertiesA
RasGetEntryPropertiesA
RasGetErrorStringA
RasGetProjectionInfoA
RasHangUpA
RasGetConnectStatusA
RasEnumConnectionsA

iphlpapi

DeleteIpForwardEntry
GetAdaptersInfo
GetAdaptersAddresses
GetTcpTable
GetIpForwardTable
GetUdpTable

Exports

Exports

?CheckAppIsInstall@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
AddDevice
AddTestPlan
CheckAppIsRunning
CheckBlockCallOrDropCall
CheckOutOfService
CheckPioneerToolsIsRunning
ClearSingleGPSItem
CloseATPort
ConnectDevice
ConnectGyroscope
ContinueSchedule
CreateDeviceManagerHandle
DelAllDevice
DelDevice
DeviceLost
DisconnectDevice
DisconnectGyroscope
EnableLoger
ExportPioneerToolsLog
FindHisiDeviceInfo
FreeDeviceManagerHandle
GetAdvanceValue
GetControlDeviceState
GetDevStatus
GetDevTaskInfo
GetDeviceState
GetGyroMode
GetObtainTraceHandle
GetPartnerDeviceID
GetPioneerToolsInfo
GetPioneerToolsVersion
GetSeviceTestStatus
GetSingleGPSItem
GlobalMonitoring
InitGuids
InitalAgent
InitializeDevices
IsDevcieConnected
IsSchedulePause
IsServiceWorking
LogSwapFinished
LogSwapNotify
Monitoring
NetOnLineChecking
NewSchedule
NewTask
NotificationRealTimeEventID
NotifyDevice
OpenATPort
PauseLog
PauseSchedule
PhoneGPSTraceNoData
ReadATPort
RegistCallBackFun
RegistCallBackFunForDataSet
RegistGyroIndoorCallBack
RegistServiceInfoCallBack
RegistTaskRecordEventCallBack
RegistTaskStartEndCallBack
RegisterNotifyEvt
RestoreLog
ResumeLog
ResumeSchedule
ServiceProcessForLogSwap
SetATUInfo
SetATUUpload
SetDeviceConfigs
SetDynamicParams
SetIMEI
SetReadIOInterval
SetRecordFilePath
StartLog
StartPioneerTools
StartSchedule
StopLog
StopPioneerTools
StopSchedule
SuspendSchedule
TMAdbOpenDevicePort
TMChangeMacAddrForPOLQA
TMCheckDongleLicense
TMConnectRemoteServer
TMCreateTCPIPMonitorControl
TMDailUp
TMDelete
TMDestoryTCPIPMonitorControl
TMDeviceControl
TMDisconnectRemoteServer
TMFindPOLQAVPNAdapter
TMFinshCalcOnePESQ
TMGetHisiDevName
TMGetHisiDeviceOtherName
TMGetLicenseByBoolParam
TMGetLicenseByInt64Param
TMGetLicenseByNetParam
TMGetMOSPESQ
TMGetTCPIPMonitorDataSoHandle
TMGetTestingTCPIPMonitorDataSoHandle
TMHangUp
TMInitMOSCalcOnePESQ
TMIpcConnectRemoteServer
TMIpcDisconnectRemoteServer
TMIpcRunTest
TMIpcSendCommand
TMIsNBDevice
TMIsOnlineNet
TMLoginDongle
TMLogoutDongle
TMMOSCalcOnePESQ
TMPolqaLicenseIsAboutToExpire
TMProcAdbOpenMate10Port
TMReadInit
TMRecoverChangeMacForPOLQA
TMReplayTCPIPMonitorData
TMSetDongleCurrentTimeFunc
TMSetExportPOLQALicenseFileFunc
TMSetGetLicenseByBoolParamFunc
TMSetGetLicenseByInt64ParamFunc
TMSetGetPOLQALicenseFileFunc
TMStartMonitorPlay
TMStopMonitorPlay
TMUpLoadFile
TMWritePort
TraceNoData
TraceNoDataProcess
TraceStatus
UnInitalAgent
UploadDataToUE
WriteATPort
WriteInfoForStartRcuLog

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 397KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1e5e12f765dd742d47d1499ad089702

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

rpcrt4

sqlite3

shlwapi

ws2_32

setupapi

rasapi32

iphlpapi

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 397KB - Virtual size: 396KB

.data Size: 10KB - Virtual size: 36KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 66KB - Virtual size: 66KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 397KB - Virtual size: 396KB

.data
Size: 10KB - Virtual size: 36KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 66KB