afddb7cb23c9754703c6c1f1e6e6f8851cac8288711c4ce60cf1648705cdf298

Sharing

Copy URL

Twitter E-mail

General

Target

afddb7cb23c9754703c6c1f1e6e6f8851cac8288711c4ce60cf1648705cdf298
Size

2.0MB
MD5

09ae55534908bbb344b79878f4daa606
SHA1

505b2302c7cee23c4878e25a4cea275fd2c66f5b
SHA256

afddb7cb23c9754703c6c1f1e6e6f8851cac8288711c4ce60cf1648705cdf298
SHA512

d7d83395528bfeaf34e50c99a1f49367e94f916718134b2c2d077376d52f005b01b2292a218fb76c51851d0f90133c0a9135a93dc65d66f4c2e07028fb3879c2
SSDEEP

49152:wsOTWp8ushSKYl3x3Y00FwGuya/UJJEcrjh8U4QjiTW9:raushSKW3OVAUJJEcBV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afddb7cb23c9754703c6c1f1e6e6f8851cac8288711c4ce60cf1648705cdf298

Files

afddb7cb23c9754703c6c1f1e6e6f8851cac8288711c4ce60cf1648705cdf298
.dll windows:5 windows x86 arch:x86

92ae5e1f3dd165040cefa839f42ab87a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStdHandle
GetLocalTime
LocalFree
MultiByteToWideChar
WideCharToMultiByte
CreateFileA
FindFirstFileA
GetSystemDirectoryA
GetCurrentDirectoryA
FindNextFileA
FindClose
FormatMessageA
DeleteFileA
GetLastError
CopyFileA
CloseHandle
SetEndOfFile
CreateFileW
GetModuleFileNameA
ReleaseSemaphore
CreateSemaphoreA
SetDllDirectoryA
GetModuleHandleA
WaitForSingleObject
SetStdHandle
WriteConsoleW
LoadLibraryW
FlushFileBuffers
SetFilePointer
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
GetModuleFileNameW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetEnvironmentStringsW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetProcAddress
lstrlenA
FreeLibrary
LoadLibraryA
Sleep
GetTempPathA
SetCommTimeouts
SetCommState
GetCommState
SetupComm
ReadFile
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapReAlloc
HeapSize
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW

user32

MessageBoxA
wsprintfA

advapi32

RegOpenKeyA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumValueA

shlwapi

PathFileExistsA
PathIsRelativeA

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

winscard

SCardListReadersA
SCardConnectA
SCardStatusA
g_rgSCardT0Pci
SCardEstablishContext
SCardTransmit
SCardDisconnect
SCardGetStatusChangeA
SCardReleaseContext

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

send
recv

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

ole32

CoCreateInstance
CoSetProxyBlanket

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

DWChangePIN
DWCheckCardExist
DWCheckSSCard
DWChk_psam
DWConvertGBKHexStrToString
DWConvertStringToGBKHexStr
DWDeleteFile
DWGetCurrReaderInfoId
DWGetDeviceSamId
DWGetIDCardInfo
DWGetIDCardNum
DWGetIDCardPhoto
DWGetInputPIN
DWGetPSAM_SerialNum
DWGetPSAM_TN
DWGetReaderList
DWGetReaderPara
DWGetSPList
DWGetSSCardCommonData
DWGetSSCardExtraInfo
DWGetSSCardInfo
DWGetSSCardNum
DWGetSSOrIDCardInfo
DWGetSSorIDCardPhoto
DWHSM_AutoDetect
DWHSM_VerifyPIN
DWHSM_iReadCard
DWHSM_iReadCardBas
DWHSM_iReadCardBas_step2
DWHSM_iReadCard_Step1
DWHSM_iReadCard_Step2
DWICC_GetInputPass
DWICC_PowerOff
DWICC_PowerOn
DWICC_ReadData
DWICC_Select
DWICC_SendAPDU
DWICC_WriteData
DWICRead
DWICRead1
DWM1F08Write
DWNtssc_iReadCardNo
DWReadMedicare
DWReaderClose
DWReaderOpen
DWResetPIN
DWSetAutoDetect
DWSetListAndGetSSCardNum
DWSetReaderList
DWSetReaderPara
DWVerifyPIN
DW_WriteData
GetDLLVersion
JSONGetBool
JSONGetInt
JSONGetString
ZZZD_Sethandle
hex2asc

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

92ae5e1f3dd165040cefa839f42ab87a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

setupapi

winscard

version

ws2_32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 400KB - Virtual size: 399KB

.data Size: 19KB - Virtual size: 31KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 106KB - Virtual size: 105KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 400KB - Virtual size: 399KB

.data
Size: 19KB - Virtual size: 31KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 106KB - Virtual size: 105KB

.rmnet
Size: 56KB - Virtual size: 60KB