mp2064[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

mp2064.dll
Size

434KB
MD5

873bea0e7211347dbb5d6b4e139b1931
SHA1

3b5230d819471c486b663c2f4e622ecf4e7b4e9e
SHA256

5884106fa6740d2dfc8bc6c39f0cda6e70235e8007e69e0c2277ccc6b9c33a8f
SHA512

a3078d13f27e9d68663aff69888fd82bf07dd593f509ca552692acca6f637ac4717ce449c9a238a92fe26185ca8872340947b563b7af02d259dc3cf4d0bff491
SSDEEP

6144:8GXBp21gmCDJyTNqHlc1kqVmkyc5rNVYoDKCoGZQC7HW/PvPF7J9eqf8a4I1B5D:8GXBSCti1yJYJVfq5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mp2064.dll

Files

mp2064.dll
.dll windows:5 windows x64 arch:x64

80538180e88347e0647a5c1d9b0f3740

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
CM_Get_Device_ID_ExA
SetupDiGetDeviceInfoListDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstallParamsA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiOpenDeviceInfoA
SetupDiGetClassDevsExA
SetupDiCreateDeviceInfoListExA
SetupDiClassGuidsFromNameExA
SetupDiGetClassDevsW

ws2_32

recv
ioctlsocket
inet_addr
socket
setsockopt
htonl
htons
send
WSAGetLastError
closesocket
sendto
select
recvfrom
WSACleanup
WSAStartup
shutdown
connect
bind

siusbxp

ord7
ord6
ord17
?SI_ResetDevice@@YAHPEAX@Z
ord10
ord13
ord16
ord4
ord15
ord12
ord3
ord2
ord1
ord9

kernel32

GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleOutputCP
HeapSetInformation
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
GetPrivateProfileStringA
GetSystemDirectoryA
GetTickCount
Sleep
ReadFile
CloseHandle
DeviceIoControl
PurgeComm
GetLastError
CreateFileA
WriteFile
GetVersionExA
WaitForSingleObject
ReleaseMutex
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
CreateSemaphoreA
FreeEnvironmentStringsW
FlushFileBuffers
ClearCommError
SetCommState
GetCommState
GetCommModemStatus
SetCommTimeouts
GetCommTimeouts
SetupComm
TerminateThread
SetEvent
GetOverlappedResult
WaitForMultipleObjects
CreateEventW
CreateEventA
CreateThread
CreateFileW
lstrlenA
lstrcpyA
GlobalAlloc
GlobalFree
GetFileAttributesA
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentDirectoryA
GetLocalTime
GetFileSize
CopyFileA
GetFullPathNameA
InitializeCriticalSection
DeleteCriticalSection
FindFirstFileA
FlsSetValue
GetCurrentThreadId
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetEnvironmentStringsW
GetCurrentProcessId
GetLocaleInfoA
HeapReAlloc
HeapSize
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
SetEndOfFile
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetStartupInfoA
GetFileType
SetFilePointer
GetModuleFileNameA
GetStringTypeA
GetStringTypeW
GetModuleHandleW
ExitProcess
GetTimeZoneInformation
SetStdHandle
GetProcessHeap
CompareStringA
CompareStringW
CreateMutexA
SetEnvironmentVariableA
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
MultiByteToWideChar
WriteConsoleA

user32

GetDC
FillRect
MessageBoxA
CharNextA

gdi32

GetObjectA
GetStockObject
SelectObject
CreateCompatibleBitmap
GetColorAdjustment
SetColorAdjustment
SetStretchBltMode
SetBrushOrgEx
StretchBlt
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
DeleteObject
CreateDIBitmap
DeleteDC
SetPixel
GetPixel
CreateCompatibleDC

advapi32

ControlService
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
StartServiceA
CloseServiceHandle

Exports

Exports

AcionaGuilhotina
AcionaGuilhotinaEx
ActivateDrawer
AjustaLarguraPapel
AlignText
AtualizaFirmware
AtualizaFirmware2
AtualizaFirmwareEx
AutenticaDoc
AutenticaDocEx
AuthenticateDoc
BBX_TMF_PTR_DocumentInserted
BBX_TMF_PTR_GetStatus
BBX_TMF_PTR_Initialize
BBX_TMF_PTR_IoControl
BBX_TMF_PTR_PrintDoc
BBX_TMF_PTR_PrintLine
BBX_TMF_PTR_Reset
BBX_TMF_PTR_Terminate
BBX_TMF_PTR_Who
BematechEOT
BematechInitFilesTransmit
BematechMountBootFile
BematechSendFile
BematechSendFiles
BematechTX
BematechTXEx
Buzzer
CaracterGrafico
CaracterGraficoEx
CarregaLogo
CarregaLogoEx
CheckDocInserted
CheckPaperInPresenter
CheckPrinterVirtualSerial
ClearNVBitmaps
ClosePort
ComandoRX
ComandoRXEx
ComandoTX
ComandoTXEx
CommandRX
CommandSet
CommandTX
ConfigFlowControl
ConfigPrinterModel
ConfigSlipSize
ConfiguraCodigoBarras
ConfiguraCodigoBarrasEx
ConfiguraEnderecoPorta
ConfiguraModeloImpressora
ConfiguraTamanhoExtrato
ConfiguraTamanhoExtratoEx
ConfiguraTaxaSerial
ConfigureBarcode
ConfigureRetractableFcn
CutPaper
Define1NVBitmap
DefineDLBitmap
DefineNVBitmap
DocumentInserted
DocumentInsertedEx
EnableDoubleHeightPrintMode
EnableLongSlip
EnablePanelKeys
EnableRetractableFcn
EnableWaitPrinting
EsperaImpressao
EsperaImpressaoEx
FechaPorta
ForceUSBPortOpen
ForceUnidirectional
FormatTX
FormataTX
FormataTXEx
FoundSerialVirtual
FoundSerialVirtualEx
GetDitheredBitmap
GetFirmwareVersion
GetParallelMode
GetProductCode
GetProductCodeEx
GetSerialNumber
GraphicChar
HabilitaEsperaImpressao
HabilitaExtratoLongo
HabilitaExtratoLongoEx
HabilitaPresenterRetratil
HabilitaPresenterRetratilEx
ImprimeBarra
ImprimeBitmap
ImprimeBitmapEx
ImprimeBmpEspecial
ImprimeBmpEspecialEx
ImprimeCodigoBarrasCODABAR
ImprimeCodigoBarrasCODABAREx
ImprimeCodigoBarrasCODE128
ImprimeCodigoBarrasCODE128Ex
ImprimeCodigoBarrasCODE39
ImprimeCodigoBarrasCODE39Ex
ImprimeCodigoBarrasCODE93
ImprimeCodigoBarrasCODE93Ex
ImprimeCodigoBarrasEAN13
ImprimeCodigoBarrasEAN13Ex
ImprimeCodigoBarrasEAN8
ImprimeCodigoBarrasEAN8Ex
ImprimeCodigoBarrasISBN
ImprimeCodigoBarrasISBNEx
ImprimeCodigoBarrasITF
ImprimeCodigoBarrasITFEx
ImprimeCodigoBarrasMSI
ImprimeCodigoBarrasMSIEx
ImprimeCodigoBarrasPDF417
ImprimeCodigoBarrasPDF417Ex
ImprimeCodigoBarrasPLESSEY
ImprimeCodigoBarrasPLESSEYEx
ImprimeCodigoBarrasUPCA
ImprimeCodigoBarrasUPCAEx
ImprimeCodigoBarrasUPCE
ImprimeCodigoBarrasUPCEEx
ImprimeCodigoQRCODE
ImprimeCodigoQRCODEEx
ImprimePrn
IniciaPorta
IniciaPortaEx
InitializePort
IoControl
IsBidirectionalPrinter
Le_Status
Le_StatusEx
Le_Status_Gaveta
Le_Status_GavetaEx
LeituraStatusEstendido
LeituraStatusEstendidoEx
LerLogInformacao
OpenDrawer
OpenDrawerEx
PrintBemaBitmap
PrintBitmap
PrintBmpSpecial
PrintDLBitmap
PrintFile
PrintNVBitmap
PrintRasterBitmap
Print_CODABAR_Barcode
Print_CODE128_Barcode
Print_CODE39_Barcode
Print_CODE93_Barcode
Print_EAN13_Barcode
Print_EAN8_Barcode
Print_ISBN_Barcode
Print_ITF_Barcode
Print_MSI_Barcode
Print_PDF417_Barcode
Print_PLESSEY_Barcode
Print_QRCODE
Print_UPCA_Barcode
Print_UPCE_Barcode
PrinterReset
PrinterResetEx
ProgramaPresenterRetratil
ProgramaPresenterRetratilEx
ReIniciaPorta
ReInitializePort
ReadDrawerStatus
ReadExtendedStatus
ReadLog
Read_Extended_Status
Read_Status
RenumerePorts
SelecionaQualidadeImpressao
SelectCodePage
SelectDithering
SelectPrintQuality
SetDataBits
SetIPAddress
SetIPAdress
SetPageSize
SetPaperWidth
SetParity
SetPrinterLanguage
SetPrinterPaperWidth
SetPrinterPriority
SetSerialBaudRate
SetSiUSB
SetStopBits
SetTcpPort
SetTimeBetweenBlocks
TempCommandRestore
TempCommandSet
UpdateFirmware
UpdateFirmware2
UpdateFirmwareEx
UpdateUsbDevice
UploadLogo
VerificaPapelPresenter
VerificaPapelPresenterEx
VerifyFileExist
VerifyFileExistEx
WaitPrinting

Sections

.text
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80538180e88347e0647a5c1d9b0f3740

Headers

File Characteristics

Imports

version

setupapi

ws2_32

siusbxp

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 300KB - Virtual size: 299KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 10KB - Virtual size: 19KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 300KB - Virtual size: 299KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 10KB - Virtual size: 19KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB