dcic32[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dcic32.dll
Size

224KB
MD5

c8c0a3e7b0c4d70c6557f154b608dc57
SHA1

9c8f9934f25e43823d3f428bf2dbc4814c74e3d1
SHA256

4def6e06c9bb38b0e301f4282c1aa9c2fff4d312d7d118923bc3c91d0914fc54
SHA512

2466ffabb25d67018dcfacb0eaf01e406e006fcbf044aa303dfd35dcbe1b6ded0d690f471825720a4588957b39b401cdad01ad097ea601f1591600cf949546c3
SSDEEP

3072:/PdiTj7r19x4NfCEsuJ4xDji+AOmknUqk8NPTjxtClj0n8sHkKTWUlrekOGrafic:/PdiDxafCPxDjAxknUqk8dxteLkZmfic

Score

1^/10

Malware Config

Signatures

Files

dcic32.dll
.dll windows:5 windows x86 arch:x86

0f22e74c83e5c37ad9cabf4ff7993bea

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17-04-2018 08:20

Not After

18-05-2027 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

17-05-2019 08:43

Not After

16-06-2020 08:43

Subject

CN=易联众智能（厦门）科技有限公司,O=易联众智能（厦门）科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:be:91:e0:9b:a2:88:ec:57:f8:18:28:62:b4:12:d1:a1:6f:c7:b6:aa:03:27:44:06:d4:eb:41:37:ac:3c:4f
Signer

Actual PE Digest

3e:be:91:e0:9b:a2:88:ec:57:f8:18:28:62:b4:12:d1:a1:6f:c7:b6:aa:03:27:44:06:d4:eb:41:37:ac:3c:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\weiyang\me\work\通用产品开发\dcic32_ylz\Release\dcic32.pdb

Imports

kernel32

CreateFileA
GetCommState
CloseHandle
SetCommTimeouts
GetTickCount
SetCommState
GetLastError
DecodePointer
WriteConsoleW
SetEndOfFile
Sleep
SetupComm
PurgeComm
GetModuleFileNameA
WriteFile
HeapReAlloc
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
SetStdHandle
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetModuleFileNameW
InterlockedFlushSList
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
GetACP
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetCommandLineA
GetCommandLineW
ReadFile

user32

DestroyWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
PeekMessageA
UnregisterClassA
RegisterClassExA
DispatchMessageA

hid

HidD_SetFeature
HidD_GetFeature
HidD_GetHidGuid
HidD_GetAttributes

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shlwapi

PathRemoveFileSpecA

advapi32

SystemFunction036

Exports

Exports

Authenticate
Authenticate_Hex
DEV_CommandMcu
DEV_CommandMcu_Hex
DEV_SendCommandMcu
DEV_SendCommandMcu_Hex
DEV_SetControl
ICC_External_Auth
ICC_Get_Challenge
ICC_Internal_Auth
ICC_Read_Bin
ICC_Select_File
ICC_Verify
ICC_Write_Bin
IC_Anticoll
IC_Anticoll2
IC_Attrib
IC_Attrib_Hex
IC_Authentication
IC_Authentication_Passaddr
IC_Authentication_Passaddrhex
IC_Beep
IC_Card
IC_Card_Hex
IC_ChangeAZPass_102
IC_ChangeAZPass_102hex
IC_ChangeAZPass_4404
IC_ChangeAZPass_4404hex
IC_ChangePass_102
IC_ChangePass_102hex
IC_ChangePass_1604
IC_ChangePass_1604B
IC_ChangePass_1604Bhex
IC_ChangePass_1604hex
IC_ChangePass_4404
IC_ChangePass_4404hex
IC_ChangePass_4428hex
IC_ChangePass_4442hex
IC_ChangePass_SLE4428
IC_ChangePass_SLE4442
IC_ChangeRPassword
IC_ChangeRPassword_Hex
IC_ChangeWPassword
IC_ChangeWPassword_Hex
IC_CheckAZPass_102
IC_CheckAZPass_102hex
IC_CheckAZPass_4404
IC_CheckAZPass_4404hex
IC_CheckAuth
IC_CheckAuth_Hex
IC_CheckCard
IC_CheckPass_102
IC_CheckPass_102hex
IC_CheckPass_1604
IC_CheckPass_1604B
IC_CheckPass_1604Bhex
IC_CheckPass_1604hex
IC_CheckPass_4404
IC_CheckPass_4404hex
IC_CheckPass_4406
IC_CheckPass_4406hex
IC_CheckPass_4406user
IC_CheckPass_4406userhex
IC_CheckPass_4428hex
IC_CheckPass_4442hex
IC_CheckPass_SLE4428
IC_CheckPass_SLE4442
IC_CheckRPassword
IC_CheckRPassword_Hex
IC_CheckWPassword
IC_CheckWPassword_Hex
IC_Check_102
IC_Check_1101
IC_Check_153
IC_Check_1604
IC_Check_1604B
IC_Check_1608
IC_Check_24C01
IC_Check_24C02
IC_Check_24C04
IC_Check_24C08
IC_Check_24C16
IC_Check_24C64
IC_Check_4404
IC_Check_4406
IC_Check_4428
IC_Check_4442
IC_Check_45DB041
IC_Check_CPU
IC_Config_Card
IC_Control
IC_CpuApdu
IC_CpuApduEXT
IC_CpuApduEXT_Hex
IC_CpuApduEn
IC_CpuApduEn_Hex
IC_CpuApduRespon
IC_CpuApduResponEXT
IC_CpuApduResponEXT_Hex
IC_CpuApduRespon_Hex
IC_CpuApduSource
IC_CpuApduSourceEXT
IC_CpuApduSourceEXT_Hex
IC_CpuApduSource_Hex
IC_CpuApdu_Hex
IC_CpuColdReset
IC_CpuColdReset_Hex
IC_CpuGetProtocol
IC_CpuHotReset
IC_CpuHotReset_Hex
IC_CpuReset
IC_CpuReset_Hex
IC_CpuSetProtocol
IC_CreatDesData
IC_CreatDesData_Hex
IC_CreatMacData
IC_CtlBackLight
IC_CtlLed
IC_CtlVoltage
IC_DEValue
IC_Decrement
IC_Decrypt
IC_Decrypt_Hex
IC_Decrypt_Neu
IC_DevBeep
IC_DirectRead
IC_DirectRead_Hex
IC_DirectWrite
IC_DirectWrite_Hex
IC_DispInfo
IC_DispInfoEn
IC_DispLcd
IC_DispMainInfo
IC_DispMainMenu
IC_Down
IC_EarseUserData
IC_Encrypt
IC_Encrypt_Hex
IC_Encrypt_Neu
IC_Erase
IC_Erase_102
IC_Erase_4406
IC_ExitComm
IC_Fuse_102
IC_Fuse_1604
IC_Fuse_1604B
IC_Fuse_4404
IC_Fuse_4406
IC_GetDeviceTime
IC_GetEnPass
IC_GetInputKey
IC_GetInputPass
IC_GetReaderTime
IC_GetUsbID
IC_GotoUpdate
IC_Halt
IC_IFD_ActWorkKey
IC_IFD_GetEnPINBlock
IC_IFD_GetEnPINPro
IC_IFD_GetPINPro
IC_IFD_Init
IC_IFD_PlayVoice
IC_IFD_SetKeyLength
IC_IFD_SetMainKey
IC_IFD_SetWorkKey
IC_Increment
IC_InitAuth
IC_InitAuth_Hex
IC_InitComm
IC_InitCommAdvanced
IC_InitComm_Baud
IC_InitType
IC_Init_Value
IC_InstallKbKey
IC_InstallKbKeyPro
IC_InstallKbKeyPro_Hex
IC_LcdClrScrn
IC_Load_Key
IC_Load_Keyhex
IC_PassCancel
IC_PassGet
IC_PassGetEn
IC_PassIn
IC_PlayVoice
IC_PosBeep
IC_Pro_Commandlink
IC_Pro_Commandlinkhex
IC_Pro_Commandsource
IC_Pro_Commandsourcehex
IC_Pro_Reset
IC_Pro_Resethex
IC_Pushout
IC_RValue
IC_Read
IC_Read1024
IC_Read1024_Hex
IC_ReadAuthCount
IC_ReadConfigZone
IC_ReadConfigZone_Hex
IC_ReadCount_102
IC_ReadCount_1604
IC_ReadCount_1604B
IC_ReadCount_4404
IC_ReadCount_4406
IC_ReadCount_SLE4428
IC_ReadCount_SLE4442
IC_ReadDevSnr
IC_ReadDevSnr_Hex
IC_ReadDevice
IC_ReadDeviceEn
IC_ReadDeviceEn_Hex
IC_ReadDevice_Hex
IC_ReadFuse
IC_ReadMagCard
IC_ReadMagCardAll
IC_ReadMifare
IC_ReadMifare_Hex
IC_ReadPass_4442hex
IC_ReadPass_SLE4442
IC_ReadProtection
IC_ReadProtection_Hex
IC_ReadRPasswordCount
IC_ReadReaderSnr
IC_ReadUsbSnr
IC_ReadUserData
IC_ReadUserData_Hex
IC_ReadUserZone
IC_ReadUserZone_Hex
IC_ReadVer
IC_ReadWPasswordCount
IC_ReadWithProtection
IC_ReadWithProtection_Hex
IC_Read_1101
IC_Read_1101hex
IC_Read_Float
IC_Read_Hex
IC_Read_Int
IC_Read_Value
IC_Request
IC_Request_B
IC_Request_Bhex
IC_Reset
IC_ResetDevice
IC_ResetMifare
IC_Restore
IC_Select
IC_Select2
IC_SetBaud
IC_SetCommTimeout
IC_SetCpuPara
IC_SetDeviceTime
IC_SetKbKeyID
IC_SetReaderTime
IC_SetUldPpsMode
IC_SetUsbTimeout
IC_SetUserZone
IC_Status
IC_Status_1
IC_SwitchPcsc
IC_TestDeviceComm
IC_Transfer
IC_TypeA_Cpu_Reset
IC_TypeA_Cpu_Reset_Hex
IC_Write
IC_Write1024
IC_Write1024_Hex
IC_Write24
IC_Write24_Hex
IC_Write64
IC_Write64_Hex
IC_WriteByBuffer
IC_WriteByBuffer_Hex
IC_WriteConfigZone
IC_WriteConfigZone_Hex
IC_WriteDevice
IC_WriteDeviceEn
IC_WriteDeviceEn_Hex
IC_WriteDevice_Hex
IC_WriteFuse
IC_WriteMifare
IC_WriteMifare_Hex
IC_WriteProtection
IC_WriteProtection_Hex
IC_WriteUserData
IC_WriteUserData_Hex
IC_WriteUserZone
IC_WriteUserZone_Hex
IC_WriteWithProtection
IC_WriteWithProtection_Hex
IC_Write_102
IC_Write_102hex
IC_Write_1101
IC_Write_1101hex
IC_Write_1604
IC_Write_1604hex
IC_Write_Float
IC_Write_Hex
IC_Write_Int
SD_GetFromPos
SD_SendToPos
SetInit
SetInit_Hex
asc2hex
hex2asc

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f22e74c83e5c37ad9cabf4ff7993bea

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

3e:be:91:e0:9b:a2:88:ec:57:f8:18:28:62:b4:12:d1:a1:6f:c7:b6:aa:03:27:44:06:d4:eb:41:37:ac:3c:4fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

hid

setupapi

shlwapi

advapi32

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 164KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 4KB - Virtual size: 8KB

.gfids Size: 512B - Virtual size: 212B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

3e:be:91:e0:9b:a2:88:ec:57:f8:18:28:62:b4:12:d1:a1:6f:c7:b6:aa:03:27:44:06:d4:eb:41:37:ac:3c:4f
Signer

.text
Size: 164KB - Virtual size: 164KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 4KB - Virtual size: 8KB

.gfids
Size: 512B - Virtual size: 212B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB