D:\工作项目\加解密\客户端源码\phSoftEnc--32\phSoftEnc--32\Release\phSoftEnc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d162243223f1443e14c70b55dcbce929ba71b28d48548f01c0a7e6e7e0057153.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d162243223f1443e14c70b55dcbce929ba71b28d48548f01c0a7e6e7e0057153.dll
Resource
win10v2004-20240426-en
General
-
Target
d162243223f1443e14c70b55dcbce929ba71b28d48548f01c0a7e6e7e0057153
-
Size
3.8MB
-
MD5
c69421deb6597b11cbff8e8ad0bbece2
-
SHA1
5e259620f8fc42d23e54f2415bf26e66588ba4ea
-
SHA256
d162243223f1443e14c70b55dcbce929ba71b28d48548f01c0a7e6e7e0057153
-
SHA512
9d71003c318179123a08ea1fa74a2a41469115d3120be8d53938f9888a3faec2fd69b1419b491dc9d4a7103777148bc7b7ee569a42770d111608f41d5c50cb9b
-
SSDEEP
49152:V/Ovf7uhRSEIS9u4uxtJuaCW8GckxLk92dWX7oIy0GJzHai2FROtF:272HISIzJNsqLI2d55T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d162243223f1443e14c70b55dcbce929ba71b28d48548f01c0a7e6e7e0057153
Files
-
d162243223f1443e14c70b55dcbce929ba71b28d48548f01c0a7e6e7e0057153.dll windows:5 windows x86 arch:x86
79e270c5de4598e442f89eea653f39e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
lstrcmpiA
FindResourceExW
GetTempFileNameA
GetTempPathA
GetNumberFormatA
GetFileAttributesA
SearchPathA
GetFileTime
GetFileSizeEx
GetFileAttributesExA
InitializeCriticalSectionAndSpinCount
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapValidate
IsBadReadPtr
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
CreateThread
ExitThread
SetStdHandle
GetFileType
GetStdHandle
WriteConsoleW
OutputDebugStringW
IsValidCodePage
GetConsoleCP
GetConsoleMode
LCMapStringW
IsProcessorFeaturePresent
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
HeapCreate
HeapDestroy
SetHandleCount
GetStartupInfoW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
CompareStringW
CreateFileW
GetProcessHeap
SetEnvironmentVariableA
OpenEventA
FileTimeToLocalFileTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
DuplicateHandle
GetHandleInformation
GetOEMCP
GetCPInfo
InterlockedIncrement
GetCurrentDirectoryA
GetACP
FileTimeToSystemTime
GetProfileIntA
VirtualProtect
GetAtomNameA
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
SetEvent
WaitForSingleObject
CloseHandle
GetCurrentProcessId
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
InterlockedExchange
GetModuleHandleW
lstrcmpA
GetCurrentThread
GetLocaleInfoA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetModuleFileNameA
CompareStringA
LoadLibraryW
GetVersionExA
lstrcmpW
FreeLibrary
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrlenW
CopyFileA
GlobalSize
GlobalAlloc
FormatMessageA
LocalFree
GlobalFree
FindResourceA
FreeResource
LoadLibraryA
ActivateActCtx
DeactivateActCtx
GlobalLock
GlobalUnlock
MulDiv
SetLastError
ResumeThread
SetThreadPriority
GetFullPathNameA
GetVolumeInformationA
DeleteFileA
GetModuleHandleA
FindClose
GetProcAddress
GetLastError
FindFirstFileA
GetWindowsDirectoryA
GetCurrentProcess
lstrlenA
MultiByteToWideChar
Sleep
OutputDebugStringA
GetCurrentThreadId
GetTickCount
GetLocalTime
LockResource
SizeofResource
WideCharToMultiByte
LoadResource
lstrcpyA
FindResourceW
user32
CheckDlgButton
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
PostQuitMessage
SetCursor
TranslateMessage
GetMessageA
UnregisterClassA
RealChildWindowFromPoint
GetAsyncKeyState
SetRectEmpty
ReleaseCapture
EnumDisplayMonitors
SetLayeredWindowAttributes
DestroyMenu
MessageBeep
CharUpperA
MonitorFromPoint
UpdateLayeredWindow
GetKeyNameTextA
MapVirtualKeyA
