5216cb113987195d6237227179d3501e7307d031296693490bac0983880b3146

Sharing

Copy URL

Twitter E-mail

General

Target

5216cb113987195d6237227179d3501e7307d031296693490bac0983880b3146
Size

1.2MB
MD5

d62fca023d5c9d5c0588ebbf01f1a269
SHA1

866b688bbe84c4145f71b13bf792c064e5229c8e
SHA256

5216cb113987195d6237227179d3501e7307d031296693490bac0983880b3146
SHA512

5cb7e780c1675fb1e12d329fecf47b9fee6493e8ad91af2f5cabad21eb44e422285f2d878c9c79fb85abe506ade1bee9bcec6b962f54504011e0b3d104384831
SSDEEP

24576:NeQJR4aTpTQMwWJjg668MSypERsjp7JyLHsS:N8a9TQKJjg66Mi99UDP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5216cb113987195d6237227179d3501e7307d031296693490bac0983880b3146

Files

5216cb113987195d6237227179d3501e7307d031296693490bac0983880b3146
.dll windows:5 windows x64 arch:x64

266131e3791ffa40aaa136b28f8c3d47

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

crypt32

CertOpenStore
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
PFXImportCertStore
CertGetNameStringA
CertFindExtension
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertGetIntendedKeyUsage
CertCreateCertificateContext
CertCloseStore
CertAddEncodedCertificateToStore
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore

kernel32

OpenFileMappingA
GetSystemDirectoryA
LoadLibraryExA
GetCurrentProcessId
InitializeCriticalSection
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
Sleep
FreeLibrary
DisableThreadLibraryCalls
GetCurrentThreadId
GetModuleHandleW
GetFileType
CreateFileMappingA
RtlVirtualUnwind
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
LoadLibraryW
GetVersionExW
FlushConsoleInputBuffer
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CloseHandle
CreateMutexA
GetVersion
GetModuleFileNameA
LocalFree
LoadLibraryA
GetStdHandle
GetProcAddress
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
EnterCriticalSection
GetProcessHeap
GetLastError
GetLocalTime
SetLastError
LocalAlloc
CreateFileW
SetEndOfFile
MultiByteToWideChar
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
HeapFree
HeapAlloc
GetFileAttributesA
FlsSetValue
GetCommandLineA
HeapReAlloc
ExitProcess
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
WriteFile
ReadFile
SetFilePointer
GetConsoleCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
FlushFileBuffers
SetStdHandle
CreateFileA
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW

user32

MessageBoxW
GetUserObjectInformationW
LoadStringA
GetProcessWindowStation
GetDesktopWindow

advapi32

InitializeSecurityDescriptor
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptGetUserKey
CryptExportKey
CryptDestroyKey
CryptReleaseContext
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo

Exports

Exports

BH_GetSignature
BH_ShowData
HS33ImprotRSA
HSBeginTransaction
HSCancelWaitForDevEvent
HSChangeDevAuth
HSChangePINRetryNum
HSChangeSOPin
HSChangeUserPin
HSClearAllPin
HSClearPin
HSCloseApp
HSConnectDev
HSCreateApp
HSCreateContainer
HSCreateFile
HSDESCbc
HSDESEcb
HSDelContainer
HSDelContainerItem
HSDeleteApp
HSDeleteFile
HSDevAuth
HSDeviceAuth
HSDisconnectDev
HSEndTransaction
HSErase
HSExportRSA
HSExportRSAPubKey
HSExportSM2PubKey
HSFingerprintQuery
HSFingerprintSet
HSFingerprintVerify
HSFingerprintVerifyEx
HSFormat
HSFormatEx2
HSFormatEx3
HSGenRSA
HSGenRSAEx
HSGenRSASoft
HSGenRandom
HSGenSM2KeyPair
HSGenSM9KeyPair
HSGetCategory
HSGetCertExtInfo
HSGetCertInfo
HSGetChangePINFlage
HSGetConfigValueInt
HSGetConfigValueString
HSGetContainerName
HSGetContainerNum
HSGetContainerParam
HSGetDevSafeState
HSGetDevState
HSGetDeviceInfo
HSGetFileRight
HSGetFileSize
HSGetFreeSize
HSGetHWApp
HSGetSOPinRetryNum
HSGetSOPinRetryNumEx
HSGetSerial
HSGetTimepiece
HSGetTimepieceOfCipher
HSGetTotalSize
HSGetUserPinRetryNum
HSGetUserPinRetryNumEx
HSGetZ
HSHasFileExist
HSHashData
HSHashDataSM3
HSHashFinal
HSHashFinalSM3
HSHashInit
HSHashInitSM3
HSHashPadding
HSHashUpdate
HSHashUpdateSM3
HSImportP12Cert
HSImportRSA
HSImportRSAEx
HSImportSM2
HSImportSM2BySM4Enc
HSImportSM2KeyPair
HSListApp
HSListContainers
HSListReaders
HSMD5
HSRSADecrypt
HSRSADecryptSoft
HSRSAEncrypt
HSRSAEncryptSoft
HSRSAPad
HSRSASign
HSRSASignBD
HSRSASignLCD
HSRSASignSoft
HSRSAVerify
HSRSAVerifySoft
HSReWriteUserPin
HSReadCachedPin
HSReadCert
HSReadDSN
HSReadESealData
HSReadFile
HSReadLabel
HSReadPCODE
HSRegistCertByData
HSRegistCertByHandle
HSRegistCertByReaderName
HSReset
HSSCB2Cbc
HSSHA1
HSSM1ImprotRSA
HSSM2Decrypt
HSSM2DecryptByCon
HSSM2Encrypt
HSSM2ExportSessionKey
HSSM2ImportSealSymKey
HSSM2ImportSessionKey
HSSM2KeyAgreement
HSSM2KeyAgreementInit
HSSM2Sign
HSSM2SignByCon
HSSM2Verify
HSSM4CBC
HSSM4DivCBC
HSSM4DivECB
HSSM4DivMac
HSSM4ImprotRSA
HSSM9DecryptByCon
HSSM9EncapsulePackByExtPubKey
HSSM9EncapsuleUnPackByCon
HSSM9EncryptByCon
HSSM9SignByCon
HSSM9VerifyByCon
HSSelectApp
HSSetConfigValueInt
HSSetConfigValueString
HSSetDevChgEvent
HSSetDevChgEventParam
HSSetTimepiece
HSSoftSM4Cbc
HSSoftSM4Cfb
HSSoftSM4Ecb
HSSoftSM4Ofb
HSSuchFingerprintVerify
HSSymEcb
HSSymFinal
HSSymInit
HSSymSessionEcb
HSSymSessionOFB
HSSymUpdate
HSUnRegistAllCert
HSUnRegistCertByData
HSVerifySOPin
HSVerifyUserPin
HSWaitForDevEvent
HSWriteCachedPin
HSWriteCert
HSWriteCharacter
HSWriteDSN
HSWriteESealData
HSWriteFile
HSWriteKey
HSWriteLabel
HSWritePCODE
HSWritePCODEEx
HS_BN_bin2bn
HS_BN_bn2bin
HS_BN_get_word
HS_BN_new
HS_BN_num_bits
HS_BN_num_bytes
HS_BN_set_word
HS_OBJ_obj2nid
HS_RSA_free
HS_RSA_new
HS_RSA_size
HS_X509_SIG_free
HS_d2i_RSAPrivateKey
HS_d2i_RSAPublicKey
HS_d2i_X509_SIG
HS_i2d_RSAPrivateKey
HS_i2d_RSAPublicKey
HYC_3DESDec
HYC_3DESEnc
HYC_ActiveMF
HYC_ChangePin
HYC_ClearSM1Key
HYC_ClearSM1KeyEEPROM
HYC_ClearSSF33Key
HYC_ClearSSF33KeyEEprom
HYC_CreateDF
HYC_CreateEF
HYC_CreateMF
HYC_DelDF
HYC_DelEF
HYC_DelMF
HYC_GenRSA
HYC_GenRandom
HYC_GenSM2Key
HYC_GenSM2TempKey
HYC_GetDevInfo
HYC_GetDevSafeState
HYC_GetECCKeyModulLen
HYC_GetEFSize
HYC_GetPinCacheFlag
HYC_GetPinRetryNum
HYC_GetRSAKeyModulLen
HYC_GetSM1KeyEEPROM
HYC_GetSOPinRetryNum
HYC_GetSSF33KeyEEprom
HYC_GetSymSupport
HYC_GetTimepiece
HYC_GetUserPinRetryNum
HYC_GetVerifyPinMode
HYC_LCDDownloadMatrix
HYC_LCDSingDada
HYC_PriKeyDoRaw
HYC_RSAEncExportSM1Key
HYC_RSAPubKeyDoRaw
HYC_ReadDSN
HYC_ReadEF
HYC_ReadPCODE
HYC_ReadRSAPubKey
HYC_ReadReservedSection
HYC_ResetUserPin
HYC_SCB2ImportEncKey
HYC_SM1Dec
HYC_SM1Enc
HYC_SM1ExportRSAKey
HYC_SM1GenKey
HYC_SM1GenKeyEEPROM
HYC_SM1GenKeyRSAEncExport
HYC_SM1GenKeySM2EncExport
HYC_SM1ImportKey
HYC_SM1ImportRSAKey
HYC_SM2CalculateE
HYC_SM2CalculateZ
HYC_SM2Dec
HYC_SM2Enc
HYC_SM2EncExportSM1Key
HYC_SM2ExchangeKey
HYC_SM2ExportEncSessionKey
HYC_SM2ImportEncKey
HYC_SM2ImportEncSessionKey
HYC_SM2ImportTempKey
HYC_SM2Singnature
HYC_SM2VerifySignature
HYC_SM3Digest
HYC_SSF33Dec
HYC_SSF33Enc
HYC_SSF33GenKey
HYC_SSF33GenKeyEEprom
HYC_SSF33GenKeyEncExport
HYC_SSF33ImportEncKey
HYC_SSF33ImportKey
HYC_SelDF
HYC_SelEF
HYC_SelMF
HYC_SetPinCacheFlag
HYC_SetSOPinRetryNum
HYC_SetUserPinRetryNum
HYC_UnLockUserDev
HYC_VerifyPin
HYC_WriteDSN
HYC_WriteEF
HYC_WriteKey
HYC_WritePCODE
HYC_WriteRSAPriKey
HYC_WriteRSAPubKey
HYC_WriteReservedSection

Sections

.text
Size: 787KB - Virtual size: 786KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 134KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

266131e3791ffa40aaa136b28f8c3d47

Headers

File Characteristics

Imports

rpcrt4

crypt32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 787KB - Virtual size: 786KB

.rdata Size: 235KB - Virtual size: 235KB

.data Size: 134KB - Virtual size: 155KB

.pdata Size: 39KB - Virtual size: 39KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 787KB - Virtual size: 786KB

.rdata
Size: 235KB - Virtual size: 235KB

.data
Size: 134KB - Virtual size: 155KB

.pdata
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 13KB