4fca1455ab8b26ca129807b381ab7d306f8da1076d04ccc7ffdd741720afba1a

Sharing

Copy URL Twitter E-mail

General

Target

4fca1455ab8b26ca129807b381ab7d306f8da1076d04ccc7ffdd741720afba1a
Size

1.1MB
MD5

13e3e40798d4959170254c4bea1167a6
SHA1

3982f9d96735f00e949ea1b0db8179eea4fed41a
SHA256

4fca1455ab8b26ca129807b381ab7d306f8da1076d04ccc7ffdd741720afba1a
SHA512

39671ab2e3336cd75d07f8a493a228fe3ea5265c057cdddb078fcb1ecd08f2c794776105d489d67ebc52bf8ea04c1c188052f6a85da657e59d90c54f170c2102
SSDEEP

24576:hLm4I49tYr7jGNczYjdgcZCikCNAED191yNJ1:NtEjGLyNJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fca1455ab8b26ca129807b381ab7d306f8da1076d04ccc7ffdd741720afba1a

Files

4fca1455ab8b26ca129807b381ab7d306f8da1076d04ccc7ffdd741720afba1a
.dll windows x86

0723ae84fa75b52e43a79efcf7f9f18f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup

kernel32

ResetEvent
LocalFree
FormatMessageW
GetPrivateProfileStringA
GetModuleFileNameA
LoadLibraryA
FreeLibrary
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
CloseHandle
WaitForSingleObjectEx
SetEvent
GetCurrentThreadId
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedExchangeAdd
TerminateProcess
GetCurrentProcess
GetVersion
WriteFile
GetFileType
GetStdHandle
GetModuleHandleExW
DeleteFiber
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ConvertFiberToThread
FindNextFileW
FindFirstFileW
FindClose
LoadLibraryW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetEnvironmentVariableW
IsValidCodePage
GetProcessHeap
HeapFree
InterlockedDecrement
InterlockedIncrement
IsProcessorFeaturePresent
OpenEventA
IsDebuggerPresent
GetModuleHandleW
GetTickCount
DecodePointer
InterlockedExchange
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

CryptGenRandom
CryptReleaseContext
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptAcquireContextW

msvcp100

?_Decref@facet@locale@std@@QAEPAV123@XZ
??1_Container_base12@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr100

wcslen
memset
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
strrchr
strncpy
strcat
memcmp
_stricmp
memchr
_purecall
??_V@YAXPAX@Z
strerror
_localtime64_s
_mkgmtime64
free
realloc
strchr
strftime
qsort
fclose
ferror
fread
fwrite
fflush
_setmode
_fileno
__iob_func
ftell
feof
fseek
fgets
_errno
malloc
_time64
_strnicmp
strspn
strtoul
strncmp
_snwprintf
_wfopen
fopen
strerror_s
atoi
strcmp
wcsstr
_vsnwprintf
_vsnprintf
_exit
raise
_gmtime64_s
sscanf
isspace
strstr
_stat64i32
getenv
strtol
strcspn
sprintf
fputs
signal
fprintf
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memmove
memcpy
??0exception@std@@QAE@ABQBDH@Z
strlen

Exports

Exports

_Java_cn_com_easyca_nc_jni_NCClientAPI_CFinalize@8
_Java_cn_com_easyca_nc_jni_NCClientAPI_GetUserID@12
_Java_cn_com_easyca_nc_jni_NCClientAPI_InitPkcs@8
_Java_cn_com_easyca_nc_jni_NCClientAPI_checkPasswd@12
_Java_cn_com_easyca_nc_jni_NCClientAPI_exportCertificate@12
_Java_cn_com_easyca_nc_jni_NCClientAPI_isUsbKeyExistent@8
_Java_cn_com_easyca_nc_jni_NCClientAPI_sign@16
_Java_cn_com_easyca_nc_jni_NCClientAPI_verify@16

Sections

.text
Size: 784KB - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 282KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0723ae84fa75b52e43a79efcf7f9f18f

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp100

msvcr100

Exports

Exports

Sections

.text Size: 784KB - Virtual size: 784KB

.rdata Size: 282KB - Virtual size: 281KB

.data Size: 5KB - Virtual size: 8KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 46KB - Virtual size: 46KB

.text
Size: 784KB - Virtual size: 784KB

.rdata
Size: 282KB - Virtual size: 281KB

.data
Size: 5KB - Virtual size: 8KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 46KB - Virtual size: 46KB