dcrf32[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dcrf32.dll
Size

553KB
MD5

14d41513dbd6f6af75cdcd2d072b1a09
SHA1

eff02381c7122150a954a772eea9a54bb4e0d0a5
SHA256

8e849a76d337e626da5bb13d423fcab2f6a97f56a88b03beec9e4727af73532f
SHA512

956cd373d38c1e2db460f7f370f08974b8c51cd63423fc261795ae71d66ecbc1e8b1cb898ddd4b7acb4ca75c23ee81a04721f4fb0fdc20e38ac90298ef649ab2
SSDEEP

6144:NoGCv4XBunu6ZUZ8TocYHSnRXaoeFwfAOHaEEHoCq2gr2tb4EN:yGrUnu6ZUZuQHSnRKPKBaNIp2J

Score

1^/10

Malware Config

Signatures

Files

dcrf32.dll
.dll windows:5 windows x86 arch:x86

6f254bd017bc61cf10f637bd6d661426

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

17/05/2019, 08:43

Not After

16/06/2020, 08:43

Subject

CN=易联众智能（厦门）科技有限公司,O=易联众智能（厦门）科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:95:e3:ab:d5:b3:ab:ad:39:23:2e:ce:41:57:65:8e:91:a7:45:00:91:03:dd:2a:41:c5:10:4d:f1:74:d6:3b
Signer

Actual PE Digest

bc:95:e3:ab:d5:b3:ab:ad:39:23:2e:ce:41:57:65:8e:91:a7:45:00:91:03:dd:2a:41:c5:10:4d:f1:74:d6:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\weiyang\me\work\nextlevelwork\dcrf32\build\msvc14\Release\dcrf32.pdb

Imports

kernel32

WriteFile
PurgeComm
WaitForSingleObject
SetupComm
GetLastError
CreateFileA
GetCommState
CloseHandle
GetOverlappedResult
CreateEventA
SetCommTimeouts
SetCommState
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
Sleep
LoadLibraryA
CreateThread
GetProcAddress
DeleteCriticalSection
FreeLibrary
WideCharToMultiByte
GetTickCount
SetEndOfFile
HeapSize
WriteConsoleW
CancelIo
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
MoveFileExW
DeleteFileW
GetConsoleCP
FlushFileBuffers
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetStdHandle
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
CreateFileW
GetModuleFileNameA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LoadLibraryExW
RaiseException
InterlockedFlushSList
RtlUnwind
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetACP

ws2_32

WSAGetLastError
recv
WSALookupServiceNextA
connect
socket
send
WSALookupServiceBeginA
WSACleanup
__WSAFDIsSet
closesocket
select
WSALookupServiceEnd
WSAStartup

winscard

g_rgSCardT1Pci
SCardTransmit
SCardReleaseContext
SCardEstablishContext
SCardDisconnect
SCardConnectA
g_rgSCardT0Pci

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

hid

HidD_FlushQueue
HidD_SetFeature
HidD_GetFeature
HidD_GetHidGuid
HidD_GetAttributes

Exports

Exports

DCDEV_CommandMcu
DCDEV_CommandMcu_Hex
LibMain
SD_IFD_ActWorkKey
SD_IFD_CreateMac
SD_IFD_DES
SD_IFD_DesCaculate
SD_IFD_GetEnPIN
SD_IFD_GetEnPINBlock
SD_IFD_GetEnPINPro
SD_IFD_GetPIN
SD_IFD_GetPINPro
SD_IFD_Init
SD_IFD_LEDDisplay
SD_IFD_PlayVoice
SD_IFD_SelecetDes
SD_IFD_SetKeyLength
SD_IFD_SetMainKey
SD_IFD_SetWorkKey
SD_InstallKey
a_hex
dc_2dot4_command
dc_2dot4_command_hex
dc_2dot4_reset
dc_2dot4_resethex
dc_ActivateCard
dc_BtAddressControl
dc_BtBaudrateControl
dc_BtCommand
dc_BtCommunicationTest
dc_BtDataResponse
dc_BtDataTransmit
dc_BtModeControl
dc_BtNameControl
dc_BtPasswordControl
dc_BtReset
dc_BtSignalStrength
dc_BtUserControl
dc_BtWithReaderBaudrateControl
dc_BuzzerBeep
dc_CalculateDes
dc_CalculateMACCheck
dc_CalculateSm4
dc_CardIssuingScript
dc_CheckCard
dc_Check_24C01
dc_Check_24C02
dc_Check_24C04
dc_Check_24C08
dc_Check_24C16
dc_Check_24C64
dc_Check_4428
dc_Check_4442
dc_Check_CPU
dc_CpuCardStatus
dc_CreatDesData
dc_CreatDesDataECB
dc_CreatMacDataECB
dc_CreatSm4Data
dc_CreatSm4DataECB
dc_FlashErase
dc_GetBankAccountNumber
dc_GetEnPass
dc_GetInputPass
dc_GetLastResponseCode
dc_HL_authentication
dc_HL_read
dc_HL_read_hex
dc_HL_readhex
dc_HL_write
dc_HL_write_hex
dc_HL_writehex
dc_InstallKbKey
dc_MFPL0_commitperso
dc_MFPL0_writeperso
dc_MFPL0_writeperso_hex
dc_MFPL1_authl1key
dc_MFPL1_authl1key_hex
dc_MFPL1_switchtol2
dc_MFPL1_switchtol3
dc_MFPL2_switchtol3
dc_MFPL3_authl3key
dc_MFPL3_authl3key_hex
dc_MFPL3_authl3sectorkey
dc_MFPL3_authl3sectorkey_hex
dc_MFPL3_readencrypted
dc_MFPL3_readencrypted_hex
dc_MFPL3_readinplain
dc_MFPL3_readinplain_hex
dc_MFPL3_writeencrypted
dc_MFPL3_writeencrypted_hex
dc_MFPL3_writeinplain
dc_MFPL3_writeinplain_hex
dc_MagFormatConfig
dc_MulticardStatus
dc_NfcActivate
dc_NfcDeactivate
dc_NfcFetch
dc_NfcInit
dc_NfcPush
dc_NfcService
dc_NfcSimulateCardConfig
dc_ParsePhotoInfo
dc_ParseTextInfo
dc_ParseTextInfoForForeigner
dc_PassCancel
dc_PassGet
dc_PassIn
dc_PassIn2
dc_PinpadCommunication
dc_ReadFlash
dc_ReadIdCardInfo
dc_ReadModuleMacAddress
dc_ReadOutEeprom
dc_ReadRfCfgReg
dc_ReadRfTypeABATS
dc_ReadRfTypeABATS_hex
dc_RequestMultiCard
dc_RestDevice
dc_RfFormatConfig
dc_RfGetCardType
dc_RfReadChipRegister
dc_RfSetChipRegister
dc_RfWaveControl
dc_SamAControl
dc_SamAReadCardInfo
dc_SelfServiceDeviceCardEject
dc_SelfServiceDeviceCardInject
dc_SelfServiceDeviceCardMove
dc_SelfServiceDeviceCardStatus
dc_SelfServiceDeviceCheckCardType
dc_SelfServiceDeviceConfig
dc_SelfServiceDeviceConfigBack
dc_SelfServiceDeviceConfigFront
dc_SelfServiceDeviceConfigPlace
dc_SelfServiceDeviceReset
dc_SelfServiceDeviceSensorStatus
dc_SetEMVPara
dc_SetKbKeyID
dc_SetUsbMode
dc_WakeDevice
dc_WriteFlash
dc_WriteModuleMacAddress
dc_WriteOutEeprom
dc_WriteRfCfgReg
dc_anticoll
dc_anticoll2
dc_anticoll_mode
dc_attrib
dc_attribInt
dc_auth_shc1102
dc_auth_ulc
dc_auth_ulc_hex
dc_authentication
dc_authentication_2
dc_authentication_key
dc_authentication_pass
dc_authentication_pass_hex
dc_authentication_passaddr
dc_authentication_passaddr_hex
dc_beep
dc_card
dc_cardAB
dc_card_b
dc_card_b_hex
dc_card_double
dc_card_double_hex
dc_card_exist
dc_card_fm11rf005
dc_card_hex
dc_card_make_and_lock
dc_card_n
dc_card_n_hex
dc_card_n_number
dc_card_status
dc_card_status2
dc_cardstr
dc_change_addr
dc_changeb3
dc_changeb3_hex
dc_changebaud_485
dc_changekey_ulc
dc_changekey_ulc_hex
dc_changepass_1604
dc_changepass_1604_hex
dc_changepin_4428
dc_changepin_4428_hex
dc_changepin_4442
dc_changepin_4442_hex
dc_check2dot4Gbaund
dc_check_1604
dc_check_write
dc_check_write_hex
dc_check_writehex
dc_checkpass_1604
dc_checkpass_1604_hex
dc_checkprint
dc_clearlcd_T8
dc_clr_control_bit
dc_command
dc_command_hex
dc_config
dc_config_card
dc_config_port_name
dc_consume_wallet
dc_cpuapdu
dc_cpuapduEXT
dc_cpuapduEXT_hex
dc_cpuapduInt
dc_cpuapduInt_hex
dc_cpuapdu_hex
dc_cpuapdurespon
dc_cpuapdurespon_hex
dc_cpuapdusource
dc_cpuapdusourceEXT
dc_cpuapdusourceEXT_hex
dc_cpuapdusource_hex
dc_cpudown
dc_cpuhotreset
dc_cpuhotreset_hex
dc_cpureset
dc_cpureset_hex
dc_cpy_cpuapdu
dc_cpy_cpuapduInt
dc_cpy_cpuapduInt_hex
dc_cpy_cpuapdu_hex
dc_cpy_getkey
dc_cpy_procommand
dc_cpy_procommandInt
dc_cpy_procommandInt_hex
dc_cpy_procommand_hex
dc_cpy_setkey
dc_creat_mac
dc_creat_mac2
dc_creat_mac2_hex
dc_creat_mac_hex
dc_ctl_mode
dc_ctlbacklight
dc_ctlled
dc_decrement
dc_decrement_ml
dc_decrypt
dc_decrypt_hex
dc_des
dc_des_hex
dc_disp_mode
dc_disp_neg
dc_disp_str
dc_dispinfo
dc_dispinfo_T8
dc_dispinfo_pro_T8
dc_display_2dbarcode
dc_displcd
dc_displcd_ext
dc_displow_T8
dc_dispmaininfo
dc_dispmainmenu
dc_dispmap_T8
dc_down_1604
dc_down_4428
dc_down_4442
dc_encrypt
dc_encrypt_hex
dc_end_i_d
dc_erase_random
dc_exchangeblock
dc_exchangeblock_hex
dc_exit
dc_find_i_d
dc_find_i_d_2
dc_find_i_d_speed
dc_fingerprint_io_control
dc_flash_card
dc_fuse_1604
dc_get55data
dc_get_hardwareserialnumber
dc_get_i_d_raw_buffer
dc_get_idsnr
dc_get_idsnr_hex
dc_get_record
dc_get_securityinfo
dc_get_securityinfo_hex
dc_get_signmessageparameters
dc_get_systeminfo
dc_get_systeminfo_hex
dc_get_terminalnumber
dc_get_trademerchantcode
dc_get_tradesecretkey
dc_get_transactiontype
dc_getcpupara
dc_getdevicetime
dc_getfingerdata
dc_getinputkey
dc_getinputpass
dc_getlongver
dc_getname
dc_getrcinfo
dc_getrcinfo_hex
dc_getsnr_fm11rf005
dc_getsnr_fm11rf005_hex
dc_gettime
dc_gettime_hex
dc_gettimehex
dc_getuid_i_d
dc_getver
dc_halt
dc_halt_shc1102
dc_high_disp
dc_hltb
dc_i_d_query_address
dc_i_d_query_address_2
dc_i_d_query_birth
dc_i_d_query_birth_2
dc_i_d_query_department
dc_i_d_query_department_2
dc_i_d_query_expire_day
dc_i_d_query_expire_day_2
dc_i_d_query_finger
dc_i_d_query_finger_2
dc_i_d_query_finger_bmp_buffer
dc_i_d_query_finger_file
dc_i_d_query_finger_len
dc_i_d_query_id_number
dc_i_d_query_id_number_2
dc_i_d_query_name
dc_i_d_query_name_2
dc_i_d_query_nation
dc_i_d_query_nation_2
dc_i_d_query_photo
dc_i_d_query_photo_2
dc_i_d_query_photo_bmp_buffer
dc_i_d_query_photo_file
dc_i_d_query_photo_len
dc_i_d_query_sex
dc_i_d_query_sex_2
dc_increment
dc_init
dc_init_485
dc_initval
dc_initval_ml
dc_inventory
dc_inventory_hex
dc_keypad_DeleteKey
dc_keypad_End
dc_keypad_GetDecryptDataOfCBC
dc_keypad_GetDecryptDataOfECB
dc_keypad_GetEncryptDataOfCBC
dc_keypad_GetEncryptDataOfECB
dc_keypad_GetMACDataOfCBC
dc_keypad_GetPinBlock
dc_keypad_GetPressed
dc_keypad_GetRandomValue
dc_keypad_ImportKey
dc_keypad_SetButtonMark
dc_keypad_Start
dc_keypad_io_control
dc_lcdclrscrn
dc_led_T8
dc_light
dc_load_key
dc_load_key_hex
dc_load_voice
dc_lock_afi
dc_lock_afi_hex
dc_lock_block
dc_lock_block_hex
dc_lock_dsfid
dc_lock_dsfid_hex
dc_mfdes_auth
dc_mfdes_auth_hex
dc_mfdes_baud
dc_mulrequest_b
dc_open_door
dc_open_timedoor
dc_pass_key_value
dc_pass_key_value2
dc_passcancel
dc_passget
dc_passin
dc_passin2
dc_play_voice
dc_playvoice
dc_posbeep
dc_printOnedimensional
dc_printPicture
dc_printcharacter
dc_printenter
dc_printstatus
dc_pro_command
dc_pro_command_hex
dc_pro_commandhex
dc_pro_commandlink
dc_pro_commandlinkEXT
dc_pro_commandlinkEXT_hex
dc_pro_commandlinkInt
dc_pro_commandlinkInt_hex
dc_pro_commandlink_hex
dc_pro_commandsource
dc_pro_commandsourceCRC
dc_pro_commandsourceCRChex
dc_pro_commandsource_hex
dc_pro_commandsource_int
dc_pro_commandsourcehex
dc_pro_halt
dc_pro_receivecommandsource
dc_pro_reset
dc_pro_resetInt
dc_pro_resetInt_hex
dc_pro_reset_hex
dc_pro_resethex
dc_pro_sendcommandsource
dc_procommandInt
dc_procommandInt_hex
dc_read
dc_read1024
dc_read1024_hex
dc_readSD
dc_read_1604
dc_read_1604_hex
dc_read_24c
dc_read_24c64
dc_read_24c64_hex
dc_read_24c_hex
dc_read_4428
dc_read_4428_hex
dc_read_4442
dc_read_4442_hex
dc_read_fm11rf005
dc_read_fm11rf005_hex
dc_read_hex
dc_read_idcard
dc_read_idcard_hex
dc_read_random
dc_read_random_hex
dc_read_shc1102
dc_read_walletbalance
dc_readblock
dc_readblock_hex
dc_readcount_1604
dc_readdevsnr
dc_readmag
dc_readmagcard
dc_readmagcardall
dc_readmagcardallA
dc_readpin_4428
dc_readpin_4428_hex
dc_readpin_4442
dc_readpin_4442_hex
dc_readpincount_4428
dc_readpincount_4442
dc_readprotect_4428
dc_readprotect_4428_hex
dc_readprotect_4442
dc_readprotect_4442_hex
dc_readreadersnr
dc_readval
dc_readval_ml
dc_readwrotect_4442
dc_readwrotect_4442_hex
dc_request
dc_request_b
dc_request_shc1102
dc_reset
dc_reset_factory
dc_reset_to_ready
dc_reset_to_ready_hex
dc_resetdevice
dc_restore
dc_rf_application
dc_rf_getstatus
dc_rf_poweroff
dc_rf_poweron
dc_rw_rfreg
dc_rw_rfreg_hex
dc_select
dc_select2
dc_select_mode
dc_select_uid
dc_select_uid_hex
dc_send_sms
dc_set2dot4Gbaund
dc_set_addr
dc_set_control_bit
dc_set_hardwareserialnumber
dc_set_poweroff
dc_set_terminalnumber
dc_set_trademerchantcode
dc_set_tradesecretkey
dc_set_transactiontype
dc_setbright
dc_setcpu
dc_setcpupara
dc_setdevicebaud
dc_setdevicetime
dc_setmag
dc_setprint
dc_settime
dc_settime_hex
dc_settimehex
dc_setusbtimeout

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f254bd017bc61cf10f637bd6d661426

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

bc:95:e3:ab:d5:b3:ab:ad:39:23:2e:ce:41:57:65:8e:91:a7:45:00:91:03:dd:2a:41:c5:10:4d:f1:74:d6:3bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

winscard

setupapi

hid

Exports

Exports

Sections

.text Size: 387KB - Virtual size: 387KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 11KB - Virtual size: 19KB

.gfids Size: 1024B - Virtual size: 536B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 18KB

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

74:c9:0c:43:bb:5a:ba:7a:d3:64:6a:e3:a6:9e:c4:52
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

bc:95:e3:ab:d5:b3:ab:ad:39:23:2e:ce:41:57:65:8e:91:a7:45:00:91:03:dd:2a:41:c5:10:4d:f1:74:d6:3b
Signer

.text
Size: 387KB - Virtual size: 387KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 11KB - Virtual size: 19KB

.gfids
Size: 1024B - Virtual size: 536B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 18KB