c97c15997320583f8f5d0f38b3d89013caac93b3517e6b425dc331ba5aa787a2

Sharing

Copy URL Twitter E-mail

General

Target

c97c15997320583f8f5d0f38b3d89013caac93b3517e6b425dc331ba5aa787a2
Size

431KB
MD5

6f18920647492a2a10b1b1ecb52dc285
SHA1

bc961aa05c831b647d2e227007fcda1ebf44fa64
SHA256

c97c15997320583f8f5d0f38b3d89013caac93b3517e6b425dc331ba5aa787a2
SHA512

a9ff1547255fb09b7c2da34f917a01cb340e808715517a3d748d8603b9caa1d7d007a58f108ae87ba551532d505cac39d2e2155617c8cb8be06d321505752a9a
SSDEEP

6144:+NS3eSRQMUdJtE9sQ6hIAjkjpVJF3+7MnNY3L7jFNUTYP9er/VcyPlvjiBV+Udv/:D3eSRQ7Zjk9R+//jz9eLlbiBjvrEH7K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c97c15997320583f8f5d0f38b3d89013caac93b3517e6b425dc331ba5aa787a2

Files

c97c15997320583f8f5d0f38b3d89013caac93b3517e6b425dc331ba5aa787a2
.dll windows:6 windows x86 arch:x86

205619d55f25373530e7495873acb68e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Scr\Mes2.0\SPRD_MES_DLL_V2.0\Unisoc_Solution_MES\Unisoc_Solution_MES\Common\Lib\Unisoc_Solution_MES.pdb

Imports

unisoc_solution_printlog

PLOG_Print_Detail_Log
PLOG_Handle_Release
PLOG_Handle_Create
PLOG_Set_Log_Param

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
CloseHandle
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
lstrlenW
DeleteFileA
CreateFileA
WriteFile
VirtualQuery
GetModuleFileNameA
GetPrivateProfileStringA
InitializeCriticalSection
GetLocalTime
CreateDirectoryA
FormatMessageW
LocalAlloc
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
Sleep
GetTickCount
GetModuleFileNameW
ReadFile
FindFirstFileA
GetComputerNameExA
GetVersionExA
CreatePipe
GetStartupInfoW
CreateProcessW
ClearCommError
PurgeComm
OpenMutexA
CreateMutexA
ReleaseMutex
CreateFileMappingW
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
LocalFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
OutputDebugStringW

user32

wsprintfW

ole32

CoInitialize
OleRun
CoCreateInstance
CoUninitialize
CoCreateGuid

oleaut32

VariantClear
VariantChangeType
VariantCopy
VariantInit
SysFreeString
SysAllocString
GetErrorInfo

msvcp140

??0_Locinfo@std@@QAE@PBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Strcoll
_Strxfrm
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ

shlwapi

PathIsDirectoryA
PathFileExistsA

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetOption
WinHttpQueryOption
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle

ws2_32

gethostname
WSAStartup
inet_ntoa
gethostbyname

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

vcruntime140

memset
memcpy
memchr
__std_type_info_destroy_list
_except_handler4_common
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
wcsstr
wcsrchr
strchr
_CxxThrowException
memmove

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
_seh_filter_dll

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsnlen
wmemcpy_s
wcscpy_s
strncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf

api-ms-win-crt-convert-l1-1-0

atoi
_wtoi
atof
wcstol
_wtoi64

api-ms-win-crt-filesystem-l1-1-0

rename
_splitpath_s

api-ms-win-crt-time-l1-1-0

_time64
_mktime64

Exports

Exports

MES_CheckFlow
MES_CheckSnInput
MES_Check_Rule_BT
MES_Check_Rule_IMEI
MES_Check_Rule_MEID
MES_Check_Rule_WIFI
MES_EnableCheck
MES_GetAssignedCodes
MES_GetBatchName
MES_GetDeviceCode
MES_GetLastError
MES_GetMesIniInfo
MES_GetMesLogPath
MES_GetMesType
MES_GetStationName
MES_Get_Host_IP
MES_Get_Host_MAC
MES_Get_Host_Os
MES_Get_Host_PCName
MES_Get_Tool_Info
MES_Handle_Create
MES_Handle_Release
MES_Handle_ReleaseAll
MES_Login
MES_Logout
MES_New_Guid
MES_RecordAssignedCodes_ExtendedField
MES_RecordDeviceInfos
MES_SendTestData
MES_SendTestResult
MES_SnInput
MES_V1_BeginTran
MES_V1_CommitTran
MES_V1_GetBatchInfo
MES_V1_GetNfcCLPC
MES_V1_GetServerTime
MES_V1_GetSimCCID
MES_V1_GetStationListByBatch
MES_V1_MDB_Bak_Connect
MES_V1_MDB_Bak_DeleteTestValue
MES_V1_MDB_Bak_DisConnect
MES_V1_MDB_Bak_GetAllTestValue
MES_V1_MDB_Bak_QueryTestValue
MES_V1_MDB_Connect
MES_V1_MDB_Disconnect
MES_V1_MDB_Init
MES_V1_MDB_WriteTestValue
MES_V1_QueryAccount
MES_V1_QueryBatch
MES_V1_QueryStation
MES_V1_RollbackTran
MES_V1_UpdateNfcCLPC
MES_V1_UpdateSimCCID
MES_V2_CheckTestTool
MES_V2_GetBatchArray
MES_V2_GetBatchArrayBuffLength
MES_V2_GetBatchInfo
MES_V2_GetBatchList
MES_V2_GetCurrentSeqFileInfo
MES_V2_GetDbList
MES_V2_GetDocumentListEx
MES_V2_GetFacotryList
MES_V2_GetHouse
MES_V2_GetHouseList
MES_V2_GetLine
MES_V2_GetLineList
MES_V2_GetLogUploadUrl
MES_V2_GetProcessFlow
MES_V2_GetSequenceFile
MES_V2_GetStationByMac
MES_V2_GetUploadDataLogConfig
MES_V2_IsSNEntry
MES_V2_JudgeStationExistByMac
MES_V2_SaveStation
MES_V2_SendDatabase
MES_V2_SendTestDataLog
MES_V2_SendTestEnvironment
MES_V2_SendTestToolInfo

Sections

.text
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

205619d55f25373530e7495873acb68e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

unisoc_solution_printlog

kernel32

user32

ole32

oleaut32

msvcp140

shlwapi

winhttp

ws2_32

version

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 291KB - Virtual size: 290KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 291KB - Virtual size: 290KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB