SoulLogin[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SoulLogin.dll
Size

269KB
MD5

2e3b95fccc85e9da05286e8c1bce6092
SHA1

85a685157a844be301575d228aae8d4ba70548e6
SHA256

a27641f624e6921b6abd0e92fe8d97841ab5bf07ebdbfaa83b087fac2b84a0f1
SHA512

39138101bb2df3223612f5271aa444122d56e068fbfedff90b479715417acc20fb45e5339f2784f3d8512b0cbe5877bd07597da9866b2c28a532affc3fbdc765
SSDEEP

6144:1izKYFGw6kS5ehtjitfcbHBPNOtEhye+Nio8:1Akw6d5ehRHX+N98

Score

1^/10

Malware Config

Signatures

Files

SoulLogin.dll
.dll windows:5 windows x86 arch:x86

f7cfcc15573c5d134c71ff2c9ffa9051

Code Sign

0e:2b:22:41:f5:a0:16:dc:01:06:27:4a:a1:5e:15:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

02/04/2019, 00:00

Not After

05/04/2022, 12:00

Subject

CN=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,OU=Research and development department,O=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:fb:59:3a:77:97:ab:36:54:ee:e3:95:04:20:c0:1c:1d:40:8f:aa
Signer

Actual PE Digest

5f:fb:59:3a:77:97:ab:36:54:ee:e3:95:04:20:c0:1c:1d:40:8f:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\MyCode\Release\春节嘉年华\VS2008_Proj\Bin\Release_DX9\SoulLogin.pdb

Imports

basecode

?SetString@CEncryptString@@QAEXPBD@Z
?GetString@CEncryptString@@QBEPBDXZ
?LogMsg@@YAXPBDZZ
??1CMyString@@UAE@XZ
?format@CMyString@@QAAXPBDZZ
??0CMyString@@QAE@PBD@Z
?LogProfileMsg@@YAXPBDZZ
?SetEnString@CEncryptString@@QAEXAAV1@@Z
?RandGet@CEncryptString@@QAEHHH@Z
?GetTheDayBeginTimeByLocalZone@@YA_J_J@Z
?ConvertRc5Buf@CEncryptString@@QAEXPAVCRc5_321216@@PADH@Z
?GetLength@CEncryptString@@QAEHXZ
?IniStrGet@@YAHPBD00PADH@Z
?SetClientLoginWay@@YAXK@Z
?SetKey@CEncryptString@@QAEXQBKK@Z
?CreateRc5@CEncryptString@@SAXXZ
?DestroyRc5@CEncryptString@@SAXXZ
?SetLocate@CEncryptString@@QAEXID@Z
?GetLocate@CEncryptString@@QAEDI@Z
?toLower@strutil@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?ErrorOut@@YAXPBDZZ
?CreateCryptor@@YAPAVIEncryptor@@EEEEEEEE@Z
?TimeGet@@YAKXZ
?IniDataGet@@YAHPBD00AAHH@Z
?GetString@CEncryptString@@QAEPADPADI@Z
??0CEncryptString@@QAE@XZ
??4CEncryptString@@QAEXPBD@Z
?SafeStrcpy@@YAXPADPBDH@Z
??_7CEncryptString@@6B@
?Rc5InitKey@CRc5_321216@@QAEXQBE@Z
??1CEncryptString@@UAE@XZ

ws2_32

sendto
inet_addr
inet_ntoa
WSAGetLastError
recvfrom
gethostbyname
WSAStartup
setsockopt
socket
closesocket
send
recv
htons
ioctlsocket
connect
select
__WSAFDIsSet
WSACleanup

dinput8

DirectInput8Create

accountbind

ord2
ord1

gamedata

RoleDataQueryEx

ndgameprotect

EnCodeDate
ChangeDate
NdGetDeviceStateEx
InstallHookEx
UninstallHookEx

graphic

?GameCameraSet@CMyBitmap@@SAXMMMK@Z
?GetScreenHeight@CMyBitmap@@SAHXZ
?GetScreenWidth@CMyBitmap@@SAHXZ

