880cdd855ccbc411c3b41112316042b12c8a644682e00d46163e25a95e2e76fe

Sharing

Copy URL

Twitter E-mail

General

Target

880cdd855ccbc411c3b41112316042b12c8a644682e00d46163e25a95e2e76fe
Size

5.5MB
MD5

f6e9b380373f7de5af108fb8492d4400
SHA1

3f00d0d7b89260162b7b5436c14c7f71398a5c3d
SHA256

880cdd855ccbc411c3b41112316042b12c8a644682e00d46163e25a95e2e76fe
SHA512

1484585469f6066acf7644d0482307a14eeae29fdb09f087886c6b6e5fce6250c78d641037838d8e4bf7da4175195a1b00f435d3bde6f9a0d93d5c06b1cb02b7
SSDEEP

98304:KH8gc0tXT2p8ixrKyZxu9NV/NXtWJ9Cw+hU1UZLOtxNq5:KNc0528ZyZM9HNdWTVe5ixO

Score

1^/10

Malware Config

Signatures

Files

880cdd855ccbc411c3b41112316042b12c8a644682e00d46163e25a95e2e76fe
.dll windows:6 windows x86 arch:x86

db60e6813dff8f740e42d22b3a34ba6d

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:f8:79:2e:07:19:49:53:59:16:e1:4f
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

22-12-2021 02:18

Not After

22-12-2024 02:18

Subject

CN=Dingli Corp.\, Ltd.,OU=Software development Department,O=Dingli Corp.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

Issuer

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01-01-2000 00:00

Not After

31-12-2099 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01-01-2000 00:00

Not After

31-12-2099 23:59

Subject

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:0b:ea:1e:7a:a4:a7:cf:15:85:c4:5e:93:69:53:1d:3f:5a:d6:40:bf:71:2e:02:27:ec:f0:a8:10:c8:af:04
Signer

Actual PE Digest

8a:0b:ea:1e:7a:a4:a7:cf:15:85:c4:5e:93:69:53:1d:3f:5a:d6:40:bf:71:2e:02:27:ec:f0:a8:10:c8:af:04

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

GetDC

advapi32

GetAce

iphlpapi

GetIfTable

shell32

ILFree

hid

HidP_GetCaps

setupapi

SetupInstallFileA

dhcpcsvc

DhcpIsEnabled

dhcpcsvc6

Dhcpv6IsEnabled

psapi

EnumProcesses

wsock32

bind

nmeagpsdecoder

ClearReportItemsProc

dinglircu

GetRcuData

testmanager

NewTask

snvm

ExecuteVM

ole32

CoCreateGuid

Exports

Exports

?DMCalcCustomParms@Common@@YAHPAX@Z
?DMConfigDecodeOrStoragePropertyForDev@@YAHHHH_J@Z
?DMExportPOLQAFileByFields@@YAHPBD0HPAPAD@Z
?DMGetErrorInfoW_JobManager@@YAPA_WH@Z
CompressFile
DMAMTPGetConfig
DMAMTPInit
DMAMTPLogin
DMAMTPLogout
DMAMTPModuleConfig
DMAMTPRegCallBack
DMAMTPReportState
DMAMTPStopUplodData
DMAMTPUninit
DMAMTPUploadDataFile
DMAMTPUploadDataRealTime
DMAdbOpenDevicePort
DMAddDev
DMAddDevice
DMAddTestPlan
DMCalcGPSTotalMileage
DMCameraEdit
DMCameraPause
DMCameraReplay
DMCameraSetTime
DMCameraStartPlay
DMCameraStopPlay
DMCheckDataSetExist
DMCheckDecodeFileValid
DMCheckDongleLicense
DMCheckPioneerToolsIsRunning
DMClearAllCustomEvent
DMClearSingleGPSItem
DMCloseATPort
DMCloseDataSetV2
DMCloseKPIFile_UnifyKPI
DMCombinateDCFFiles
DMCombinateDDIBFiles
DMCombinateDDIBFilesEx
DMConfigDecodeOrStorageComplexProperty
DMConfigDecodeOrStorageProperty
DMConfigDecodeOrStoragePropertyInterface
DMConfigDecodeOrStorageStringProperty
DMConfigDecodeOrStorageStringPropertyInterface
DMConnectDevice
DMConnectGyroscope
DMConnectRemoteServer
DMContinueSchedule
DMCopyPioneerToolsLog
DMCreateDeviceManagerHandle
DMCreateRedecodeHandle
DMCreateRequest
DMCreateRequestEx
DMCreateRequestEx_JobManager
DMCreateRequest_JobManager
DMCreateTCPIPMonitorControl
DMDailUp
DMDataSetFreeMemory
DMDelAllDevice
DMDelDecodedFile
DMDelDevice
DMDestoryTCPIPMonitorControl
DMDisconnectDevice
DMDisconnectGyroscope
DMDisconnectRemoteServer
DMDivideFileFromDCFFileByTime
DMDivideFileFromDCFFileByZone
DMDivideFileFromDataSet
DMDongleCurrentTime
DMEnableLoger
DMExistsSetCellFrequencyOrPNList
DMExportPOLQALicenseFile
DMFilterPointZonesFromDataSet
DMFindHisiDeviceInfo
DMFindPOLQAEnvironment
DMFinshCalcOnePESQ
DMFreeDeviceManagerHandle
DMFreeKPIDetail_UnifyKPI
DMFreeRedecodeHandle
DMGenerateParamValueDB
DMGetActiveCellCount
DMGetActiveCellParamRealValue
DMGetActiveCellParamValue
DMGetAppearsObserverItem
DMGetAppointSPCount
DMGetBaseInfoResult_UnifyKPI
DMGetBinCondition
DMGetBinPointFRMDLTParamValueInfo
DMGetBinPointID
DMGetBinPointParamDetailInfo
DMGetBinPointParamValueInfo
DMGetBinPointTimeRange
DMGetBinPointWorseParamValueInfo
DMGetCanRestoreCancelMarkCount
DMGetComputerTimeTestRange
DMGetControlDeviceState
DMGetCountOfOneEvent
DMGetCurrWritingFileInfo
DMGetCurrentLogID
DMGetCurrentRcuFileSize
DMGetCustomConditionFilterResult
DMGetCustomStorageDefinedInfoCount
DMGetCustomStorageDefinedInfoName
DMGetDateTimeEx
DMGetDecodeFileStorageVersion
DMGetDecryptEnabled
DMGetDevStatus
DMGetDevTaskInfo
DMGetDeviceInfoByIndex
DMGetDeviceModelName
DMGetDeviceParent
DMGetDeviceState
DMGetDeviceType
DMGetDeviceVendor
DMGetDongleID
DMGetErrorInfoW
DMGetEventByPointIndex
DMGetEventCountByPointIndex
DMGetEventCountEx
DMGetEventDetailsByEventFlagAndIndex
DMGetEventInfoByEventIndex
DMGetEventPointIndexes
DMGetEventPropertyDoubleValue
DMGetEventPropertyExtentValue
DMGetEventPropertyFloatValue
DMGetEventPropertyInt64Value
DMGetEventPropertyIntValue
DMGetEventPropertyStringValue
DMGetEventSerializeMemory
DMGetEventsEx
DMGetEventsEx_TestManager
DMGetExistEventFlagList
DMGetExistMsgCodeTypeList
DMGetExistSPList
DMGetExistsStructSpecificIDList
DMGetGPSPointCount
DMGetGPSValidRange
DMGetGPSValue
DMGetGyroMode
DMGetHaveValueParamList
DMGetHaveValueSpecificIDList
DMGetHisiDevName
DMGetHisiDeviceOtherName
DMGetIndoorMagInfos
DMGetIndoorMagPictureContents
DMGetIndoorMagPictureNames
DMGetIndoorMapInfoCount
DMGetInt64ParamValue
DMGetIsTestDataSet
DMGetKMLStationCoordinate
DMGetLayer3OriginalMsgContent
DMGetLicenseByBoolParam
DMGetLicenseByInt64Param
DMGetLicenseByNetParam
DMGetLogInfoResult_UnifyKPI
DMGetMOMTDetailInfoResult_UnifyKPI
DMGetMOSPESQ
DMGetMessageCode
DMGetMessageContent
DMGetMessageName
DMGetMsgCodePointIndexList
DMGetMsgDirection
DMGetMsgXMLContentEx
DMGetNearlyPointIndexByEventCode
DMGetNetType
DMGetNetWorkState
DMGetNewEvents
DMGetNextMsgCode
DMGetOnePointAllParamsValue
DMGetOneTestInfo
DMGetPOLQALicenseFile
DMGetParamBaseFilterResult
DMGetParamRealPointListEx
DMGetParamRealValue
DMGetParamRealValueByRealValueIndex
DMGetParamRealValueIndexByPointIndex
DMGetParamRealValueList
DMGetParamRealValueTotalCount
DMGetParamValue
DMGetPioneerToolsInfo
DMGetPioneerToolsVersion
DMGetPointIndexByParamRealValueIndex
DMGetPointInterZoneByGPSIndex
DMGetPort
DMGetRandomCheckMark
DMGetRcuHead
DMGetRealGPSInfo
DMGetRealGPSProtocolTime
DMGetRedcodingProcess
DMGetRelativePointIndexByDistance
DMGetRelativePointIndexByTime
DMGetRequestState
DMGetRequestState_JobManager
DMGetRowCount_UnifyKPI
DMGetSPEventCount
DMGetSPEventIndexList
DMGetSPIndexList
DMGetSameComputerTimePointIndexRange
DMGetScannerFieldSerializeMemory
DMGetSceneInfoResult_UnifyKPI
DMGetSerialNumber
DMGetSetCellCount
DMGetSetCellCountBySetType
DMGetSetCellParamRealValue
DMGetSetCellParamRealValueByFrequencyAndPN
DMGetSetCellParamRealValueByPN
DMGetSetCellParamRealValueBySetType
DMGetSetCellParamValue
DMGetSetCellParamValueByFrequencyAndPN
DMGetSetCellParamValueByPN
DMGetSetCellParamValueBySetType
DMGetSeviceTestStatus
DMGetSingleGPSItem
DMGetSortedAllEventIndexList
DMGetSourceDatasetHandle
DMGetSpecialFieldSerializeMemory
DMGetSpecialFieldValidStorageMemory
DMGetStructItem
DMGetStructItemCount
DMGetStructMultiSubItem
DMGetStructMultiSubItemCount
DMGetStructSubItem
DMGetStructSubItemCount
DMGetSubTaskCount
DMGetSubTaskCount_JobManager
DMGetSubTaskInfo
DMGetSubTaskInfo_JobManager
DMGetTCPIPMonitorDataSoHandle
DMGetTestInfoCount
DMGetTestingTCPIPMonitorDataSoHandle
DMGetTimeZone
DMGetTotalPointCountV2
DMGetUTCDateTime
DMGetVersion
DMGetWalkingEventCount
DMGetWalkingEventGPS
DMGetWalkingEventPictureInfo
DMGetXMLOneStationInfo
DMGetXMLStationInfo
DMHangUp
DMHighRailGetXMLStationCount
DMHighRailManualInbound
DMHighRailManualOutbound
DMHighRailSendOriGPSSpeedInfo
DMHighRailSetGPSFillKMLInfosAndStartFill
DMHighRailStartFill
DMInitConfigDecodeOrStorageProperty
DMInitGuids
DMInitMOSCalcOnePESQ
DMInitPOLQALicense
DMInitalAgent
DMInitializeReport
DMInitialize_JobManager
DMIpcConnectRemoteServer
DMIpcDisconnectRemoteServer
DMIpcRunTest
DMIpcSendCommand
DMIsDataSetTestingbyDevID
DMIsDevcieConnected
DMIsDeviceLost
DMIsExistDataSetHandle
DMIsExistDecodedFile
DMIsFiltedDataSet
DMIsInGSMState
DMIsSchedulePause
DMIsSecretFile
DMIsServiceWorking
DMLoginDongle
DMLogoutDongle
DMMOSCalcOnePESQ
DMMonitoring
DMNewSchedule
DMNewTask
DMNotifyMainFormLoadFinished
DMObtainTraceHandle
DMOpenATPort
DMOpenBinDataSet
DMOpenDataSetExV2
DMOpenDataSetV2
DMOpenDataSetWithoutInit
DMOpenKPIFile_UnifyKPI
DMPauseRcuLog
DMPauseSchedule
DMPhoneGPSTraceNoData
DMPolqaLicenseIsAboutToExpire
DMProcAdbOpenMate10Port
DMPushCustomEventData
DMPushCustomParamValue
DMPushDecodeDataA
DMPushEventDataA
DMQueryKPI_UnifyKPI
DMRCUNameToDDIB
DMReadATPort
DMReadInit
DMReadKPIDetail_UnifyKPI
DMReadKPIValue_UnifyKPI
DMRedecode
DMRegistCallBackFunc
DMRegistCallBackFuncEx
DMRegistCreateDatasetBeforeCallback
DMRegistGyroIndoorCallBack
DMRegistHighRailArrivalsCallback
DMRegistHighRailStatusCallback
DMRegistServiceInfoCallBack
DMRegistTaskRecordEventCallBack
DMRegistTaskStartEndCallBack
DMRegisterObserverInfo
DMRemainExpireDays
DMReplayTCPIPMonitorData
DMRestoreCancelMarks
DMResumRcuLog
DMResumeSchedule
DMSendIndoorInformation
DMSetATUInfo
DMSetATUUpload
DMSetCurrentLogID
DMSetDefaultRcuPath
DMSetDeviceConfigs
DMSetDeviceRecovery
DMSetDynamicParams
DMSetIMEI
DMSetRandomCheckMark
DMSetRcuHeadAndDataTpye
DMSetReadIOInterval
DMSetRecordFilePath
DMSetScannerItemSort
DMStartMonitorPlay
DMStartRTFillGPSPro
DMStartRcuLog
DMStartScannerLog
DMStartSchedule
DMStatParamSingleRangeInfo
DMStopMonitorPlay
DMStopMos
DMStopRcuLog
DMStopRedecode
DMStopScannerLog
DMStopSchedule
DMStorageCustomEventFinished
DMSuspendSchedule
DMSwapRcuFileName
DMTranslateToOriginalGPSIndex
DMTranslateToOriginalPointIndex
DMUnInitalAgent
DMUnInitializeReport
DMUnInitialize_JobManager
DMUninitPOLQALicense
DMUpLoadFile
DMWaitForSwapDataIsReady
DMWriteATPort
DMWriteBaseInfo_UnifyKPI
DMWriteDelayDetailInfo_UnifyKPI
DMWriteEvent
DMWriteKPIDetail_UnifyKPI
DMWriteKPIValue_UnifyKPI
DMWriteLOGInfo_UnifyKPI
DMWritePort
DMWriteSceneInfo_UnifyKPI
DM_InitialEx
DM_UnInitial
DMftp_dir_connect
DMftp_dir_init
DMftp_dir_list
DMftp_dir_uninit
DMget_dir_count
DMget_dir_name
DMget_file_count
DMget_file_name
DestroyClient
GetConfig
GetUploadedSize
HaveIndoorMarked
InitClient
KillSubBTUProcess
SendAlarm
SendClearAlarm
SendEvent
SendGps
StopUpload
UploadData
UploadDataRealTime
UploadZipData
UploadZipDataRealTime

Sections

.AKS1
Size: 2.8MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.AKS2
Size: 2.7MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.AKS3
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

db60e6813dff8f740e42d22b3a34ba6d

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

52:f8:79:2e:07:19:49:53:59:16:e1:4fCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:abCertificate

Extended Key Usages

Key Usages

8a:0b:ea:1e:7a:a4:a7:cf:15:85:c4:5e:93:69:53:1d:3f:5a:d6:40:bf:71:2e:02:27:ec:f0:a8:10:c8:af:04Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

iphlpapi

shell32

hid

setupapi

dhcpcsvc

dhcpcsvc6

psapi

wsock32

nmeagpsdecoder

dinglircu

testmanager

snvm

ole32

Exports

Exports

Sections

.AKS1 Size: 2.8MB - Virtual size: 4.0MB

.AKS2 Size: 2.7MB - Virtual size: 3.6MB

.AKS3 Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

52:f8:79:2e:07:19:49:53:59:16:e1:4f
Certificate

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

1e:b1:32:d5:08:9c:51:ab
Certificate

8a:0b:ea:1e:7a:a4:a7:cf:15:85:c4:5e:93:69:53:1d:3f:5a:d6:40:bf:71:2e:02:27:ec:f0:a8:10:c8:af:04
Signer

.AKS1
Size: 2.8MB - Virtual size: 4.0MB

.AKS2
Size: 2.7MB - Virtual size: 3.6MB

.AKS3
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB