3eb80542aa422b86fd412994b44ff577ed135081c81f91a96e0cb18ccc499139N

Sharing

Copy URL Twitter E-mail

General

Target

3eb80542aa422b86fd412994b44ff577ed135081c81f91a96e0cb18ccc499139N
Size

576KB
MD5

de335f7c37acdc211c8322d1184fb400
SHA1

12762b2a789e1ef093d09426eb6b08ee66eb9868
SHA256

3eb80542aa422b86fd412994b44ff577ed135081c81f91a96e0cb18ccc499139
SHA512

19631d445822caba20de78b77fa9d3203eebb6eadd3c29091616428d605afa6a74cae9eefc8c69efded22c8c514b175ab804e1378b102a5a3e4b9ec4b69cc366
SSDEEP

12288:S5pADv9u+l8QOqBKZGMll92x1TBTbOmw5Be:S7ADlu01BKvlYRdl

Score

1^/10

Malware Config

Signatures

Files

3eb80542aa422b86fd412994b44ff577ed135081c81f91a96e0cb18ccc499139N
.dll windows:4 windows x86 arch:x86

0333a95e0af2369b3db2b68ca0f8b01c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:02:4f:80:80:b9:b2:eb:c6:ca:f9:d9
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

16/08/2017, 05:48

Not After

01/08/2020, 05:33

Subject

CN=Zhejiang Dahua Technology CO.\,LTD.,OU=R & D Center,O=Zhejiang Dahua Technology CO.\,LTD.,L=Hangzhou,ST=Zhejiang,C=CN,1.2.840.113549.1.9.1=#0c0c73736c4069747275732e636e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:e2:e3:e6:ee:0d:8a:3c:5d:9e:3b:06
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

02/08/2017, 06:01

Not After

01/08/2020, 05:33

Subject

CN=Zhejiang Dahua Technology CO.\,LTD.,OU=R & D Center,O=Zhejiang Dahua Technology CO.\,LTD.,L=Hangzhou,ST=Zhejiang,C=CN,1.2.840.113549.1.9.1=#0c0c73736c4069747275732e636e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:9b:70:4b:9e:85:8b:2f:f3:e5:59:db:5a:e9:d9:db:92:87:09:35:08:89:1b:ab:72:c8:cd:9e:2f:03:ec:bf
Signer

Actual PE Digest

cb:9b:70:4b:9e:85:8b:2f:f3:e5:59:db:5a:e9:d9:db:92:87:09:35:08:89:1b:ab:72:c8:cd:9e:2f:03:ec:bf

Digest Algorithm

sha256

PE Digest Matches

true

47:16:07:04:07:93:ad:fc:8e:70:2c:e9:6a:bb:9d:45:76:d2:94:0e
Signer

Actual PE Digest

47:16:07:04:07:93:ad:fc:8e:70:2c:e9:6a:bb:9d:45:76:d2:94:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
CreateMutexA
CloseHandle
WaitForSingleObject
ReleaseMutex
CreateEventA
SetEvent
CreateSemaphoreA
ReleaseSemaphore
CreateThread
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
MultiByteToWideChar
GetCurrentThreadId
DeleteFileA
GetLastError
GetProcAddress
FreeLibrary
VirtualQuery
GetModuleFileNameA
LoadLibraryExA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateDirectoryA
WideCharToMultiByte
DisableThreadLibraryCalls

user32

MessageBoxA
GetWindowRect

gdi32

SetBkMode

shell32

ShellExecuteA

msvcrt

atan
free
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
_adjust_fdiv
sin
fabs
localtime
toupper
strcat
pow
strtok
printf
strstr
strchr
strncpy
atoi
rand
_access
strcpy
_mkdir
abs
fprintf
vsprintf
time
gmtime
ctime
sprintf
strlen
_ftol
strcmp
fseek
ftell
fread
fopen
_except_handler3
fclose
fwrite
fflush
__CxxFrameHandler
_purecall
malloc
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
??1type_info@@UAE@XZ
sscanf
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
_iob
fputs
??0exception@@QAE@ABV0@@Z
_itoa
memcpy
cos

msvcp60

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??_7runtime_error@std@@6B@
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1runtime_error@std@@UAE@XZ
??0runtime_error@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??9std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z

dhnetsdk

ord26
ord28
ord27
ord119
ord25
ord606
ord102
ord73
ord557
ord6
ord2
ord525
ord63
ord20
ord88
ord12
ord92
ord196
ord395
ord91
ord175
ord1
ord133
ord127
ord7
ord157
ord215
ord195
ord170
ord169
ord75
ord32
ord33
ord473
ord474
ord98
ord93
ord90
ord96
ord97
ord99
ord120
ord83
ord95
ord168
ord203
ord76
ord493
ord217
ord202

ws2_32

socket
htons
inet_addr
connect
closesocket
recv
send
WSAStartup

Exports

Exports

GetTransModuleImp
LoadNeedLibrary
ReleaseTransImp
UnLoadNeedlibrary
_FileOperation_Check_Write@8
_FileOperation_Read@12
_FileOperation_Write@12
_PLAY_AddToPlayGroup@8
_PLAY_AdjustWaveAudio@8
_PLAY_CatchResizePic@20
_PLAY_ChooseAudio@12
_PLAY_CloseAudioRecord@0
_PLAY_CloseFile@4
_PLAY_ClosePlayGroup@4
_PLAY_CloseStream@4
_PLAY_ConvertToBmpFile@24
_PLAY_ConvertToBmpFileEx@28
_PLAY_ConvertToJpegFile@24
_PLAY_DelFromPlayGroup@8
_PLAY_EnableLargePicAdjustment@8
_PLAY_Fast@4
_PLAY_FisheyeGetPosition@20
_PLAY_GetAudioChannels@8
_PLAY_GetAudioChooseState@12
_PLAY_GetBufferValue@8
_PLAY_GetColor@24
_PLAY_GetCurrentFrameRate@4
_PLAY_GetFileTime@4
_PLAY_GetFreePort@4
_PLAY_GetLastError@4
_PLAY_GetOverlayMode@4
_PLAY_GetPictureSize@12
_PLAY_GetPlayPos@4
_PLAY_GetPlayedFrames@4
_PLAY_GetPlayedTime@4
_PLAY_GetPlayedTimeEx@4
_PLAY_GetSourceBufferRemain@4
_PLAY_GetVolume@4
_PLAY_InputData@12
_PLAY_OneByOne@4
_PLAY_OneByOneBack@4
_PLAY_OpenAudioRecord@24
_PLAY_OpenFile@8
_PLAY_OpenPlayGroup@0
_PLAY_OpenStream@16
_PLAY_Pause@8
_PLAY_PausePlayGroup@8
_PLAY_Play@8
_PLAY_PlaySound@4
_PLAY_PlaySoundShare@4
_PLAY_QueryInfo@20
_PLAY_RefreshPlay@4
_PLAY_ReleasePort@4
_PLAY_ResetBuffer@8
_PLAY_ResetSourceBuffer@4
_PLAY_RigisterDrawFun@12
_PLAY_RigisterDrawFunEx@16
_PLAY_SeekPlayGroup@8
_PLAY_SetAVSyncType@8
_PLAY_SetColor@24
_PLAY_SetDecCallBack@8
_PLAY_SetDecInfoCallBack@12
_PLAY_SetDelayTime@12
_PLAY_SetDemuxCallBack@12
_PLAY_SetDisplayCallBack@12
_PLAY_SetDisplayRegion@20
_PLAY_SetEncTypeChangeCallBack@12
_PLAY_SetEncTypeChangeCallBackEx@12
_PLAY_SetFileEndCallBack@12
_PLAY_SetFishEyeInfoCallBack@12
_PLAY_SetIVSCallBack@12
_PLAY_SetMultiFrameDecCallBack@12
_PLAY_SetMultiSensorCallBack@12
_PLAY_SetOSDInfoCallBack@12
_PLAY_SetOverlayMode@12
_PLAY_SetPicQuality@8
_PLAY_SetPlayDirection@8
_PLAY_SetPlayGroupDirection@8
_PLAY_SetPlayGroupSpeed@8
_PLAY_SetPlayMethod@20
_PLAY_SetPlayPos@8
_PLAY_SetPlaySpeed@8
_PLAY_SetPlayedTimeEx@8
_PLAY_SetSEnhanceMode@8
_PLAY_SetSecurityKey@12
_PLAY_SetStreamOpenMode@8
_PLAY_SetVisibleDecCallBack@12
_PLAY_SetVolume@8
_PLAY_SetWaterMarkCallBackEx@12
_PLAY_Slow@4
_PLAY_SplitProc@8
_PLAY_SplitProcUpdate@8
_PLAY_StartAVIConvert@16
_PLAY_StartDataRecord@12
_PLAY_StartFisheye@4
_PLAY_StepPlayGroup@4
_PLAY_Stop@4
_PLAY_StopAVIConvert@4
_PLAY_StopDataRecord@4
_PLAY_StopFisheye@4
_PLAY_StopSound@0
_PLAY_StopSoundShare@4
_PLAY_VerticalSyncEnable@8
_PLAY_WriteData@12

Sections

.text
Size: 420KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 9.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0333a95e0af2369b3db2b68ca0f8b01c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

13:02:4f:80:80:b9:b2:eb:c6:ca:f9:d9Certificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

0b:e2:e3:e6:ee:0d:8a:3c:5d:9e:3b:06Certificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

cb:9b:70:4b:9e:85:8b:2f:f3:e5:59:db:5a:e9:d9:db:92:87:09:35:08:89:1b:ab:72:c8:cd:9e:2f:03:ec:bfSigner

47:16:07:04:07:93:ad:fc:8e:70:2c:e9:6a:bb:9d:45:76:d2:94:0eSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

msvcrt

msvcp60

dhnetsdk

ws2_32

Exports

Exports

Sections

.text Size: 420KB - Virtual size: 418KB

.rdata Size: 52KB - Virtual size: 50KB

.data Size: 28KB - Virtual size: 9.4MB

.reloc Size: 60KB - Virtual size: 56KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

13:02:4f:80:80:b9:b2:eb:c6:ca:f9:d9
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

0b:e2:e3:e6:ee:0d:8a:3c:5d:9e:3b:06
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

cb:9b:70:4b:9e:85:8b:2f:f3:e5:59:db:5a:e9:d9:db:92:87:09:35:08:89:1b:ab:72:c8:cd:9e:2f:03:ec:bf
Signer

47:16:07:04:07:93:ad:fc:8e:70:2c:e9:6a:bb:9d:45:76:d2:94:0e
Signer

.text
Size: 420KB - Virtual size: 418KB

.rdata
Size: 52KB - Virtual size: 50KB

.data
Size: 28KB - Virtual size: 9.4MB

.reloc
Size: 60KB - Virtual size: 56KB