simflash

FlashSimulatorDestroy
FlashSimulatorQuery

tqwea

ord82
ord89

tqpackage

?TqFOpen@@YA?AW4TQPRESULT@@PBDAAPAX@Z
?TqFClose@@YA?AW4TQPRESULT@@PAX@Z
?TqFGetLen@@YAJPAX@Z
?TQFRead@@YAJPAXKK0@Z

msvcp90

??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

mfc90

ord2961
ord5636
ord6170
ord3534
ord1183
ord2106
ord3477
ord1358
ord1357
ord2587
ord636
ord2097
ord4529
ord4151
ord1490
ord4029
ord793
ord589
ord3659
ord4667
ord4890
ord3110
ord6001
ord5646
ord5663
ord4981
ord4333
ord2447
ord5659
ord5657
ord3209
ord2087
ord4199
ord5813
ord6721
ord5533
ord1046
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord4159
ord6783
ord4409
ord4434
ord4197
ord1098
ord1087
ord321
ord4384
ord1062
ord6557
ord6788
ord796
ord595
ord5647
ord1497
ord6391
ord3346
ord1746
ord3940
ord4281
ord4030
ord6291
ord6780
ord3987
ord4760
ord4617
ord5152
ord5309
ord2208
ord1810
ord1809
ord1678
ord3344
ord6388
ord1755
ord1752
ord4331
ord1496
ord4650
ord5585
ord2074
ord5497
ord4589
ord3732
ord5139
ord4688
ord1729
ord4993
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4668
ord3506
ord374
ord639
ord2360
ord578
ord6800
ord1568
ord780
ord266
ord4477
ord5835
ord310
ord2539
ord945
ord4311
ord4375
ord2069
ord2592
ord1137
ord798
ord3213
ord305
ord6613
ord3178
ord1611
ord2691
ord6584
ord3949
ord316
ord820
ord4222
ord910
ord2481
ord5924
ord601
ord800
ord2084
ord391
ord1152
ord5963
ord4392
ord6446
ord817
ord1277
ord1275
ord1233
ord1180
ord1145
ord1075
ord322
ord801
ord367
ord5615
ord605
ord1278
ord1243
ord1241
ord1268
ord392

msvcr90

rand
srand
feof
strncmp
_strupr
fscanf
printf
__iob_func
fprintf
_getpid
_ltoa
strstr
atol
_itoa
strtol
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
atoi
memcpy
?_open@@YAHPBDHH@Z
__CxxFrameHandler3
_lseeki64
_read
fread
??0exception@std@@QAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
strchr
_time64
_mktime64
_localtime64
strncpy
memset
fopen
sprintf
fgets
sscanf
fclose
_snprintf
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
exit

kernel32

GetModuleFileNameA
LocalFree
CreateProcessA
Sleep
DeleteFileA
InterlockedExchange
LocalAlloc
CopyFileA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
GetCurrentDirectoryA
WritePrivateProfileStringA
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
InterlockedCompareExchange
TerminateProcess
GlobalFree

user32

GetKeyState
keybd_event
GetFocus
GetDC
EnableWindow
GetActiveWindow
PostMessageA
KillTimer
SetTimer
SetRect
IsWindowVisible
BringWindowToTop
MessageBoxA

gdi32

CreateDIBSection
SelectObject
GetObjectA
BitBlt
ExtCreateRegion
CombineRgn
DeleteObject
DeleteDC
CreateCompatibleBitmap
CreatePatternBrush
CreateCompatibleDC

advapi32

RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegQueryValueExA
RegSetValueExA

ole32

CreateStreamOnHGlobal

oleaut32

SysFreeString
OleLoadPicture

dnsapi

DnsQuery_A
DnsRecordListFree

Exports

Exports

LoginAccount
LoginAutoLogin
LoginCrcCheck1
LoginCreate
LoginDestroy
LoginDestroyFlash
LoginGetAccount
LoginGetAccountServer
LoginGetAreaAmount
LoginGetAreaName
LoginGetAreaServerAmount
LoginGetAreaServerDispName
LoginGetAreaServerName
LoginGetHistoryAccount
LoginGetHistoryAccountNum
LoginGetServerName
LoginGetServerPage
LoginIgnoreSvrOver
LoginInit
LoginIsWndShow
LoginOemLogin
LoginPlayLogin
LoginPreTranslateMessage
LoginProcess
LoginQuickLogin
LoginRenderFlash
LoginResetLogin
LoginSetAccount
LoginSetCheckNumEx
LoginSetCurServerInfo
LoginSetFirstStatus
LoginSetFlash
LoginSetLastAccount
LoginSetLogo
LoginSetMacaddress
LoginSetMainWnd
LoginSetServerPage
LoginSetVersion
LoginShowLogo
LoginShowLogoEnd
LoginShowWnd
LoginUser
LoginWeiXinLogin

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7cfcc15573c5d134c71ff2c9ffa9051

Code Sign

0e:2b:22:41:f5:a0:16:dc:01:06:27:4a:a1:5e:15:deCertificate

Extended Key Usages

Key Usages

5f:fb:59:3a:77:97:ab:36:54:ee:e3:95:04:20:c0:1c:1d:40:8f:aaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

basecode

ws2_32

dinput8

accountbind

gamedata

ndgameprotect

graphic

simflash

tqwea

tqpackage

msvcp90

mfc90

msvcr90

kernel32

user32

gdi32

advapi32

ole32

oleaut32

dnsapi

Exports

Exports

Sections

.text Size: 192KB - Virtual size: 192KB

.rdata Size: 49KB - Virtual size: 49KB

.data Size: 7KB - Virtual size: 37KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

0e:2b:22:41:f5:a0:16:dc:01:06:27:4a:a1:5e:15:de
Certificate

5f:fb:59:3a:77:97:ab:36:54:ee:e3:95:04:20:c0:1c:1d:40:8f:aa
Signer

.text
Size: 192KB - Virtual size: 192KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 7KB - Virtual size: 37KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB