Resubmissions

28/02/2024, 08:57

240228-kwzr6sfg89 9

General

  • Target

    UniSignCRSV3Setup.exe

  • Size

    12.3MB

  • MD5

    209f26d94c90f63d38b11a465f5d4967

  • SHA1

    d99610aa8a209127df6fb7c10bbbd7b775a8aab5

  • SHA256

    860d83653d768dc3d4b77787c9842e498dd03f0bfececcf243f699c9ee5125b1

  • SHA512

    3102a2cd365aec9f5098e645e2b55ef6418ba6a698e523714eac0a93212e1a86af8a1535731916290a30889ed5186bbf58b1850a1c98252306eb05ff95c38978

  • SSDEEP

    393216:upOnIEWyB3QxQUgW6E2fkjA4sMrFEAgzf:fIEWyB3Q9V6FYs87+

Score
3/10

Malware Config

Signatures

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • UniSignCRSV3Setup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $LOCALAPPDATALOW/NPKI/CrossCert/0FD92CAF8B33B1B2B4F1151C9D786162E19B1427_10078.der
  • $LOCALAPPDATALOW/NPKI/CrossCert/B674A99B923CC751B122A44FBCB73CFE2233D776_4100.der
  • $LOCALAPPDATALOW/NPKI/KICA/2033DEEA8DF10D9143F21632A4E1B45449243FBD_1001.der
  • $LOCALAPPDATALOW/NPKI/KICA/AE52FD0E0E01F83086377EF618C649254A600970_4106.der
  • $LOCALAPPDATALOW/NPKI/KICA/B909F2B621489A2ABA025980862793166A77F559_10081.der
  • $LOCALAPPDATALOW/NPKI/KISA/BFB627D8035A76654C6101415631E58B7B3AD9CC_4.der
  • $LOCALAPPDATALOW/NPKI/KISA/C8D08EC749AE1F2042B24B7F13C977580CA1CDC1_1.der
  • $LOCALAPPDATALOW/NPKI/SignKorea/279696BEF384DC5901622423E2187BD3418D2D42_4098.der
  • $LOCALAPPDATALOW/NPKI/SignKorea/8DAA2008F089E01141BC7FA48E2AC4405ECA563A_10079.der
  • $LOCALAPPDATALOW/NPKI/TradeSign/2B7602AE825C7DEE81919EF5895BB9E2995BA9AF_10084.der
  • $LOCALAPPDATALOW/NPKI/TradeSign/4D5D560A0703DF83CAF3D56D8F19FC12AC90A28A_4105.der
  • $LOCALAPPDATALOW/NPKI/yessign/4AFBBD332D8BB1D18C946BFFE042365F1C91CB08_10080.der
  • $LOCALAPPDATALOW/NPKI/yessign/5204329F8F9D2172BAFA3398A8617E2733248D5F_1003.der
  • $PLUGINSDIR/ExecDos.dll
    .dll windows:4 windows x86 arch:x86

    2dfc6a992d004b736e85c64219a88b4a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KISA_HSAHVIEW_DLG.ini
  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    9a94f6ac0467741584e47f4e8de3e1c5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SimpleFC.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/certutil.exe
    .exe windows:5 windows x86 arch:x86

    ae5b17b1afd512b0299ef1c67da322c0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/freebl3.dll
    .dll windows:6 windows x86 arch:x86

    68765e49af812cea06653c4ddee9320d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nspr4.dll
    .dll windows:6 windows x86 arch:x86

    a6070e3824e66675bb029a2cf7952a4f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nss3.dll
    .dll windows:6 windows x86 arch:x86

    9e2f8a8cfc34da6dfd8f2fda9de568a7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nssckbi.dll
    .dll windows:6 windows x86 arch:x86

    451c3f4cd3e07105e71c24cbfb0b4bc7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nssdbm3.dll
    .dll windows:6 windows x86 arch:x86

    5711e67d03eac5e5866171565c333484


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nssutil3.dll
    .dll windows:6 windows x86 arch:x86

    6ba16e7e12b3827a81a688ff0a5191a4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/plc4.dll
    .dll windows:6 windows x86 arch:x86

    4598533a0c3b6c5ddb9612a89de425ce


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/plds4.dll
    .dll windows:6 windows x86 arch:x86

    4f9a53fbf939884bc7e65bde68799fc4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rootca.der
  • $PLUGINSDIR/smime3.dll
    .dll windows:6 windows x86 arch:x86

    661c75afc3436cc22e5522ac828d2bd6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/softokn3.dll
    .dll windows:6 windows x86 arch:x86

    f62703f3be4a59d359a62952d431248f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/sqlite3.dll
    .dll windows:6 windows x86 arch:x86

    08e0c5c4d25d1d7e6ba2923f9444c9ee


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ssl3.dll
    .dll windows:6 windows x86 arch:x86

    f348b63c7bfa0d338398a4f761b19b5a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/NPKI/CrossCert/0FD92CAF8B33B1B2B4F1151C9D786162E19B1427_10078.der
  • $PROGRAMFILES/NPKI/CrossCert/B674A99B923CC751B122A44FBCB73CFE2233D776_4100.der
  • $PROGRAMFILES/NPKI/KICA/2033DEEA8DF10D9143F21632A4E1B45449243FBD_1001.der
  • $PROGRAMFILES/NPKI/KICA/AE52FD0E0E01F83086377EF618C649254A600970_4106.der
  • $PROGRAMFILES/NPKI/KICA/B909F2B621489A2ABA025980862793166A77F559_10081.der
  • $PROGRAMFILES/NPKI/KISA/BFB627D8035A76654C6101415631E58B7B3AD9CC_4.der
  • $PROGRAMFILES/NPKI/KISA/C8D08EC749AE1F2042B24B7F13C977580CA1CDC1_1.der
  • $PROGRAMFILES/NPKI/SignKorea/279696BEF384DC5901622423E2187BD3418D2D42_4098.der
  • $PROGRAMFILES/NPKI/SignKorea/8DAA2008F089E01141BC7FA48E2AC4405ECA563A_10079.der
  • $PROGRAMFILES/NPKI/TradeSign/2B7602AE825C7DEE81919EF5895BB9E2995BA9AF_10084.der
  • $PROGRAMFILES/NPKI/TradeSign/4D5D560A0703DF83CAF3D56D8F19FC12AC90A28A_4105.der
  • $PROGRAMFILES/NPKI/yessign/4AFBBD332D8BB1D18C946BFFE042365F1C91CB08_10080.der
  • $PROGRAMFILES/NPKI/yessign/5204329F8F9D2172BAFA3398A8617E2733248D5F_1003.der
  • $PROGRAMFILES64/NPKI/CrossCert/0FD92CAF8B33B1B2B4F1151C9D786162E19B1427_10078.der
  • $PROGRAMFILES64/NPKI/CrossCert/B674A99B923CC751B122A44FBCB73CFE2233D776_4100.der
  • $PROGRAMFILES64/NPKI/KICA/2033DEEA8DF10D9143F21632A4E1B45449243FBD_1001.der
  • $PROGRAMFILES64/NPKI/KICA/AE52FD0E0E01F83086377EF618C649254A600970_4106.der
  • $PROGRAMFILES64/NPKI/KICA/B909F2B621489A2ABA025980862793166A77F559_10081.der
  • $PROGRAMFILES64/NPKI/KISA/BFB627D8035A76654C6101415631E58B7B3AD9CC_4.der
  • $PROGRAMFILES64/NPKI/KISA/C8D08EC749AE1F2042B24B7F13C977580CA1CDC1_1.der
  • $PROGRAMFILES64/NPKI/SignKorea/279696BEF384DC5901622423E2187BD3418D2D42_4098.der
  • $PROGRAMFILES64/NPKI/SignKorea/8DAA2008F089E01141BC7FA48E2AC4405ECA563A_10079.der
  • $PROGRAMFILES64/NPKI/TradeSign/2B7602AE825C7DEE81919EF5895BB9E2995BA9AF_10084.der
  • $PROGRAMFILES64/NPKI/TradeSign/4D5D560A0703DF83CAF3D56D8F19FC12AC90A28A_4105.der
  • $PROGRAMFILES64/NPKI/yessign/4AFBBD332D8BB1D18C946BFFE042365F1C91CB08_10080.der
  • $PROGRAMFILES64/NPKI/yessign/5204329F8F9D2172BAFA3398A8617E2733248D5F_1003.der
  • CCDaemon.exe
    .exe windows:5 windows x86 arch:x86

    b5c4b2ffba6f50d1c8e04ac1872afa1f


    Code Sign

    Headers

    Imports

    Sections

  • CertTransfer.dll
    .dll windows:4 windows x86 arch:x86

    5a9991222077f6251abf77e6484698ad


    Headers

    Imports

    Exports

    Sections

  • LibCCSSL.dll
    .dll windows:4 windows x86 arch:x86

    c41d2981546ce745a9dbb3878a2375e4


    Headers

    Imports

    Exports

    Sections

  • USToolkit.dll
    .dll windows:5 windows x86 arch:x86

    45d47269d99eb10b9e7cc8df8bbf677f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UniCRSLocalServer.exe
    .exe windows:6 windows x86 arch:x86

    baa93d47220682c04d92f7797d9224ce


    Code Sign

    Headers

    Imports

    Sections

  • UniCRSV3.dll
    .dll windows:6 windows x86 arch:x86

    baa93d47220682c04d92f7797d9224ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UniSignWebPluginIO.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    baa93d47220682c04d92f7797d9224ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UniSignWebToolkitV2.dll
    .dll windows:5 windows x86 arch:x86

    baa93d47220682c04d92f7797d9224ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:5 windows x86 arch:x86

    2466a57281bc6c27fa4772d66f1ca851


    Headers

    Imports

    Exports

    Sections

  • libxml2.dll
    .dll windows:6 windows x86 arch:x86

    f2293fd9c194b5e00f9485c58221d52e


    Headers

    Imports

    Exports

    Sections

  • nsldap32v11.dll
    .dll windows:4 windows x86 arch:x86

    7b103496832d12b54dafd19d2bf54834


    Headers

    Imports

    Exports

    Sections

  • quricol32.dll
    .dll windows:5 windows x86 arch:x86

    f44ea95867dfd4a725b69e9377af75fe


    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    4194d8e8ff314834552cb3df29d5cf71


    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis