b46c71c6eb72aeff7c57277cc8f3c3c0N

Sharing

Copy URL Twitter E-mail

General

Target

b46c71c6eb72aeff7c57277cc8f3c3c0N
Size

868KB
MD5

b46c71c6eb72aeff7c57277cc8f3c3c0
SHA1

abbce1d3ce57f99ce842f74f6f8b3841cf744c68
SHA256

f96ff6be87ba8520cc188300d7d1949fcabe6b86e495e3350c8d9b1ac520e32f
SHA512

e652c07d74ada164c66146ceffd95166bc59eceea96fc4fe98820f82ca3797a4513e16e27a36dd35c350c37cfe5ca8e52b3354c9e500e4e07536c1d65751d83e
SSDEEP

12288:2pvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so:QZ5F/bYogxJUB9cwtHFMD

Score

1^/10

Malware Config

Signatures

Files

b46c71c6eb72aeff7c57277cc8f3c3c0N
.dll windows:6 windows x64 arch:x64

43821a5b012d073248d9d1388148a920

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2f:a7:a4:ea:d3:8b:19:00:06:8b:ae:6f:6c:44:60:d0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/02/2015, 00:00

Not After

04/12/2015, 23:59

Subject

CN=深圳市汉邦机电有限公司,O=深圳市汉邦机电有限公司,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:29:e5:ef:9b:3d:95:23:8a:4d:8b:cd:5f:17:bd:47:35:86:3c:96
Signer

Actual PE Digest

13:29:e5:ef:9b:3d:95:23:8a:4d:8b:cd:5f:17:bd:47:35:86:3c:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

unidrvui.pdb

Imports

msvcrt

isspace
_strnicmp
iswctype
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_errno
_vsnprintf
_wtol
_wcsicmp
wcsstr
_purecall
wcsncmp
strncmp
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_wtoi
_wcsnicmp
_stricmp
_itow
wcsrchr
atoi
memmove
_vsnwprintf
qsort
fprintf
vfprintf
towupper
wcschr

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemAlloc

user32

InvalidateRect
SendMessageW
LoadCursorW
SetWindowLongPtrW
SetDlgItemTextW
ShowWindow
GetDlgItem
GetDlgItemTextW
GetWindowLongPtrW
EndDialog
DialogBoxParamW
LoadStringW
MessageBoxW
MessageBeep
LoadIconW
SetDlgItemTextA
WinHelpW
SendDlgItemMessageW
EnableWindow
CheckRadioButton
SetCursor

kernel32

lstrlenW
lstrcmpW
HeapDestroy
SetLastError
LocalAlloc
HeapCreate
GetLastError
LocalFree
GetModuleHandleW
GetLocaleInfoW
VerifyVersionInfoW
GetSystemDirectoryW
VerSetConditionMask
GetFileAttributesExW
GetFileTime
GetSystemDefaultLCID
CompareFileTime
CopyFileW
LockResource
SizeofResource
LoadLibraryW
LoadResource
FindResourceW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
Sleep
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetFileAttributesW
GetFileSize
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
SetErrorMode
LoadLibraryExW
MultiByteToWideChar
HeapFree
CloseHandle
WriteFile
ReadFile
GetTempFileNameW
CreateDirectoryW
CreateFileW
MulDiv
WideCharToMultiByte
FreeLibrary
GetProcAddress
MoveFileExW
DeleteFileW
HeapAlloc

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winspool.drv

DeletePrinterDataW
SetPrinterDataW
GetPrinterDataW
GetPrinterW
EnumFormsW
AddFormW
DeleteFormW
OpenPrinterW
SetPrinterW
ClosePrinter
GetPrinterDriverW
GetFormW
GetPrinterDriverDirectoryW
DeviceCapabilitiesW

gdi32

CreateICW
EnumFontFamiliesW
CreateDCW
GetDeviceCaps
SetGraphicsMode
DeleteDC

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocStringLen
VariantChangeType
SysAllocString
SysStringLen

Exports

Exports

DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvResetConfigCache
DrvSplDeviceCaps
DrvUpgradePrinter
MxdcGetPDEVAdjustment

Sections

.text
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 248KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43821a5b012d073248d9d1388148a920

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

2f:a7:a4:ea:d3:8b:19:00:06:8b:ae:6f:6c:44:60:d0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

13:29:e5:ef:9b:3d:95:23:8a:4d:8b:cd:5f:17:bd:47:35:86:3c:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

ole32

user32

kernel32

version

winspool.drv

gdi32

oleaut32

Exports

Exports

Sections

.text Size: 585KB - Virtual size: 584KB

.data Size: 12KB - Virtual size: 13KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 248KB - Virtual size: 252KB

.reloc Size: 5KB - Virtual size: 4KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

2f:a7:a4:ea:d3:8b:19:00:06:8b:ae:6f:6c:44:60:d0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

13:29:e5:ef:9b:3d:95:23:8a:4d:8b:cd:5f:17:bd:47:35:86:3c:96
Signer

.text
Size: 585KB - Virtual size: 584KB

.data
Size: 12KB - Virtual size: 13KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 248KB - Virtual size: 252KB

.reloc
Size: 5KB - Virtual size: 4KB