SSCardDriver[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SSCardDriver.dll
Size

191KB
MD5

8d983e175ea6992397d719d2451d41fa
SHA1

40d76f8d8c7299de1fdee050db44a9365d8f9cbc
SHA256

3747e2c6109170753afd7224d6c1922756fe5eafd69916806a44ac5bbfc38854
SHA512

1e282f84f9f4ada1a1217ee91dc2bd4b8ef0f76f65148a07f043a21b2ac0ffac28f8ffaa6ff6e0f9f412a4eae80aa06c153f3012b5cedf0455e6ad078f4f2b22
SSDEEP

3072:1dpAFZ+3/EeGtEVEkhtYw/GmGvbiQsKpaXfZjin23WxezROH3StkmZNAthlB3tQk:lvG0Ekhuw/GmwiQdpaR3XwH3SXZ+/6jQ

Score

1^/10

Malware Config

Signatures

Files

SSCardDriver.dll
.dll windows:4 windows x86 arch:x86

93f06e3467f8d97dd1f0dee817e2d738

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

17/05/2019, 08:43

Not After

16/06/2020, 08:43

Subject

CN=易联众智能（厦门）科技有限公司,O=易联众智能（厦门）科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:bc:95:77:c4:c8:91:c2:50:0d:30:8f:08:0f:32:6c:89:75:c1:c6:af:a3:e9:1e:90:ab:b5:19:8e:8c:1b:d0
Signer

Actual PE Digest

33:bc:95:77:c4:c8:91:c2:50:0d:30:8f:08:0f:32:6c:89:75:c1:c6:af:a3:e9:1e:90:ab:b5:19:8e:8c:1b:d0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

h:\0 对外发布的版本\读卡器\10 跨省结算\04 20191022 2.3.0.4 加入0005序列号和加防破解\YLZ_SSCardDriver\Release\YLZ_SSCardDriver.pdb

Imports

kernel32

GetCurrentProcess
ExitProcess
HeapFree
HeapAlloc
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
HeapSize
HeapReAlloc
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetOEMCP
GetCPInfo
GlobalFlags
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
InterlockedIncrement
SetErrorMode
lstrcpyA
lstrcatA
GetCurrentThreadId
CloseHandle
InterlockedDecrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
SetLastError
GlobalFree
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
Sleep
GetModuleFileNameA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetTickCount
GetModuleHandleA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
LoadLibraryA
GetProcAddress
FreeLibrary
lstrlenA
lstrcmpiA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetSystemTimeAsFileTime
IsBadReadPtr

user32

PostQuitMessage
DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
SetWindowTextA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
LoadIconA
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
UnregisterClassA
GetSubMenu
GetMenuItemCount
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetMessagePos
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
ValidateRect
PeekMessageA
GetKeyState
SendMessageA
DispatchMessageA
CallNextHookEx
SetWindowsHookExA
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush

gdi32

TextOutA
DeleteDC
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ExtTextOutA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA

comctl32

ord17

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

iChangePIN
iDoDebit
iDoDebit_HSM_Step1
iDoDebit_HSM_Step2
iReadCard
iReadCardBas
iReadCardBas_HSM_Step1
iReadCardBas_HSM_Step2
iReadCard_HSM_Step1
iReadCard_HSM_Step2
iReadDebitRecord
iReloadPIN
iReloadPIN_HSM_Step1
iReloadPIN_HSM_Step2
iReloadPIN_HSM_Step3
iUnblockPIN
iUnblockPIN_HSM_Step1
iUnblockPIN_HSM_Step2
iUnblockPIN_HSM_Step3
iVerifyPIN
iWriteCard
iWriteCard_HSM_Step1
iWriteCard_HSM_Step2

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.scode
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93f06e3467f8d97dd1f0dee817e2d738

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

33:bc:95:77:c4:c8:91:c2:50:0d:30:8f:08:0f:32:6c:89:75:c1:c6:af:a3:e9:1e:90:ab:b5:19:8e:8c:1b:d0Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.scode Size: 12KB - Virtual size: 9KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 45KB

.rsrc Size: 16KB - Virtual size: 14KB

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

33:bc:95:77:c4:c8:91:c2:50:0d:30:8f:08:0f:32:6c:89:75:c1:c6:af:a3:e9:1e:90:ab:b5:19:8e:8c:1b:d0
Signer

.text
Size: 120KB - Virtual size: 117KB

.scode
Size: 12KB - Virtual size: 9KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 45KB

.rsrc
Size: 16KB - Virtual size: 14KB