wdcrwv[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wdcrwv.dll
Size

135KB
MD5

1c0510ae03a95b55a4a235e7c5b0f862
SHA1

131a6536cd4ea77672acbed0ee933f11b1bd5cfa
SHA256

aa8997c9037cfaf532c232c22a538c856aa722df98319f4979cb9072c16425bd
SHA512

da90bbbec9499c0d9c2e1882743cbfe5a5590450230e83e6d5df63cecf6da79cde1c91404c093a421d931d5398db94ae1aabb2101024671d67591b1b40cf4870
SSDEEP

3072:6z1oQosWs58bQ807tKHQuN4q14FlomDodgd:AoQJ58bWo1Rd6

Score

1^/10

Malware Config

Signatures

Files

wdcrwv.dll
.dll windows:4 windows x86 arch:x86

5d2fe6ff904577ef6af330fc74bc8282

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

17/05/2019, 08:43

Not After

16/06/2020, 08:43

Subject

CN=易联众智能（厦门）科技有限公司,O=易联众智能（厦门）科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:ea:c3:f2:15:3e:db:8a:cb:0a:79:7f:24:56:1e:71:ff:14:69:c3:6f:bc:c1:6a:6b:7b:da:04:b7:a6:a7:46
Signer

Actual PE Digest

28:ea:c3:f2:15:3e:db:8a:cb:0a:79:7f:24:56:1e:71:ff:14:69:c3:6f:bc:c1:6a:6b:7b:da:04:b7:a6:a7:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA

hid

HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_GetFeature
HidD_SetFeature
HidD_GetHidGuid
HidD_GetAttributes

advapi32

OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

winscard

SCardListReadersA
SCardFreeMemory
SCardReleaseContext
SCardEstablishContext
SCardTransmit
SCardConnectA
SCardDisconnect
g_rgSCardT1Pci
g_rgSCardT0Pci

ws2_32

connect
htons
inet_addr
WSACleanup
socket
WSAStartup
recv
send
closesocket

kernel32

GetProcAddress
LoadLibraryA
SetStdHandle
CreateEventA
GetStringTypeW
GetStringTypeA
SetFilePointer
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetOEMCP
SetCommTimeouts
GetCommTimeouts
SetCommState
CloseHandle
GetCommState
CreateFileA
ReadFile
PurgeComm
GetTickCount
Sleep
GetLastError
HeapAlloc
HeapFree
lstrlenA
DeviceIoControl
GetVersionExA
WaitForSingleObject
ResetEvent
CreateThread
SetEvent
GetOverlappedResult
WriteFile
SetLastError
GetPrivateProfileStringA
DisconnectNamedPipe
FlushFileBuffers
ConnectNamedPipe
CreateNamedPipeA
WaitCommEvent
SetCommMask
GetCommMask
LocalFree
LocalAlloc
CreateMutexA
ReleaseMutex
GetModuleFileNameA
RtlUnwind
InterlockedDecrement
InterlockedIncrement
HeapSize
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetACP

Exports

Exports

BinToCHex
CHexToBin
CT_DES
CT_Get_Param
CT_Set_Param
CT_close
CT_open
CT_openByInterface
CT_openCOMEx
CT_openUSB_ByPort
CT_read_I2C
CT_read_RAM
CT_version
CT_write_I2C
CT_write_RAM
Create_Mutex
DEScrypt
DESdecrypt
DESsubkey
Demo_CheckCardStateByCTS
Destroy_Mutex
FlashDiskTransmit
ICC_Transmit
ICC_TransmitAPDU
ICC_TransmitAPDU32
ICC_ccid_Transmit
ICC_present
ICC_read_file
ICC_reset
ICC_resetVB
ICC_set_NAD
ICC_tsi_api
ICC_tsi_apiFlashDisk
ICC_tsi_apiT0
ICC_tsi_apiT0VB
ICC_tsi_apiVB
ICC_write_file
IsKeyInsert
Lock_Mutex
MEM_AT153_Auth
MEM_AT1608_Auth
MEM_AT45_Status
MEM_AT88_SetFusepin
MEM_GetType
MEM_Reset
MEM_SetType
MEM_change_pin
MEM_erase_bit
MEM_read_bin
MEM_read_bin_p
MEM_read_bit
MEM_verify
MEM_write_bin
MEM_write_bin_p
MEM_write_bit
Mifare1_DecreaseAmount
Mifare1_Halt
Mifare1_IncreaseAmount
Mifare1_InitAmount
Mifare1_RC531Key
Mifare1_Read
Mifare1_Reset
Mifare1_Verify
Mifare1_Write
SHA1
SHA1VB
SingleDES
SingleDESVB
SingleMAC
SingleMACVB
TripleDES
TripleDESVB
TripleMAC
TripleMACVB
UP_Transmit
UP_close
UP_open
UnLock_Mutex
Up_CT_version
ZTE_CloseChannel
ZTE_ICC_tsi_apiFlashDisk
ZTE_RequestChannel
ZZSetTimeOut

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d2fe6ff904577ef6af330fc74bc8282

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

28:ea:c3:f2:15:3e:db:8a:cb:0a:79:7f:24:56:1e:71:ff:14:69:c3:6f:bc:c1:6a:6b:7b:da:04:b7:a6:a7:46Signer

Headers

File Characteristics

Imports

setupapi

hid

advapi32

winscard

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 93KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 992B

.reloc Size: 8KB - Virtual size: 5KB

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

28:ea:c3:f2:15:3e:db:8a:cb:0a:79:7f:24:56:1e:71:ff:14:69:c3:6f:bc:c1:6a:6b:7b:da:04:b7:a6:a7:46
Signer

.text
Size: 96KB - Virtual size: 93KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 992B

.reloc
Size: 8KB - Virtual size: 5KB