ef3b8e683118f4d7b0c02d7b5183b117943869e8171019f06a169ba41e69d995

Sharing

Copy URL Twitter E-mail

General

Target

ef3b8e683118f4d7b0c02d7b5183b117943869e8171019f06a169ba41e69d995
Size

126KB
MD5

cf0d32ca93cdc215c22e1d175b753937
SHA1

54d3c6f068df06b12f87a18dda7cf5865d33594f
SHA256

ef3b8e683118f4d7b0c02d7b5183b117943869e8171019f06a169ba41e69d995
SHA512

0f994deca587502ac91dcbcb7f24c48954688ef53a0485d86c68ea3edb7a28a45fb8b267f5b99a7d61e4c795c5bdb3eda0850be245c7489bb2d596e9c6ba2ebc
SSDEEP

3072:MeDzxBCPxVRWmdk2lQBV+UdE+rECWp7hKpC0:TCbR6BV+UdvrEFp7hK5

Score

1^/10

Malware Config

Signatures

Files

ef3b8e683118f4d7b0c02d7b5183b117943869e8171019f06a169ba41e69d995
.dll windows:5 windows x86 arch:x86

fa0b8257c8c1fc38c8b050f58603bac0

Code Sign

33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2021, 17:55

Not After

16/06/2022, 17:55

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:5d:69:8e:19:82:2e:e9:6d:bf:05:51:fa:db:b1:34:ad:db:f9:73:7e:b0:53:56:f8:31:5a:55:11:64:2c:8b
Signer

Actual PE Digest

60:5d:69:8e:19:82:2e:e9:6d:bf:05:51:fa:db:b1:34:ad:db:f9:73:7e:b0:53:56:f8:31:5a:55:11:64:2c:8b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_w2K_x86\i386\CH341PORTS.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
wcscspn
wcsspn
_itoa
_wcsupr
wcstombs
strstr
_strupr
wcslen
wcsstr
swprintf
wcscpy
wcscat
wcschr
wcscmp

setupapi

SetupDiGetDeviceInfoListDetailW
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupCloseInfFile
SetupInstallFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiCreateDevRegKeyW
CM_Free_Log_Conf_Handle
CM_Free_Res_Des_Handle
CM_Get_Res_Des_Data
CM_Get_Next_Res_Des
CM_Get_First_Log_Conf
SetupDiInstallDevice
CM_Get_DevNode_Status
SetupDiRemoveDevice
SetupDiGetDeviceInstanceIdW
SetupDiCallClassInstaller

user32

CharNextW
SendMessageTimeoutW
wvsprintfW
MessageBoxW
CharPrevW
DialogBoxParamW
GetDlgCtrlID
ShowWindow
IsDlgButtonChecked
GetWindowTextLengthW
GetWindowTextW
CheckDlgButton
SetDlgItemTextW
wsprintfW
SetWindowTextW
GetFocus
SetWindowLongW
EnableWindow
GetWindowLongW
EndDialog
GetParent
SendDlgItemMessageW
GetDlgItem
LoadStringW
CheckRadioButton
WinHelpW
SendMessageW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW

kernel32

Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
GetCurrentProcess
TerminateProcess
GetTickCount
MultiByteToWideChar
DisableThreadLibraryCalls
QueryDosDeviceW
CreateFileW
CloseHandle
DefineDosDeviceW
GetUserDefaultLangID
GetLastError
lstrcatW
GetProfileStringW
lstrlenW
WriteProfileStringW
lstrcmpW
GetUserDefaultLCID
GetLocaleInfoW
lstrcpyW
LocalFree
LocalAlloc
SetLastError
lstrcmpiW

comctl32

DestroyPropertySheetPage
CreatePropertySheetPageW

msports

ComDBReleasePort
ComDBClose
ComDBOpen
ComDBClaimNextFreePort
ComDBClaimPort
ComDBGetCurrentPortUsage

Exports

Exports

ParallelPortPropPageProvider
PortsClassInstaller
SerialPortPropPageProvider

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa0b8257c8c1fc38c8b050f58603bac0

Code Sign

33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

60:5d:69:8e:19:82:2e:e9:6d:bf:05:51:fa:db:b1:34:ad:db:f9:73:7e:b0:53:56:f8:31:5a:55:11:64:2c:8bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

setupapi

user32

advapi32

kernel32

comctl32

msports

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

60:5d:69:8e:19:82:2e:e9:6d:bf:05:51:fa:db:b1:34:ad:db:f9:73:7e:b0:53:56:f8:31:5a:55:11:64:2c:8b
Signer

.text
Size: 24KB - Virtual size: 23KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 2KB - Virtual size: 1KB