575aa1ccc1ef70fe920a688f46d25d7fe2ae5760386e8910f3832049ad5a7786

Sharing

Copy URL Twitter E-mail

General

Target

575aa1ccc1ef70fe920a688f46d25d7fe2ae5760386e8910f3832049ad5a7786
Size

1016KB
MD5

89a0cd7565125cb70b669c2b784cacb6
SHA1

8c0cfbd838e21edad7cae55ef0b9a01011b1237d
SHA256

575aa1ccc1ef70fe920a688f46d25d7fe2ae5760386e8910f3832049ad5a7786
SHA512

ccbac2a16446b82cc6e39974e4130d6f29efe80406c990a82f754206d286f8a5f9bed4b45699329173eadb9739b6298ca5a038496361c5d3289051667aa46e91
SSDEEP

12288:aER4fqg9todM2RHg2JXJQMHpVhspApEFFr/dVmAw9:1efVcS2VJQMHpspekr/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
575aa1ccc1ef70fe920a688f46d25d7fe2ae5760386e8910f3832049ad5a7786

Files

575aa1ccc1ef70fe920a688f46d25d7fe2ae5760386e8910f3832049ad5a7786
.dll windows:4 windows x86 arch:x86

9583ae986489f5d2510ee9e0bd1881bf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\jk_9\workspace\Module_DSSF-Client_W_P_2019.03.27_DSSF-Client_DSSF-700-XYYH_windows\code_path\DVRProxyServer__ca5152\bin\OnvifDeviceDll.pdb

Imports

libdsl

?append@DStr@dsl@@QAEAAV12@PBDH@Z
?findstr@DStr@dsl@@QBEHPBD@Z
??1DStr@dsl@@QAE@XZ
?GetTimeZone@DTime@dsl@@SAHXZ
??0DMutexGuard@dsl@@QAE@PAVDMutex@1@@Z
??1DMutexGuard@dsl@@QAE@XZ
?addref@DRefObj@dsl@@AAEHXZ
?release@DRefObj@dsl@@AAEHXZ
?SetFile@DPrintLog@dsl@@QAEHPBD@Z
?SetStderr@DPrintLog@dsl@@QAEH_N@Z
?SetSyslog@DPrintLog@dsl@@QAEH_N@Z
?SetLevel@DPrintLog@dsl@@QAEHH@Z
?MakeTime@DTime@dsl@@QBE_JXZ
?SetTime@DTime@dsl@@QAEX_J@Z
?strcpy_x@DStr@dsl@@SAHPADHPBD@Z
??0DStr@dsl@@QAE@XZ
?sprintf_x@DStr@dsl@@SAHPADHPBDZZ
?GetTime@DTime@dsl@@SA_JXZ
?DestroyTimer@DTimerMgr@dsl@@QAEHI@Z
?CreateTimer@DTimerMgr@dsl@@QAEIPAVDTimerHandler@2@@Z
?StartTimer@DTimerMgr@dsl@@QAEHIH@Z
?Lock@DMutex@dsl@@QAEXXZ
?Unlock@DMutex@dsl@@QAEXXZ
?instance@DPrintLog@dsl@@SAPAV12@XZ
?Log@DPrintLog@dsl@@QAAHPBDH0H0ZZ
?destroy@DRefObj@dsl@@MAEXXZ
?Reset@DRefObj@dsl@@UAEXXZ
?GetObjInfo@DRefObj@dsl@@UBEXPAVDStr@2@@Z
??0DRefObj@dsl@@IAE@XZ
??0DTimerHandler@dsl@@QAE@XZ
??0DTimerMgr@dsl@@QAE@XZ
??0DMutex@dsl@@QAE@XZ
??1DRefObj@dsl@@MAE@XZ
??1DTimerHandler@dsl@@MAE@XZ
??1DTimerMgr@dsl@@UAE@XZ
??1DMutex@dsl@@QAE@XZ
??0DTime@dsl@@QAE@XZ
?SetNow@DTime@dsl@@QAEXXZ
?GetTick@DTime@dsl@@SAIXZ
?Now@DTime@dsl@@SA_JXZ

ws2_32

inet_addr
inet_ntoa

thirddeviceinter

initOnvifComponentLibrary

jsonmd

??AValue@Json@@QAEAAV01@PBD@Z
??0Value@Json@@QAE@PBD@Z
?asInt@Value@Json@@QBEHXZ
??4Value@Json@@QAEAAV01@ABV01@@Z
??AValue@Json@@QAEAAV01@I@Z
??0Value@Json@@QAE@ABV01@@Z
?asUInt@Value@Json@@QBEIXZ
??1Value@Json@@QAE@XZ
??AValue@Json@@QBEABV01@PBD@Z
?asString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?size@Value@Json@@QBEIXZ
??0Value@Json@@QAE@_N@Z
??0Value@Json@@QAE@H@Z
??0Value@Json@@QAE@I@Z
?asCString@Value@Json@@QBEPBDXZ
??0Value@Json@@QAE@W4ValueType@1@@Z

inframd

?size@CPacket@Memory@Dahua@@QBEIXZ
?setPrintLogLevel@Infra@Dahua@@YAXH@Z
?none@ServerInfo@Component@Dahua@@2U123@B
??0ClassID@Component@Dahua@@QAE@PBD@Z
??0CTime@Infra@Dahua@@QAE@HHHHHH@Z
?getBuffer@CPacket@Memory@Dahua@@QBEPAEXZ
?valid@CPacket@Memory@Dahua@@QBE_NXZ
?parse@CTime@Infra@Dahua@@QAE_NPBD0H@Z
??0CTime@Infra@Dahua@@QAE@XZ
?format@CTime@Infra@Dahua@@QBEXPADPBDH@Z
?release@CComponentHelper@Detail@Component@Dahua@@SAHPAVIUnknown@34@@Z
?setAsCurrentUser@CComponentHelper@Detail@Component@Dahua@@SA_NPAVIClient@34@@Z
?addRef@CComponentHelper@Detail@Component@Dahua@@SAHPAVIUnknown@34@@Z
?getComponentFactory@CComponentHelper@Detail@Component@Dahua@@SAPAVIFactoryUnknown@34@PBDABUClassID@34@ABUServerInfo@34@AAPAVIClient@34@@Z
?iid@IFactory@IClient@Component@Dahua@@SAPBDXZ
?makeComponentObject@CComponentHelper@Detail@Component@Dahua@@SAPAVIUnknown@34@PAV534@@Z
?makeComponentInstance@CComponentHelper@Detail@Component@Dahua@@SAPAVIUnknown@34@PAV534@@Z
?attachPrint@Infra@Dahua@@YA_NV?$TFunction1@_NPBD@12@@Z

netframeworkmd

?CreateThreadPool@CNetThread@NetFramework@Dahua@@SAHI_N@Z
?DestroyThreadPool@CNetThread@NetFramework@Dahua@@SAHXZ

streammd

?getChannel@CMediaFrame@Stream@Dahua@@QBEHXZ
?getType@CMediaFrame@Stream@Dahua@@QBEHXZ
?getStreamType@CMediaFrame@Stream@Dahua@@QBE?AW4StreamType@23@XZ

streamappmd

initStreamAppComponentLibrary

mfc80

ord1191
ord1209
ord314
ord1177
ord1175
ord1201
ord1120
ord1167
ord1917
ord371
ord1098
ord1208
ord1206
ord1092
ord1037
ord1084
ord315
ord765
ord6754
ord372
ord265
ord764
ord762
ord1187
ord1185
ord266
ord581

msvcr80

sprintf
strcpy
strncpy
memmove
strstr
atol
sscanf
_time64
strchr
sprintf_s
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
printf
__RTDynamicCast
__iob_func
fprintf
_beginthreadex
_purecall
atoi
strcmp
strlen
memmove_s
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_recalloc
calloc
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
free
malloc
memset
memcpy
wcscpy_s
wcslen
_resetstkoflw
__CxxFrameHandler3
_stricmp

kernel32

lstrcmpiW
GetStringTypeExA
GetStringTypeExW
WideCharToMultiByte
lstrlenW
CompareStringA
CompareStringW
GetEnvironmentVariableA
MultiByteToWideChar
InterlockedExchange
GetVersion
GetEnvironmentVariableW
LoadLibraryExA
GetProcAddress
FreeLibrary
lstrcmpiA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
InterlockedCompareExchange
lstrlenA
GetLastError
Sleep
CloseHandle
CreateEventA
TerminateThread
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
GetCurrentThreadId
GetTickCount
InterlockedIncrement
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedDecrement
GetACP
GetLocaleInfoA
GetThreadLocale
InitializeCriticalSection
GetVersionExA

user32

CharLowerA
CharLowerW
CharUpperA
CharUpperW

msvcp80

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

oleaut32

SysFreeString

Exports

Exports

STDDVR_CloseCommand
STDDVR_CloseDevice
STDDVR_Connect
STDDVR_GetDeviceInfo
STDDVR_Heartbeat
STDDVR_Init
STDDVR_LoginDevice
STDDVR_OpenDevice
STDDVR_OpenDeviceEx
STDDVR_PraseCommand
STDDVR_SendData
STDDVR_SetCallBack
STDDVR_SetCallBackEx
STDDVR_UnInit

Sections

.text
Size: 792KB - Virtual size: 789KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9583ae986489f5d2510ee9e0bd1881bf

Headers

File Characteristics

PDB Paths

Imports

libdsl

ws2_32

thirddeviceinter

jsonmd

inframd

netframeworkmd

streammd

streamappmd

mfc80

msvcr80

kernel32

user32

msvcp80

oleaut32

Exports

Exports

Sections

.text Size: 792KB - Virtual size: 789KB

.rdata Size: 108KB - Virtual size: 105KB

.data Size: 56KB - Virtual size: 56KB

.idata Size: 16KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 33KB

.text
Size: 792KB - Virtual size: 789KB

.rdata
Size: 108KB - Virtual size: 105KB

.data
Size: 56KB - Virtual size: 56KB

.idata
Size: 16KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 33KB