Overview

overview

7

Static

static

3

NCSetup.exe

windows7-x64

7

NCSetup.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

$SYSDIR/xceedzip.dll

windows7-x64

1

$SYSDIR/xceedzip.dll

windows10-2004-x64

1

$TEMP/fzhnc/1.exe

windows7-x64

7

$TEMP/fzhnc/1.exe

windows10-2004-x64

7

$TEMP/fzhnc/QQBQ.exe

windows7-x64

7

$TEMP/fzhnc/QQBQ.exe

windows10-2004-x64

7

LICENSE.rtf

windows7-x64

4

LICENSE.rtf

windows10-2004-x64

1

NC.exe

windows7-x64

1

NC.exe

windows10-2004-x64

1

NCDLL.dll

windows7-x64

1

NCDLL.dll

windows10-2004-x64

1

NCDLLchs.dll

windows7-x64

1

NCDLLchs.dll

windows10-2004-x64

1

key.exe

windows7-x64

1

key.exe

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

unrar.dll

windows7-x64

3

unrar.dll

windows10-2004-x64

3

xcdsfx32.exe

windows7-x64

1

xcdsfx32.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    7f8f07231e2bbe5cc48b0143d8ac9b4c

  • Size

    1.1MB

  • MD5

    7f8f07231e2bbe5cc48b0143d8ac9b4c

  • SHA1

    f9c9ffed787ca88f472fbbc2fc71150a4041a9ed

  • SHA256

    11fb760aa8e3b7982a097511b06dce9f70f3a3a815a05296ecd22c5e588331d8

  • SHA512

    d1f8e419faa8f215458f50a1f8bb1e65305bca1a21ad1cb6fc64f97d7c748e133188f0aee36b9ce626b66585184363bac468b31d61ecb0da4c22ce4f47c06f98

  • SSDEEP

    24576:wWzz+DciYWzi3Aj3+vY/6h5JVISk+rOqmFZO93W7gVCBgs:wWvyciNDig/6hvKSJrQZO9mV3

Score
3/10

Malware Config

Signatures

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • 7f8f07231e2bbe5cc48b0143d8ac9b4c
    .rar
  • NCSetup.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/xceedzip.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    19b65baa7ae6fd735a9a9018efe8a691


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/fzhnc/1.exe
    .exe windows:5 windows x86 arch:x86

    c56a25fa4336eeb10723b3537ba4876d


    Headers

    Imports

    Sections

  • $TEMP/fzhnc/QQBQ.exe
    .exe windows:4 windows x86 arch:x86

    1bed3305885b0ca596d9cbba22baf78a


    Headers

    Imports

    Sections

  • LICENSE.RTF
    .rtf
  • NC.CNT
  • NC.GID
  • NC.HLP
  • NC.exe
    .exe windows:4 windows x86 arch:x86

    04564af00a96c5b7c5a9ce19e84d98a1


    Headers

    Imports

    Sections

  • NCDLL.DLL
    .dll windows:4 windows x86 arch:x86

    ce6ef31899b31809ae0c71c094c6f083


    Headers

    Imports

    Sections

  • NCDLLchs.DLL
    .dll windows:4 windows x86 arch:x86

    ce6ef31899b31809ae0c71c094c6f083


    Headers

    Imports

    Sections

  • README.TXT
  • key.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • unrar.dll
    .dll windows:4 windows x86 arch:x86

    385277c33e14ce37089eb1876b499856


    Headers

    Imports

    Exports

    Sections

  • xcdsfx32.bin
    .exe windows:4 windows x86 arch:x86

    63a5d7938b5c53bdfc2f46e503f74dd1


    Headers

    Imports

    Sections

  • ˵.txt
  • snap01.jpg
    .jpg
  • 下载说明.htm
    .html .js polyglot
  • 汉化说明.txt