e499306a539043fcc4c0e5aae4d2be76ba699b11376133b4ae17886e34053570

Sharing

Copy URL Twitter E-mail

General

Target

e499306a539043fcc4c0e5aae4d2be76ba699b11376133b4ae17886e34053570
Size

8.2MB
MD5

109e27a5b9471915a466751ced1f0087
SHA1

9a9666413cfa440e09b4dc176de3a525fe6c74b5
SHA256

e499306a539043fcc4c0e5aae4d2be76ba699b11376133b4ae17886e34053570
SHA512

1ccbc7dbc08c24a058bfcd37cdc577a6b0b1b7368a121958849c80f1d6b713a9b12e7c1da10b3d8aecc2f2628f54ac3d01eeb321696d3ecb21098721f1a481eb
SSDEEP

196608:pFhSglFqfOkCWPCLja17kCePnvEl5CNuGO1a8q99HOzc12z:pPSglIfcLq+tncquGO69HOzOo

Score

1^/10

Malware Config

Signatures

Files

e499306a539043fcc4c0e5aae4d2be76ba699b11376133b4ae17886e34053570
.dll windows:6 windows x86 arch:x86

c2cafc3fb268977b740385095ff45e7c

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:f8:79:2e:07:19:49:53:59:16:e1:4f
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

22/12/2021, 02:18

Not After

22/12/2024, 02:18

Subject

CN=Dingli Corp.\, Ltd.,OU=Software development Department,O=Dingli Corp.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

Issuer

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:08:9c:51:ab
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA2 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:24:35:19:36:d1:b9:0f:77:c4:8f:86:5d:75:a2:21:ef:6c:42:8b:09:16:af:9d:fc:a1:66:13:fc:ea:19:80
Signer

Actual PE Digest

7f:24:35:19:36:d1:b9:0f:77:c4:8f:86:5d:75:a2:21:ef:6c:42:8b:09:16:af:9d:fc:a1:66:13:fc:ea:19:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx
FreeLibrary