GetClipboardFormatNameA
UnpackDDElParam
LoadAcceleratorsW
LoadAcceleratorsA
TranslateAcceleratorA
ReuseDDElParam
DestroyIcon
LoadImageA
DrawIconEx
DestroyAcceleratorTable
CreateAcceleratorTableA
CopyAcceleratorTableA
ToAsciiEx
GetKeyboardLayout
SetCursorPos
SetClassLongA
GetIconInfo
CopyImage
LoadImageW
SetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatA
PtInRect
OffsetRect
CopyIcon
IsRectEmpty
CharUpperBuffA
WaitMessage
DefFrameProcA
TranslateMDISysAccel
DefMDIChildProcA
IsClipboardFormatAvailable
GetDoubleClickTime
IsCharLowerA
MapVirtualKeyExA
DestroyCursor
SetRect
InflateRect
IntersectRect
UnionRect
SubtractRect
GetWindowPlacement
GetKeyState
GetDlgCtrlID
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
SetMenu
GetMenu
GetMessageTime
SetWindowLongA
EndDialog
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
LoadMenuW
LoadMenuA
RemoveMenu
ModifyMenuA
InsertMenuItemA
InsertMenuA
GetSubMenu
GetMenuItemInfoA
GetMenuStringA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
SetMenuDefaultItem
EnableMenuItem
CheckMenuItem
AppendMenuA
DeleteMenu
IsMenu
CreatePopupMenu
CreateMenu
GrayStringA
DrawTextExA
GetMonitorInfoA
RegisterWindowMessageA
DrawFrameControl
DrawEdge
DrawStateA
DrawIcon
InvertRect
FrameRect
FillRect
LoadBitmapA
GetSysColorBrush
SetWindowsHookExA
UnhookWindowsHookEx
GetCursorPos
CallNextHookEx
GetSysColor
GetWindowTextLengthA
GetWindowTextA
SetFocus
LoadIconW
LoadIconA
LoadCursorW
LoadCursorA
PostThreadMessageA
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
GetWindowLongA
EnableWindow
NotifyWinEvent
HideCaret
OpenClipboard
WindowFromPoint
SetParent
GetParent
IsChild
GetLastActivePopup
GetWindow
GetTopWindow
FindWindowA
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
GetDesktopWindow
SetCapture
GetCapture
SetActiveWindow
GetActiveWindow
KillTimer
SetTimer
EnableScrollBar
RedrawWindow
LockWindowUpdate
ShowOwnedPopups
IsWindowVisible
ValidateRect
InvalidateRect
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ScreenToClient
ClientToScreen
MapWindowPoints
GetClientRect
GetWindowRect
BringWindowToTop
GetWindowRgn
SetWindowRgn
IsZoomed
IsIconic
GetSystemMenu
DrawMenuBar
GetClassNameA
TabbedTextOutA
PostMessageA
SendMessageA
MapDialogRect
GetMenuCheckMarkDimensions
LoadBitmapW
SetMenuItemBitmaps
GetFocus
GetSystemMetrics
SetWindowPos
GetWindowThreadProcessId
AllowSetForegroundWindow
SystemParametersInfoA
IsWindow
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
GetKeyboardState
PeekMessageA
DispatchMessageA
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
SendDlgItemMessageA
DrawFocusRect
MonitorFromWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
WinHelpA
TrackPopupMenu
DrawTextA
SetWindowPlacement
GetMessagePos
gdi32
SaveDC
RestoreDC
SelectObject
SelectPalette
GetStockObject
DeleteDC
DeleteObject
GetObjectA
ExtTextOutA
SetBkColor
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectClipRgn
ExcludeClipRect
IntersectClipRect
MoveToEx
LineTo
CreateFontA
CreateFontIndirectA
SetTextAlign
SetTextCharacterExtra
GetLayout
SetLayout
DPtoLP
CreatePatternBrush
CreateHatchBrush
CreateSolidBrush
CreatePen
GetDeviceCaps
GetObjectType
ExtSelectClipRgn
SetViewportOrgEx
CreateBitmap
SetDIBColorTable
GetSystemPaletteEntries
EnumFontFamiliesExA
CreateDIBSection
CreateDIBitmap
GetTextCharsetInfo
EnumFontFamiliesA
CopyMetaFileA
SetPixelV
CreateRectRgn
CreateCompatibleBitmap
CreatePalette
GetPaletteEntries
SetPaletteEntries
GetNearestPaletteIndex
CreateRectRgnIndirect
CreateEllipticRgn
