fdecc9717e4816dd4c6c7b86a9b164075a29b90223b1ff4e8cfbab4260d60e6d

Sharing

Copy URL Twitter E-mail

General

Target

fdecc9717e4816dd4c6c7b86a9b164075a29b90223b1ff4e8cfbab4260d60e6d
Size

2.4MB
MD5

88ad607bdd90c95609c392304f970b86
SHA1

7eab208b988b8dd09238c258350ecb8ddbbb6306
SHA256

fdecc9717e4816dd4c6c7b86a9b164075a29b90223b1ff4e8cfbab4260d60e6d
SHA512

2241b417e85c17f13974f8c2fa00744396c1778dfea9843228881c8b7cd1ad0739ae3c5fd1e67f5e1b194a1c048233379f9ab3dc18d3962220a51b31291adc29
SSDEEP

49152:cPtLcmBPSw0McG7mASmSdbnDtQza3Lw4aGcZkTeLocLLfwIYtyMs8W/DW+G4d:cPhSwmG7mA5gbnDCza3LqG0kTeLo2HYA

Score

1^/10

Malware Config

Signatures

Files

fdecc9717e4816dd4c6c7b86a9b164075a29b90223b1ff4e8cfbab4260d60e6d
.dll windows:5 windows x86 arch:x86

93aff1fffbb3bebaf476a42d13fd3bcc

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:b3:33:38:d6:02:1c:4a:89:d2:fa:89
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

19/03/2021, 07:35

Not After

19/03/2024, 07:35

Subject

SERIALNUMBER=91440300068590430Q,CN=深圳市迈德威视科技有限公司,O=深圳市迈德威视科技有限公司,STREET=龙华区大浪街道新石社区嘉义源数码科技园6号5层,L=深圳,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085348454e5a48454e,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:f5:00:9b:d6:c2:cc:5d:6d:e1:50:e5:75:cc:20:7b:18:58:5e:0e:ac:c0:31:7d:21:6f:41:50:37:62:90:02
Signer

Actual PE Digest

61:f5:00:9b:d6:c2:cc:5d:6d:e1:50:e5:75:cc:20:7b:18:58:5e:0e:ac:c0:31:7d:21:6f:41:50:37:62:90:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStringTypeW
CompareStringW
GetConsoleCP
GetConsoleMode
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetCurrentDirectoryW
GetDriveTypeW
GetProcessHeap
GetDateFormatA
GetTimeFormatA
DeleteFileW
FindNextFileA
InterlockedCompareExchange
CreateDirectoryW
DeviceIoControl
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetSystemDirectoryA
MoveFileW
SleepEx
QueueUserAPC
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
GetStartupInfoW
GetLocaleInfoW
GetStdHandle
LCMapStringW
IsValidCodePage
HeapDestroy
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetFileType
SetStdHandle
HeapQueryInformation
HeapSize
ExitProcess
VirtualQuery
GetSystemInfo
VirtualAlloc
GetCommandLineA
CreateThread
ExitThread
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
RtlUnwind
RaiseException
HeapFree
GetSystemTimeAsFileTime
GetTimeZoneInformation
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetNumberFormatA
GetWindowsDirectoryA
SearchPathA
GetProfileIntA
GetACP
GetOEMCP
GetCPInfo
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
GetFileAttributesExA
GetTempPathA
GetTempFileNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpiA
FindResourceA
FreeResource
GlobalFindAtomA
lstrcmpW
DeleteFileA
GlobalFlags
GetVersionExA
lstrcpyA
GetSystemDirectoryW
LoadLibraryW
GetCurrentDirectoryA
FileTimeToSystemTime
GlobalGetAtomNameA
InterlockedIncrement
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetCurrentProcessId
GlobalAddAtomA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
ResumeThread
GlobalDeleteAtom
GetCurrentThread
GetModuleFileNameA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
LoadLibraryExA
CompareStringA
ActivateActCtx
LoadLibraryA
DeactivateActCtx
lstrcmpA
GetModuleHandleW
GetProcAddress
FreeLibrary
InterlockedExchange
ReleaseMutex
CreateMutexA
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
lstrlenW
MulDiv
lstrlenA
SetThreadPriority
CreateEventA
ReadFile
GetOverlappedResult
CancelIo
SetLastError
ResetEvent
SetEvent
WaitForSingleObject
QueryPerformanceFrequency
GetTickCount
QueryPerformanceCounter
CloseHandle
CreateFileA
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
SizeofResource

