Overview

overview

7

Static

static

3

feiteng_su...ol.exe

windows7-x64

7

feiteng_su...ol.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

ExeHook.dll

windows7-x64

1

ExeHook.dll

windows10-2004-x64

1

JpgVSbmp.dll

windows7-x64

1

JpgVSbmp.dll

windows10-2004-x64

3

MonUrlExt.dll

windows7-x64

1

MonUrlExt.dll

windows10-2004-x64

1

NMSashok.dll

windows7-x64

1

NMSashok.dll

windows10-2004-x64

1

NMSearchHok.dll

windows7-x64

1

NMSearchHok.dll

windows10-2004-x64

1

NMUI.exe

windows7-x64

6

NMUI.exe

windows10-2004-x64

1

NMUrlMon.dll

windows7-x64

6

NMUrlMon.dll

windows10-2004-x64

6

PopHTMLTip.dll

windows7-x64

1

PopHTMLTip.dll

windows10-2004-x64

1

ScreenLogView.exe

windows7-x64

1

ScreenLogView.exe

windows10-2004-x64

1

SoftUpdate.dll

windows7-x64

1

SoftUpdate.dll

windows10-2004-x64

1

configcenter.dll

windows7-x64

1

configcenter.dll

windows10-2004-x64

1

dib.dll

windows7-x64

3

dib.dll

windows10-2004-x64

3

ftslsp.dll

windows7-x64

1

ftslsp.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    cc59d7104d662dc12502f8e363eae633

  • Size

    1.0MB

  • MD5

    cc59d7104d662dc12502f8e363eae633

  • SHA1

    3345e963fed32154180c5f4d5859a1aa8ff66dd0

  • SHA256

    38d73c586c06ef5121f851a52e8e4ec9bd53b3d278bb09d60e33e0aa204c4ece

  • SHA512

    98cda6fa568f6a9a8857853cbf9b98ca0431839bb6a33e44b6c840c9ac297b3238e5e0c50d705912dc1d9c19aced1ea01918f25d98ef8b2ca9cc6e840c02cf1d

  • SSDEEP

    24576:TK+o3F2koMwLC+9iu1zWGT4uLBUli6ybc5i:etV2kFNIiwSGVOji

Score
3/10

Malware Config

Signatures

  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs
    installer

Files

  • cc59d7104d662dc12502f8e363eae633
    .rar
  • feiteng_surfcontrol.exe
    .exe windows:4 windows x86 arch:x86

    170729c4965736ee8f8f4d1bab77cf38


    Headers

    Imports

    Sections

  • $EXEDIR/showtaskicon.bmp
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SetPassword.ini
  • $PLUGINSDIR/SetShortCut.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86

    e57536e0d3500471d52df7cea0d65a39


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • ExeHook.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    46a97f7304c97ad9e0df4e64343862a8


    Headers

    Imports

    Exports

    Sections

  • IntegralUnit.ini
  • JpgVSbmp.dll
    .dll windows:4 windows x86 arch:x86

    8ee1425373dbd6acff15e99152ac0ffb


    Headers

    Imports

    Exports

    Sections

  • MonUrlExt.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f4765fac19677fe35cddb35b0207893f


    Headers

    Imports

    Exports

    Sections

  • NMSashok.dll
    .dll windows:4 windows x86 arch:x86

    dd58aa8fd4fb1e4725106663565715c4


    Headers

    Imports

    Exports

    Sections

  • NMSearchHok.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    db20054a3b8e2f741b865545f98dc905


    Headers

    Imports

    Exports

    Sections

  • NMUI.exe
    .exe windows:4 windows x86 arch:x86

    39f167be751377c67b6f20ab5b05b5e1


    Headers

    Imports

    Sections

  • NMUrlMon.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2e36ccdbde9bbe5fbff0e88ed3fe9b4b


    Headers

    Imports

    Exports

    Sections

  • PopHTMLTip.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    03635043a9a9ed3b0ef44b64dd982dc7


    Headers

    Imports

    Exports

    Sections

  • ScreenLogView.exe
    .exe windows:4 windows x86 arch:x86

    2ce8b50a1c2d1e31d7da82cd4260dbc7


    Headers

    Imports

    Sections

  • SoftUpdate.dll
    .dll windows:4 windows x86 arch:x86

    86454a0a5c25c41a636e8cb93f47766d


    Headers

    Imports

    Exports

    Sections

  • configcenter.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    dd5133e02e9b866ec88d8999df490b21


    Headers

    Imports

    Exports

    Sections

  • dib.dll
    .dll windows:4 windows x86 arch:x86

    40f2dcddfddf54dc53ce2ffda36cd0a1


    Headers

    Imports

    Exports

    Sections

  • ftslsp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ae65ad9422d094c32aeee693a12711a5


    Headers

    Imports

    Exports

    Sections

  • misi.dat
  • pl.ini
  • report.htm
    .html .js polyglot
  • res.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • res/PopInfo.htm
    .html .js polyglot
  • res/close.gif
    .gif
  • res/close_down.gif
    .gif
  • res/main.gif
    .gif
  • res/mousemove_close.gif
    .gif
  • security.exe
    .exe windows:4 windows x86 arch:x86

    5e7243748eb848e623f0322f13569b0f


    Headers

    Imports

    Sections

  • ssi.dat
  • 新云软件.url
    .url