6fb8657ea9393628ebc4710a1b74abe3a4a33c2da351ac9483f604f4bb583106

Sharing

Copy URL Twitter E-mail

General

Target

6fb8657ea9393628ebc4710a1b74abe3a4a33c2da351ac9483f604f4bb583106
Size

7.1MB
MD5

07419017b001ac14c4f21b80fa3368ce
SHA1

20b59e31853ea508a3b9bc1ee6e9603c766dcf49
SHA256

6fb8657ea9393628ebc4710a1b74abe3a4a33c2da351ac9483f604f4bb583106
SHA512

ebe2fa67abb5729d5b264ae1bb29b86f2a62661092ff9be2dd1641bb322749041c5754c1a6529627c1e28e15081e9c0c68daf9f70aae99a75bf48198c8802c48
SSDEEP

196608:cBlk3Q4kbBZH/HU2NBakhNq4yNO55PYIMyPSmcrtW:cf4kbvUAhM4RSyPutW

Score

1^/10

Malware Config

Signatures

Files

6fb8657ea9393628ebc4710a1b74abe3a4a33c2da351ac9483f604f4bb583106
.zip
CYX_RGB_LED_Tool_V2.0.2.10_AD08_M1A_AD05.zip
.zip
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/01_vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

092eb6daba2f17cbda102fd1a32acd00

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2020, 00:00

Not After

18/03/2045, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:cc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

22/02/2024, 01:37

Not After

22/02/2025, 01:37

Subject

SERIALNUMBER=91440300MA5DRN3C5F,CN=Shenzhen CYX Industrial Co.\,Ltd.,O=Shenzhen CYX Industrial Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a
Signer

Actual PE Digest

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile

msvcrt

strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf

advapi32

AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA

ntdll

NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.2MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/CYX_RGB_LED_Tool.exe
.exe windows:5 windows x86 arch:x86

a5c85460389a34aefaee2543f3df876b

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2020, 00:00

Not After

18/03/2045, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:cc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

22/02/2024, 01:37

Not After

22/02/2025, 01:37

Subject

SERIALNUMBER=91440300MA5DRN3C5F,CN=Shenzhen CYX Industrial Co.\,Ltd.,O=Shenzhen CYX Industrial Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ec:42:74:af:af:57:4f:6b:f3:d0:74:b6:0b:74:a1:45:b9:ad:f5:8d
Signer

Actual PE Digest

ec:42:74:af:af:57:4f:6b:f3:d0:74:b6:0b:74:a1:45:b9:ad:f5:8d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\03_VC_Study\03_ECTools2Svn_S\02_HHZNCN_ECTools2Svn3_CYX_EC_RGB_Tool_V8_UI_S_IT5571_Am08Pro_V2_DynamicLib\CYX_RGB_LED_Tool_AM08Pro.pdb

Imports

mfc90

ord3504
ord6157
ord6398
ord5833
ord5846
ord6023
ord5957
ord6084
ord6352
ord6549
ord4565
ord6546
ord6043
ord6552
ord6046
ord2753
ord4392
ord4506
ord4477
ord5963
ord2481
ord2480
ord1603
ord941
ord301
ord6148
ord1668
ord4638
ord5585
ord6780
ord5647
ord2623
ord5389
ord5608
ord2139
ord3480
ord595
ord611
ord586
ord789
ord4030
ord4513
ord2069
ord5372
ord5063
ord6291
ord6646
ord333
ord4116
ord337
ord613
ord6048
ord4431
ord4952
ord4029
ord589
ord793
ord4197
ord1098
ord6462
ord2208
ord1791
ord3659
ord4890
ord3110
ord6001
ord5646
ord5663
ord4981
ord4333
ord2447
ord5659
ord5657
ord3209
ord2087
ord4199
ord5813
ord6721
ord5533
ord1046
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord4159
ord6783
ord4409
ord4434
ord374
ord3987
ord1938
ord4993
ord6559
ord2698
ord4502
ord6584
ord1678
ord524
ord744
ord5167
ord4727
ord5636
ord2146
ord3506
ord4668
ord1496
ord6388
ord3344
ord1809
ord1810
ord3218
ord5152
ord5615
ord3213
ord305
ord1611
ord3783
ord376
ord2057
ord4529
ord6557
ord6788
ord6740
ord2364
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4667
ord3620
ord3579
ord5750
ord1247
ord6791
ord5761
ord6802
ord1329
ord6152
ord525
ord2469
ord6166
ord310
ord4396
ord4527
ord6077
ord942
ord945
ord3223
ord1361
ord1108
ord2592
ord1144
ord2097
ord6079
ord798
ord3528
ord6527
ord6170
ord1061
ord1087
ord1137
ord2263
ord6078
ord817
ord3346
ord6391
ord1755
ord1752
ord4331
ord1497
ord4650
ord2074
ord5497
ord4589
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord6356
ord3612
ord3479
ord2587
ord6493
ord4337
ord2591
ord5876
ord265
ord266
ord2130
ord3568
ord2282
ord4498
ord3845
ord757
ord553
ord300
ord2327
ord820
ord686
ord436
ord1252
ord6554
ord6074
ord1358
ord1357
ord3534
ord2106
ord1254
ord316
ord601
ord2539
ord1183
ord1446
ord5309
ord3477
ord636
ord367
ord4617
ord1792
ord1276
ord639
ord800

msvcr90

__CxxFrameHandler3
__RTDynamicCast
_setmbcp
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
exit
__argv
__argc
memmove_s
memcpy_s
free
malloc
memset

kernel32

GetVersionExA
lstrlenA
GetVersion
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetSystemDefaultLangID
GetCurrentProcess
Sleep
GetModuleFileNameA
lstrcmpiA
FindResourceA
LoadResource
LockResource
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
SetLastError
GetCPInfo
WideCharToMultiByte
lstrlenW
MultiByteToWideChar

user32

EnableMenuItem
GetCursorPos
SetForegroundWindow
DrawIcon
IsIconic
KillTimer
SetTimer
GetSystemMenu
LoadIconA
LoadImageA
CreateIconIndirect
GetIconInfo
DrawStateA
GetClientRect
DrawFocusRect
OffsetRect
InflateRect
FrameRect
PostMessageA
GetWindowRect
GetActiveWindow
WindowFromPoint
ClientToScreen
InvalidateRect
SetCursor
GetParent
GetNextDlgTabItem
IsMenu
SendMessageA
GetWindowLongA
DestroyCursor
GrayStringA
DrawTextExA
TabbedTextOutA
EnableWindow
GetSubMenu
LoadBitmapA
GetSysColorBrush
CreatePopupMenu
CreateMenu
GetMenuItemID
GetMenuState
ModifyMenuA
GetMenuItemCount
AppendMenuA
ReleaseDC
GetDC
GetDesktopWindow
GetSystemMetrics
DestroyIcon
DrawIconEx
SystemParametersInfoA
DrawTextA
GetMenuItemInfoA
SetRect
DrawEdge
FillRect
GetSysColor
CopyRect
TrackPopupMenu

gdi32

CreateCompatibleBitmap
CreateSolidBrush
BitBlt
CreatePatternBrush
SetBkColor
CreateBitmap
GetStockObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
PatBlt
SetPixel
GetPixel
GetObjectA
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateFontIndirectA
GetBkMode
CreatePen
GetDeviceCaps
CreateCompatibleDC

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteExA
Shell_NotifyIconA

comctl32

_TrackMouseEvent
InitCommonControlsEx

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/io.dll
.dll windows:5 windows x86 arch:x86

5460078917e547a17a3ea1cccd2f3dad

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2020, 00:00

Not After

18/03/2045, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:cc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

22/02/2024, 01:37

Not After

22/02/2025, 01:37

Subject

SERIALNUMBER=91440300MA5DRN3C5F,CN=Shenzhen CYX Industrial Co.\,Ltd.,O=Shenzhen CYX Industrial Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b8:df:d2:58:0f:6e:70:53:f3:a2:fd:90:6c:74:e0:a9:a2:26:69:e9
Signer

Actual PE Digest

b8:df:d2:58:0f:6e:70:53:f3:a2:fd:90:6c:74:e0:a9:a2:26:69:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
LockResource
LoadResource
FindResourceA
SizeofResource
GetCurrentProcess
GetVersionExA
GetProcAddress
GetModuleHandleA
WriteFile
GetLastError
DeviceIoControl
OutputDebugStringA
GetSystemDirectoryA
CloseHandle
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers

advapi32

StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA

Exports

Exports

DlPortReadPortUchar
DlPortReadPortUlong
DlPortReadPortUshort
DlPortWritePortUchar
DlPortWritePortUlong
DlPortWritePortUshort
GetPhysLong
Inp32
IsInpOutDriverOpen
IsXP64Bit
MapPhysToLin
Out32
SetPhysLong
UnmapPhysicalMemory

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/01_On_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/01_On_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/02_Static_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/02_Static_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/03_Breath_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/03_Breath_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/04_ColorLoop_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/04_ColorLoop_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/05_RainBow_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/05_RainBow_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/06_Auto_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/06_Auto_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/06_Exit.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/07_Min.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/0_BG.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/Perf_P1_Blue-.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/Perf_P1_Blue.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/Perf_P2_Green.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_Cn/Perf_P3_Red.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/01_On_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/01_On_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/02_Static_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/02_Static_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/03_Breath_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/03_Breath_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/04_ColorLoop_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/04_ColorLoop_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/05_RainBow_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/05_RainBow_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/06_Auto_0.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/06_Auto_1.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/06_Exit.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/07_Min.ico
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/0_BG.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/Perf_P1_Blue.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/Perf_P2_Green.bmp
CYX_RGB_LED_Tool_V2.0.2.10_VirusIssuepwd-cyx_AD08/skin_En/Perf_P3_Red.bmp

Sharing

General

Malware Config

Signatures

Files

092eb6daba2f17cbda102fd1a32acd00

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8Certificate

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:ccCertificate

Extended Key Usages

Key Usages

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

user32

ntdll

comctl32

shell32

Sections

.text Size: 30KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 68KB

.rsrc Size: 4.2MB - Virtual size: 5KB

a5c85460389a34aefaee2543f3df876b

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8Certificate

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:ccCertificate

Extended Key Usages

Key Usages

ec:42:74:af:af:57:4f:6b:f3:d0:74:b6:0b:74:a1:45:b9:ad:f5:8dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90

msvcr90

kernel32

user32

gdi32

advapi32

shell32

comctl32

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 12KB - Virtual size: 12KB

5460078917e547a17a3ea1cccd2f3dad

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8Certificate

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:cc
Certificate

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a
Signer

.text
Size: 30KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 68KB

.rsrc
Size: 4.2MB - Virtual size: 5KB

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:cc
Certificate

ec:42:74:af:af:57:4f:6b:f3:d0:74:b6:0b:74:a1:45:b9:ad:f5:8d
Signer

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 12KB - Virtual size: 12KB

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

3a:e1:d6:24:70:23:6a:8d:29:f5:3f:cc
Certificate

b8:df:d2:58:0f:6e:70:53:f3:a2:fd:90:6c:74:e0:a9:a2:26:69:e9
Signer

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 4KB - Virtual size: 4KB