user32

GetSystemMenu
LoadMenuW
SetClassLongA
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
OffsetRect
IsRectEmpty
DestroyMenu
GetMenuItemInfoA
IntersectRect
InflateRect
CharUpperA
DestroyIcon
IsIconic
ShowWindow
MoveWindow
IsDialogMessageA
CheckDlgButton
RegisterWindowMessageA
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
KillTimer
SetTimer
InvalidateRect
ToAsciiEx
GetDesktopWindow
RealChildWindowFromPoint
GetWindow
GetDlgCtrlID
GetWindowRect
SetCapture
PtInRect
SetWindowTextA
GetClassInfoA
DefWindowProcA
MapWindowPoints
GetClientRect
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SystemParametersInfoA
GetMonitorInfoA
SetRectEmpty
CopyRect
DeleteMenu
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
MapVirtualKeyA
GetKeyboardLayout
GetKeyboardState
GrayStringA
DrawTextExA
MessageBoxA
wsprintfA
RemoveMenu
GetSubMenu
DrawTextA
TabbedTextOutA
FillRect
GetWindowTextLengthA
GetWindowTextA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
LoadAcceleratorsW
CreateAcceleratorTableA
SetRect
SetCursorPos
BringWindowToTop
LockWindowUpdate
CopyImage
UnionRect
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
TranslateAcceleratorA
InsertMenuItemA
LoadAcceleratorsA
IsWindowEnabled
EnableWindow
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetMenuItemCount
InsertMenuA
GetMenuItemID
AppendMenuA
GetMenuStringA
GetMenuState
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
ReleaseCapture
MessageBeep
DrawStateA
DrawIconEx
DrawEdge
DrawFrameControl
DrawFocusRect
GetClassNameA
CopyAcceleratorTableA
LoadImageA
LoadMenuA
ReuseDDElParam
UnpackDDElParam
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
GetWindowRgn
DestroyCursor
DrawIcon
MapDialogRect
GetNextDlgGroupItem
HideCaret
InvertRect
SubtractRect
MapVirtualKeyExA
MonitorFromPoint
IsCharLowerA
GetIconInfo
GetDoubleClickTime
CharUpperBuffA
CopyIcon
RegisterClipboardFormatA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetMenuDefaultItem
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
WaitMessage
PostThreadMessageA
CreateMenu
IsMenu
UpdateLayeredWindow
EnableScrollBar
UpdateWindow
GetKeyNameTextA

gdi32

DeleteObject
SelectClipRgn
CreateRectRgn
GetObjectA
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateDIBitmap
CreateFontIndirectA
CreateCompatibleBitmap
CreateRectRgnIndirect
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
SetRectRgn
CombineRgn
DPtoLP
GetTextExtentPoint32A
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
OffsetRgn
GetRgnBox
SetDIBColorTable
RealizePalette
StretchBlt
SetPixel
Rectangle
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
EnumFontFamiliesExA
GetTextFaceA
SetPixelV
GetLayout
SetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreateDCA
CopyMetaFileA
PatBlt
GetDeviceCaps

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHAppBarMessage
DragQueryFileA
DragFinish
SHGetFileInfoA
ShellExecuteA
SHGetDesktopFolder

comctl32

ImageList_GetIconSize

ole32

OleLockRunning
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
DoDragDrop
CreateStreamOnHGlobal
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VariantInit
SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen

gdiplus

GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipDrawImageI
GdipGetImageWidth
GdipBitmapLockBits
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCloneImage
GdipBitmapUnlockBits
GdipGetImageHeight
GdipGetImagePaletteSize

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathIsDirectoryA
PathIsRelativeA

winmm

PlaySoundA

Exports

Exports

CameraInit
CameraPlay
CameraStop
CameraUpdate
DisplayImage
EnableTestMode
SaveParams
StartVideo

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mvp0
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93aff1fffbb3bebaf476a42d13fd3bcc

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

7d:b3:33:38:d6:02:1c:4a:89:d2:fa:89Certificate

Extended Key Usages

Key Usages

61:f5:00:9b:d6:c2:cc:5d:6d:e1:50:e5:75:cc:20:7b:18:58:5e:0e:ac:c0:31:7d:21:6f:41:50:37:62:90:02Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

gdiplus

oleacc

imm32

setupapi

shlwapi

winmm

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 464KB - Virtual size: 464KB

.data Size: 48KB - Virtual size: 79KB

.mvp0 Size: 128KB - Virtual size: 128KB

.reloc Size: 175KB - Virtual size: 174KB

.rsrc Size: 12KB - Virtual size: 12KB

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

7d:b3:33:38:d6:02:1c:4a:89:d2:fa:89
Certificate

61:f5:00:9b:d6:c2:cc:5d:6d:e1:50:e5:75:cc:20:7b:18:58:5e:0e:ac:c0:31:7d:21:6f:41:50:37:62:90:02
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 464KB - Virtual size: 464KB

.data
Size: 48KB - Virtual size: 79KB

.mvp0
Size: 128KB - Virtual size: 128KB

.reloc
Size: 175KB - Virtual size: 174KB

.rsrc
Size: 12KB - Virtual size: 12KB