CreatePolygonRgn
CreateRoundRectRgn
SetRectRgn
CombineRgn
OffsetRgn
GetRgnBox
PtInRegion
CreateDCA
CreateCompatibleDC
RealizePalette
GetBkColor
GetTextColor
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
LPtoDP
FillRgn
FrameRgn
PtVisible
RectVisible
Polyline
Ellipse
Polygon
Rectangle
PatBlt
BitBlt
StretchBlt
GetPixel
SetPixel
ExtFloodFill
TextOutA
GetTextExtentPoint32A
GetTextFaceA
GetTextMetricsA
Escape
GetBoundsRect
advapi32
OpenThreadToken
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
RegEnumKeyA
RegEnumValueA
RegEnumKeyExA
SetThreadToken
RevertToSelf
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
DragFinish
DragQueryFileA
SHGetFileInfoA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA
SHAppBarMessage
SHBrowseForFolderA
oleaut32
VariantInit
SysStringLen
VariantChangeType
VariantClear
SysFreeString
SysAllocStringLen
SystemTimeToVariantTime
VarBstrFromDate
SysAllocString
VariantTimeToSystemTime
phsoftpkiapi
pkiInternalDecryptForBig
pkiGenerateRandom
pkiInternalDecryptSymmKey
pkiSoftInitApp
pkiInternalDecryptByPrikey
pkiGetXMLCertInfo
pkiVerifySignature
pkiBase64Encode
pkiSymmCryptData
pkiSM3HashData
pkiGenECCKey
pkiExternalByPubKey
pkiEnd
pkiSymmCryptDataEx
pkiVerifySignaturePure
pkiBase64Decode
msimg32
TransparentBlt
AlphaBlend
comctl32
ImageList_GetIconSize
shlwapi
PathIsUNCA
PathRemoveFileSpecW
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
gdiplus
GdipDeleteGraphics
GdiplusShutdown
GdipSetInterpolationMode
GdipDrawImageRectI
GdipDisposeImage
GdipFree
GdipCloneImage
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateFromHDC
GdipCreateBitmapFromScan0
ws2_32
__WSAFDIsSet
socket
recv
inet_addr
WSACleanup
htons
closesocket
gethostbyname
send
getsockopt
inet_ntoa
connect
getaddrinfo
WSAStartup
select
libssl-1_1
SSL_new
SSL_shutdown
SSL_CTX_new
SSL_write
SSL_free
SSL_get_error
SSL_CTX_free
SSL_read
SSL_set_fd
TLS_client_method
SSL_connect
OPENSSL_init_ssl
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comdlg32
GetFileTitleA
ole32
CreateStreamOnHGlobal
DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
IsAccelerator
OleLockRunning
CoInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CoCreateGuid
CoUninitialize
CoInitializeEx
CoTaskMemFree
OleDuplicateData
CoCreateInstance
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID
OleTranslateAccelerator
Exports
Exports
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
phSoft_Base64Decode
phSoft_Base64Encode
phSoft_DecryptData
phSoft_DecryptDataEmergency
phSoft_DecryptFile
phSoft_DecryptFileEmergency
phSoft_DecryptFileForBussSystem
phSoft_DecryptSymmData
phSoft_EncByPubkey
phSoft_EncryptData
phSoft_EncryptDataEx
phSoft_EncryptFile
phSoft_EncryptFileEx
phSoft_EncryptFileForBussSystem
phSoft_EncryptFileForBussSystemEx
phSoft_EncryptSymmData
phSoft_GenECCPublicKey
phSoft_GenRandom
phSoft_GetBidKey
phSoft_GetBussID
phSoft_GetDecKeyResult
phSoft_GetEncKeyResult
phSoft_GetEncKeyResultEx
phSoft_GetEncPubKey
phSoft_GetLastError
phSoft_GetQR
phSoft_GetQRSKF
phSoft_GetQRSKFEx
phSoft_GetUserExChangePubkey
phSoft_GetUserPubID
phSoft_InternalDecrypt
phSoft_InternalDecryptSymmKey
phSoft_InternalDecryptSymmKeyEx
phSoft_PubkeyEncResult
phSoft_UnionDecryptData
phSoft_UnionDecryptDataEx
phSoft_UnionEncryptData
phSoft_UnionEncryptDataEx
phSoft_VerifySign
phSoft_VerifyToken
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 485KB - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 307KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