D:\192.168.2.24-SmartECGNet\SDK\Trunk\ECGView\ECGViewerOCX\Release\SamplingDeviceDetect.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1c814c6733677d07a272912d4513baebf2c498ee79148fc833b9944f1158f2a0.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1c814c6733677d07a272912d4513baebf2c498ee79148fc833b9944f1158f2a0.dll
Resource
win10v2004-20240412-en
General
-
Target
1c814c6733677d07a272912d4513baebf2c498ee79148fc833b9944f1158f2a0
-
Size
36KB
-
MD5
8e297c8687c654000e87b55a6ebef884
-
SHA1
e9d33543b052704ab44b5aaf254a7ee306de3fd8
-
SHA256
1c814c6733677d07a272912d4513baebf2c498ee79148fc833b9944f1158f2a0
-
SHA512
86d8fc18b20dedc1f58431d6c193ed253e45f7f6ced850f237fb1cfb50a9f476c166037e121a6e9cfe7651255be70398568800bf6671f62138a0877f68882ff0
-
SSDEEP
384:TB30hSBrB14IIS3CztkOjsXdG4PZzFmUBD4VCr7lA+R6oB9EoGaLj3Uv5KLScGlf:ldx1gkO4zrfQ5KLiviOwjDdOf7+MwG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c814c6733677d07a272912d4513baebf2c498ee79148fc833b9944f1158f2a0
Files
-
1c814c6733677d07a272912d4513baebf2c498ee79148fc833b9944f1158f2a0.dll windows:5 windows x86 arch:x86
462496c93e8c81ee869fdc0b6716aeaf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mfc100u
ord286
ord1720
ord11544
ord2614
ord5264
ord285
ord2629
ord7524
ord11838
ord1476
ord4290
ord11784
ord13854
ord4744
ord2164
ord11476
ord11477
ord13381
ord7108
ord13387
ord8530
ord3684
ord3625
ord11864
ord7126
ord1739
ord14162
ord10976
ord13267
ord11469
ord7179
ord13570
ord13567
ord13572
ord13569
ord13571
ord13568
ord3416
ord5261
ord11228
ord11236
ord4086
ord7391
ord9498
ord11240
ord11209
ord4642
ord4923
ord5115
ord8483
ord4901
ord5118
ord4645
ord4794
ord4623
ord6931
ord6932
ord6922
ord4792
ord7393
ord9328
ord8346
ord6140
ord902
ord4207
ord2062
ord280
ord1271
ord870
ord13605
ord322
ord7176
ord1292
ord890
ord6869
ord296
ord1721
ord908
ord2091
ord2055
ord2053
ord2080
ord1984
ord2045
ord3413
ord408
ord1953
ord2090
ord2088
ord1945
ord1873
ord1934
ord323
ord1301
ord1298
ord265
ord11683
ord7624
ord11845
ord7548
ord266
ord1300
msvcr100
_purecall
memcpy
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__CxxFrameHandler3
memset
swprintf_s
_wtoi
kernel32
ResetEvent
EncodePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
CloseHandle
LocalAlloc
LocalFree
GetCommMask
WaitForMultipleObjects
WaitCommEvent
Sleep
GetTickCount
WaitForSingleObject
GetOverlappedResult
ReadFile
GetLastError
WriteFile
PurgeComm
ClearCommError
SetCommState
BuildCommDCBW
GetCommState
SetCommMask
SetCommTimeouts
SetupComm
CreateFileW
CreateEventW
advapi32
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
Exports
Exports
GetDeviceTypeAndSerialNoV2
GetFirmwareVersion
GetReceiverAddress
GetSampleBoxInfo
GetSampleBoxPort
GetTypeAndSerialNo
IsDX12SamplingboxON
IsSE12SampleDevice
IsSamlingBoxExist
SetDeviceType
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