user32

wsprintfA
UnregisterClassA

shlwapi

ord158
PathRemoveFileSpecA

setupapi

SetupDiGetDevicePropertyW

advapi32

InitializeSecurityDescriptor

ole32

CoCreateInstance

nmeagpsdecoder

FreeDecoderObjectProc

dinglircu

SetDebugLogEnable

testmanager

SetATUInfo

ws2_32

ioctlsocket
WSAStartup

iphlpapi

GetAdaptersInfo
GetAdaptersInfo

oleaut32

VariantClear

Exports

Exports

?DMCalcCustomParms@Common@@YAHPAX@Z
?DMConfigDecodeOrStoragePropertyForDev@@YAHHHH_J@Z
?DMExportPOLQAFileByFields@@YAHPBD0HPAPAD@Z
?DMGetErrorInfoW_JobManager@@YAPA_WH@Z
CompressFile
DMAMTPGetConfig
DMAMTPInit
DMAMTPLogin
DMAMTPLogout
DMAMTPModuleConfig
DMAMTPRegCallBack
DMAMTPReportState
DMAMTPStopUplodData
DMAMTPUninit
DMAMTPUploadDataFile
DMAMTPUploadDataRealTime
DMAdbOpenDevicePort
DMAddDev
DMAddDevice
DMAddTestPlan
DMCalcGPSTotalMileage
DMCameraEdit
DMCameraPause
DMCameraReplay
DMCameraSetTime
DMCameraStartPlay
DMCameraStopPlay
DMCheckDataSetExist
DMCheckDecodeFileValid
DMCheckPioneerToolsIsRunning
DMClearAllCustomEvent
DMClearSingleGPSItem
DMCloseATPort
DMCloseDataSetV2
DMCloseKPIFile_UnifyKPI
DMCombinateDCFFiles
DMCombinateDDIBFiles
DMCombinateDDIBFilesEx
DMConfigDecodeOrStorageComplexProperty
DMConfigDecodeOrStorageProperty
DMConfigDecodeOrStoragePropertyInterface
DMConfigDecodeOrStorageStringProperty
DMConfigDecodeOrStorageStringPropertyInterface
DMConnectDevice
DMConnectGyroscope
DMConnectRemoteServer
DMContinueSchedule
DMCopyPioneerToolsLog
DMCreateDeviceManagerHandle
DMCreateRedecodeHandle
DMCreateRequest
DMCreateRequestEx
DMCreateRequestEx_JobManager
DMCreateRequest_JobManager
DMCreateTCPIPMonitorControl
DMDailUp
DMDataSetFreeMemory
DMDelAllDevice
DMDelDecodedFile
DMDelDevice
DMDestoryTCPIPMonitorControl
DMDisconnectDevice
DMDisconnectGyroscope
DMDisconnectRemoteServer
DMDivideFileFromDCFFileByTime
DMDivideFileFromDCFFileByZone
DMDivideFileFromDataSet
DMEnableLoger
DMExistsSetCellFrequencyOrPNList
DMExportPOLQALicenseFile
DMFilterPointZonesFromDataSet
DMFindHisiDeviceInfo
DMFindPOLQAEnvironment
DMFinshCalcOnePESQ
DMFreeDeviceManagerHandle
DMFreeKPIDetail_UnifyKPI
DMFreeRedecodeHandle
DMGenerateParamValueDB
DMGetActiveCellCount
DMGetActiveCellParamRealValue
DMGetActiveCellParamValue
DMGetAppearsObserverItem
DMGetAppointSPCount
DMGetBaseInfoResult_UnifyKPI
DMGetBinCondition
DMGetBinPointFRMDLTParamValueInfo
DMGetBinPointID
DMGetBinPointParamDetailInfo
DMGetBinPointParamValueInfo
DMGetBinPointTimeRange
DMGetBinPointWorseParamValueInfo
DMGetCanRestoreCancelMarkCount
DMGetComputerTimeTestRange
DMGetControlDeviceState
DMGetCountOfOneEvent
DMGetCurrWritingFileInfo
DMGetCurrentRcuFileSize
DMGetCustomConditionFilterResult
DMGetCustomStorageDefinedInfoCount
DMGetCustomStorageDefinedInfoName
DMGetDateTimeEx
DMGetDecodeFileStorageVersion
DMGetDecryptEnabled
DMGetDevStatus
DMGetDevTaskInfo
DMGetDeviceInfoByIndex
DMGetDeviceModelName
DMGetDeviceParent
DMGetDeviceState
DMGetDeviceType
DMGetDeviceVendor
DMGetErrorInfoW
DMGetEventByPointIndex
DMGetEventCountByPointIndex
DMGetEventCountEx
DMGetEventDetailsByEventFlagAndIndex
DMGetEventInfoByEventIndex
DMGetEventPointIndexes
DMGetEventPropertyDoubleValue
DMGetEventPropertyExtentValue
DMGetEventPropertyFloatValue
DMGetEventPropertyInt64Value
DMGetEventPropertyIntValue
DMGetEventPropertyStringValue
DMGetEventSerializeMemory
DMGetEventsEx
DMGetEventsEx_TestManager
DMGetExistEventFlagList
DMGetExistMsgCodeTypeList
DMGetExistSPList
DMGetExistsStructSpecificIDList
DMGetGPSPointCount
DMGetGPSValidRange
DMGetGPSValue
DMGetGyroMode
DMGetHaveValueParamList
DMGetHaveValueSpecificIDList
DMGetHisiDevName
DMGetHisiDeviceOtherName
DMGetIndoorMagInfos
DMGetIndoorMagPictureContents
DMGetIndoorMagPictureNames
DMGetIndoorMapInfoCount
DMGetInt64ParamValue
DMGetIsTestDataSet
DMGetKMLStationCoordinate
DMGetLayer3OriginalMsgContent
DMGetLogInfoResult_UnifyKPI
DMGetMOMTDetailInfoResult_UnifyKPI
DMGetMOSPESQ
DMGetMessageCode
DMGetMessageContent
DMGetMessageName
DMGetMsgCodePointIndexList
DMGetMsgDirection
DMGetMsgXMLContentEx
DMGetNearlyPointIndexByEventCode
DMGetNetType
DMGetNetWorkState
DMGetNewEvents
DMGetNextMsgCode
DMGetOnePointAllParamsValue
DMGetOneTestInfo
DMGetParamBaseFilterResult
DMGetParamRealPointListEx
DMGetParamRealValue
DMGetParamRealValueByRealValueIndex
DMGetParamRealValueIndexByPointIndex
DMGetParamRealValueList
DMGetParamRealValueTotalCount
DMGetParamValue
DMGetPioneerToolsInfo
DMGetPioneerToolsVersion
DMGetPointIndexByParamRealValueIndex
DMGetPointInterZoneByGPSIndex
DMGetPort
DMGetRcuHead
DMGetRealGPSInfo
DMGetRealGPSProtocolTime
DMGetRedcodingProcess
DMGetRelativePointIndexByDistance
DMGetRelativePointIndexByTime
DMGetRequestState
DMGetRequestState_JobManager
DMGetRowCount_UnifyKPI
DMGetSPEventCount
DMGetSPEventIndexList
DMGetSPIndexList
DMGetSameComputerTimePointIndexRange
DMGetScannerFieldSerializeMemory
DMGetSceneInfoResult_UnifyKPI
DMGetSerialNumber
DMGetSetCellCount
DMGetSetCellCountBySetType
DMGetSetCellParamRealValue
DMGetSetCellParamRealValueByFrequencyAndPN
DMGetSetCellParamRealValueByPN
DMGetSetCellParamRealValueBySetType
DMGetSetCellParamValue
DMGetSetCellParamValueByFrequencyAndPN
DMGetSetCellParamValueByPN
DMGetSetCellParamValueBySetType
DMGetSeviceTestStatus
DMGetSingleGPSItem
DMGetSortedAllEventIndexList
DMGetSourceDatasetHandle
DMGetSpecialFieldSerializeMemory
DMGetSpecialFieldValidStorageMemory
DMGetStructItem
DMGetStructItemCount
DMGetStructMultiSubItem
DMGetStructMultiSubItemCount
DMGetStructSubItem
DMGetStructSubItemCount
DMGetSubTaskCount
DMGetSubTaskCount_JobManager
DMGetSubTaskInfo
DMGetSubTaskInfo_JobManager
DMGetTCPIPMonitorDataSoHandle
DMGetTestInfoCount
DMGetTestingTCPIPMonitorDataSoHandle
DMGetTimeZone
DMGetTotalPointCountV2
DMGetUTCDateTime
DMGetWalkingEventCount
DMGetWalkingEventGPS
DMGetWalkingEventPictureInfo
DMGetXMLOneStationInfo
DMGetXMLStationInfo
DMHangUp
DMHighRailGetXMLStationCount
DMHighRailManualInbound
DMHighRailManualOutbound
DMHighRailSendOriGPSSpeedInfo
DMHighRailSetGPSFillKMLInfosAndStartFill
DMHighRailStartFill
DMInitConfigDecodeOrStorageProperty
DMInitGuids
DMInitMOSCalcOnePESQ
DMInitPOLQALicense
DMInitalAgent
DMInitializeReport
DMInitialize_JobManager
DMIpcConnectRemoteServer
DMIpcDisconnectRemoteServer
DMIpcRunTest
DMIpcSendCommand
DMIsDataSetTestingbyDevID
DMIsDevcieConnected
DMIsDeviceLost
DMIsExistDataSetHandle
DMIsExistDecodedFile
DMIsFiltedDataSet
DMIsInGSMState
DMIsSchedulePause
DMIsSecretFile
DMIsServiceWorking
DMLockNRNetWorkMode
DMMOSCalcOnePESQ
DMMonitoring
DMNewSchedule
DMNewTask
DMNotifyMainFormLoadFinished
DMObtainTraceHandle
DMOpenATPort
DMOpenBinDataSet
DMOpenDataSetExV2
DMOpenDataSetV2
DMOpenDataSetWithoutInit
DMOpenKPIFile_UnifyKPI
DMPauseRcuLog
DMPauseSchedule
DMPhoneGPSTraceNoData
DMPolqaLicenseIsAboutToExpire
DMProcAdbOpenMate10Port
DMPushCustomEventData
DMPushCustomParamValue
DMPushDecodeDataA
DMPushEventDataA
DMQueryKPI_UnifyKPI
DMRCUNameToDDIB
DMReadATPort
DMReadKPIDetail_UnifyKPI
DMReadKPIValue_UnifyKPI
DMRedecode
DMRegistCallBackFunc
DMRegistCallBackFuncEx
DMRegistCreateDatasetBeforeCallback
DMRegistGyroIndoorCallBack
DMRegistHighRailArrivalsCallback
DMRegistHighRailStatusCallback
DMRegistServiceInfoCallBack
DMRegistTaskRecordEventCallBack
DMRegistTaskStartEndCallBack
DMRegisterObserverInfo
DMReplayTCPIPMonitorData
DMRestoreCancelMarks
DMResumRcuLog
DMResumeSchedule
DMSendIndoorInformation
DMSetATUInfo
DMSetATUUpload
DMSetDefaultRcuPath
DMSetDeviceConfigs
DMSetDeviceRecovery
DMSetDynamicParams
DMSetIMEI
DMSetRcuHeadAndDataTpye
DMSetReadIOInterval
DMSetRecordFilePath
DMSetScannerItemSort
DMStartGyroIndoorTest
DMStartMonitorPlay
DMStartRTFillGPSPro
DMStartRcuLog
DMStartScannerLog
DMStartSchedule
DMStatParamSingleRangeInfo
DMStopGyroIndoorTest
DMStopMonitorPlay
DMStopMos
DMStopRcuLog
DMStopRedecode
DMStopScannerLog
DMStopSchedule
DMStorageCustomEventFinished
DMSuspendSchedule
DMSwapRcuFileName
DMTranslateToOriginalGPSIndex
DMTranslateToOriginalPointIndex
DMUnInitalAgent
DMUnInitializeReport
DMUnInitialize_JobManager
DMUninitPOLQALicense
DMUpLoadFile
DMWaitForSwapDataIsReady
DMWriteATPort
DMWriteBaseInfo_UnifyKPI
DMWriteDelayDetailInfo_UnifyKPI
DMWriteEvent
DMWriteKPIDetail_UnifyKPI
DMWriteKPIValue_UnifyKPI
DMWriteLOGInfo_UnifyKPI
DMWritePort
DMWriteSceneInfo_UnifyKPI
DM_InitialEx
DM_SLM_GetDongleCount
DM_SLM_GetDongleKey
DM_SLM_GetDongleTime
DM_SLM_GetLicenseBool
DM_SLM_GetLicenseEndTime
DM_SLM_GetLicenseString
DM_SLM_Init
DM_SLM_Uninit
DM_UnInitial
DMftp_dir_connect
DMftp_dir_init
DMftp_dir_list
DMftp_dir_uninit
DMget_dir_count
DMget_dir_name
DMget_file_count
DMget_file_name
DestroyClient
GetConfig
GetUploadedSize
HaveIndoorMarked
InitClient
KillSubBTUProcess
SendAlarm
SendClearAlarm
SendEvent
SendGps
StopUpload
UploadData
UploadDataRealTime
UploadZipData
UploadZipDataRealTime

Sections

.text
Size: - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mark
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata3
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox3
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2cafc3fb268977b740385095ff45e7c

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

52:f8:79:2e:07:19:49:53:59:16:e1:4fCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:08:9c:51:abCertificate

Extended Key Usages

Key Usages

7f:24:35:19:36:d1:b9:0f:77:c4:8f:86:5d:75:a2:21:ef:6c:42:8b:09:16:af:9d:fc:a1:66:13:fc:ea:19:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

setupapi

advapi32

ole32

nmeagpsdecoder

dinglircu

testmanager

ws2_32

iphlpapi

oleaut32

Exports

Exports

Sections

.text Size: - Virtual size: 5.0MB

.rdata Size: - Virtual size: 514KB

.data Size: - Virtual size: 138KB

.mark Size: - Virtual size: 512B

.virbox Size: - Virtual size: 5.8MB

.vdata3 Size: - Virtual size: 28KB

.virbox3 Size: 228KB - Virtual size: 228KB

.reloc Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

52:f8:79:2e:07:19:49:53:59:16:e1:4f
Certificate

1e:b1:32:d5:08:9c:51:ab:0d:f2:6e:85:4e:b0:dd:a7
Certificate

1e:b1:32:d5:08:9c:51:ab
Certificate

7f:24:35:19:36:d1:b9:0f:77:c4:8f:86:5d:75:a2:21:ef:6c:42:8b:09:16:af:9d:fc:a1:66:13:fc:ea:19:80
Signer

.text
Size: - Virtual size: 5.0MB

.rdata
Size: - Virtual size: 514KB

.data
Size: - Virtual size: 138KB

.mark
Size: - Virtual size: 512B

.virbox
Size: - Virtual size: 5.8MB

.vdata3
Size: - Virtual size: 28KB

.virbox3
Size: 228KB - Virtual size: 228KB

.reloc
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB