cb1e663a8b6a67f4bed7235848915c13d90de46b2178a1bc1ae29d0b22bfcae7

Sharing

Copy URL Twitter E-mail

General

Target

cb1e663a8b6a67f4bed7235848915c13d90de46b2178a1bc1ae29d0b22bfcae7
Size

117KB
MD5

97a8be4501cf6f51986fc5f680ab0882
SHA1

129e16409536c4356bd597ea9142600ad22f6e56
SHA256

cb1e663a8b6a67f4bed7235848915c13d90de46b2178a1bc1ae29d0b22bfcae7
SHA512

6d49fd72a8151bfb13398bcc431d4171b5064c35ca3840a8a57ebc6065052fc5559325fc197a3574e9b7900f5c4737cf6cb949877d6b557c633e8f0c4cc784e2
SSDEEP

3072:62ma8NS4ukJp5H+vpC1PnawN1C28/osYOBjpKEMl:fmFS4/mQtawDCosYOBjp/Ml

Score

1^/10

Malware Config

Signatures

Files

cb1e663a8b6a67f4bed7235848915c13d90de46b2178a1bc1ae29d0b22bfcae7
.dll windows:5 windows x86 arch:x86

3f257f6006e2dd4e55acbd9e56835bdf

Code Sign

0b:0f:49:95:06:70:e0:a4:0b:bd:bb:6d:ca:e0:5e:7b
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/04/2020, 00:00

Not After

08/04/2021, 12:00

Subject

CN=南京云帐房网络科技有限公司,O=南京云帐房网络科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:16:c2:38:78:50:dc:ba:68:6f:2c:d3:e8:f6:25:d6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/04/2020, 00:00

Not After

08/04/2021, 12:00

Subject

CN=南京云帐房网络科技有限公司,O=南京云帐房网络科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

66:d0:9a:7f:75:54:c7:ea:72:f9:79:1c:05:48:99:44:85:1a:10:0a:c3:ad:4b:f7:0b:b6:c5:bc:a9:8e:83:d5
Signer

Actual PE Digest

66:d0:9a:7f:75:54:c7:ea:72:f9:79:1c:05:48:99:44:85:1a:10:0a:c3:ad:4b:f7:0b:b6:c5:bc:a9:8e:83:d5

Digest Algorithm

sha256

PE Digest Matches

true

3b:3a:7c:73:c0:aa:14:c9:21:c6:89:8f:87:97:d6:6a:44:c1:c6:d9
Signer

Actual PE Digest

3b:3a:7c:73:c0:aa:14:c9:21:c6:89:8f:87:97:d6:6a:44:c1:c6:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\trunk\InterfaceSystemSetup\Bin\Release\YzfUsbUnitOperation100.pdb

Imports

common

?CloseKey@CRegFile@YZF_NAMESPACE@@QAEXXZ
?GetKeyValueByPath@CRegFile@YZF_NAMESPACE@@QAE_NPAUHKEY__@@PBD1AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?StopProcess@CProcessOperate@YZF_NAMESPACE@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1CProcessOperate@YZF_NAMESPACE@@QAE@XZ
??0CRegFile@YZF_NAMESPACE@@QAE@XZ
?StartProcess@CProcessOperate@YZF_NAMESPACE@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?EnumProcess@CProcessOperate@YZF_NAMESPACE@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CProcessOperate@YZF_NAMESPACE@@QAE@XZ
?SetKeyValueByPath@CRegFile@YZF_NAMESPACE@@QAE_NPAUHKEY__@@PBD1V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?FindProcessPid@CProcessUtil@YZF_NAMESPACE@@SAKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1CRegFile@YZF_NAMESPACE@@QAE@XZ

msvcp100

?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

logext100

Logging

certutility100

?ClearAllJSCACert@@YAIXZ
?GetCertDetailedInfo@@YAIAAV?$vector@UCertDetailedInfo@@V?$allocator@UCertDetailedInfo@@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z

msvcr100

free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_malloc_crt
sprintf
atof
qsort
strncpy
strstr
floor
ceil
_vsnprintf_s
fprintf
??_V@YAXPAX@Z
_purecall
malloc
atoi
sprintf_s
memset
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
memmove
memchr
memcpy
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
strchr
strncmp
isalnum
isalpha
tolower
isspace

kernel32

GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
GetTickCount
GetSystemTime
OutputDebugStringA
LoadLibraryExA
CreatePipe
GetStartupInfoA
CreateProcessA
ReadFile
Sleep
FreeLibrary
LoadLibraryA
OpenProcess
GetModuleFileNameW
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
TerminateThread
CloseHandle
VirtualFreeEx
CreateRemoteThread
GetLastError
WaitForSingleObject
GetExitCodeThread

Exports

Exports

YzfAddNewCabinet
YzfCheckOpenedPortStatus
YzfCheckOpenedPortStatusEx
YzfClearUsedPortInfo
YzfEnumAllPortsEx
YzfEnumAllPortsExEx
YzfGetUsbUnitIDByIP
YzfIsInstallMiddleware
YzfReadUsedPortInfo
YzfRecordUsedPortInfo
YzfUsbUnitCloseAllUSBPort
YzfUsbUnitCloseAllUSBPortEx
YzfUsbUnitClosePort
YzfUsbUnitClosePortEx
YzfUsbUnitClosePortExEx
YzfUsbUnitFini
YzfUsbUnitGetDetail
YzfUsbUnitGetDetailEx
YzfUsbUnitGetDeviceSN
YzfUsbUnitGetDeviceSNEx
YzfUsbUnitGetPortStatus
YzfUsbUnitGetPortStatusEx
YzfUsbUnitGetStatus
YzfUsbUnitGetStatusEx
YzfUsbUnitInit
YzfUsbUnitOpenPort
YzfUsbUnitOpenPortEx
YzfUsbUnitScanPort

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f257f6006e2dd4e55acbd9e56835bdf

Code Sign

0b:0f:49:95:06:70:e0:a4:0b:bd:bb:6d:ca:e0:5e:7bCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

09:16:c2:38:78:50:dc:ba:68:6f:2c:d3:e8:f6:25:d6Certificate

Extended Key Usages

Key Usages

66:d0:9a:7f:75:54:c7:ea:72:f9:79:1c:05:48:99:44:85:1a:10:0a:c3:ad:4b:f7:0b:b6:c5:bc:a9:8e:83:d5Signer

3b:3a:7c:73:c0:aa:14:c9:21:c6:89:8f:87:97:d6:6a:44:c1:c6:d9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

common

msvcp100

logext100

certutility100

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

0b:0f:49:95:06:70:e0:a4:0b:bd:bb:6d:ca:e0:5e:7b
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:16:c2:38:78:50:dc:ba:68:6f:2c:d3:e8:f6:25:d6
Certificate

66:d0:9a:7f:75:54:c7:ea:72:f9:79:1c:05:48:99:44:85:1a:10:0a:c3:ad:4b:f7:0b:b6:c5:bc:a9:8e:83:d5
Signer

3b:3a:7c:73:c0:aa:14:c9:21:c6:89:8f:87:97:d6:6a:44:c1:c6:d9
Signer

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB