372b9a0e618a20e9dc491df371a657a295e47f619974ae82c96141d7eb2eaa25

Sharing

Copy URL Twitter E-mail

General

Target

372b9a0e618a20e9dc491df371a657a295e47f619974ae82c96141d7eb2eaa25
Size

1.3MB
MD5

8955868e0d5b2dcfa53b20df30b5832e
SHA1

199a1e8ed00668ba806c55d253fadc1360120b7f
SHA256

372b9a0e618a20e9dc491df371a657a295e47f619974ae82c96141d7eb2eaa25
SHA512

42cfea882e0c1cf0f11faed09ce962db33b88371c63bbf707f23322c597da15fdc4f964a9a93b1366a3c6ccbb77c53bb586ec39b08bd1c88d4a9b9fb9731524b
SSDEEP

24576:WrmbPYls6kuKIPjYgZiAkpZfhI28NVLh4VNhef1d4oTa5p/AERWNBwa:rbluKyIhaDGc7Ta5p/bGBwa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
372b9a0e618a20e9dc491df371a657a295e47f619974ae82c96141d7eb2eaa25

Files

372b9a0e618a20e9dc491df371a657a295e47f619974ae82c96141d7eb2eaa25
.dll windows:4 windows x86 arch:x86

0d61bdf6561989bff6638a75482e44d9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select
recv
send
ioctlsocket
setsockopt
connect
getsockopt
__WSAFDIsSet
shutdown
closesocket
socket
WSACleanup
WSAStartup
getservbyport
gethostbyaddr
getservbyname
inet_addr
WSAGetLastError
inet_ntoa
WSASetLastError
ntohl
htonl
ntohs
gethostbyname
htons

kernel32

GetCurrentProcess
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetCurrentDirectoryA
GetFullPathNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
ReleaseSemaphore
WaitForSingleObject
OutputDebugStringA
Sleep
CreateSemaphoreA
CreateDirectoryA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
GetLastError
GetFileInformationByHandle
GetFileType
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
WriteFile
GetDiskFreeSpaceExA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleA
GetModuleFileNameA
ReadFile
SetFilePointer
FlushConsoleInputBuffer
GlobalMemoryStatus
GetCurrentProcessId
CreateFileA
CloseHandle
GetDriveTypeA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetTickCount
FileTimeToSystemTime
GetTimeZoneInformation
FileTimeToLocalFileTime
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
CreateFileW
SetStdHandle
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
UnhandledExceptionFilter
RtlUnwind
HeapAlloc
HeapFree
RaiseException
GetSystemTime
GetLocalTime
ExitProcess
TerminateProcess
HeapReAlloc
GetCommandLineA
GetVersion
CreateThread
ExitThread
SetLastError
HeapSize
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetStartupInfoA
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW

advapi32

ReportEventA
RegisterEventSourceA
GetSecurityInfo
DeregisterEventSource

user32

InvalidateRect
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

NS_BMPCapture
NS_ChangeRange
NS_CloseSound
NS_Download
NS_DownloadInMem
NS_EnableIVS
NS_Encrypt
NS_ExportDeviceConfig
NS_ExportDeviceLog
NS_ExportFile
NS_ExportReport
NS_FECRigisterDrawFun
NS_FEC_CapturePIC
NS_FEC_GetParam
NS_FEC_IsInFinshDraw
NS_FEC_PTZ2WindowEx
NS_FEC_Play
NS_FEC_SetDrawType
NS_FEC_SetFinshDraw
NS_FEC_TestScan
NS_FEC_UpDateParam
NS_Fast
NS_FiniLib
NS_FrameForward
NS_GetDownloadStatus
NS_GetHTTPErrorInfo
NS_GetIpcImportErrorInfo
NS_GetLastError
NS_GetNetworkInfo
NS_GetOSDTime
NS_GetPictureSize
NS_GetPlayedTime
NS_GetRecordFileSize
NS_GetScale
NS_GetUploadErrorInfo
NS_GetVolume
NS_ImportDeviceConfig
NS_InitLib
NS_JPEGCapture
NS_OpenSound
NS_Pause
NS_Play
NS_RefreshPlay
NS_RegAdditionFun
NS_RenderPrivateDataEx
NS_ResetPlayWnd
NS_Resume
NS_ReversePlay
NS_RigisterDrawFun
NS_SR_Rotate
NS_SelfDecryptInfo
NS_SendHttpSynRequest
NS_SetDVRMessageCallBack
NS_SetDisplayBuf
NS_SetDisplayCallBack
NS_SetDisplayRegion
NS_SetFishMsgCallBack
NS_SetHttpRequestCallBack
NS_SetMessageHandler
NS_SetOverlayPriInfoFlag
NS_SetSecretKey
NS_SetVolume
NS_Slow
NS_StartAlarmChan
NS_StartAsynUpload
NS_StartDownload
NS_StartDownloadEx
NS_StartDownloadExx
NS_StartFishListener
NS_StartSave
NS_StartUpgrade
NS_StartVoiceTalk
NS_Stop
NS_StopAlarmChan
NS_StopAsynUpload
NS_StopDownload
NS_StopFishListener
NS_StopHttpRequest
NS_StopSave
NS_StopUpgrade
NS_StopVoiceTalk
NS_SubmitHttpRequest
NS_SwitchFile
NS_UpgradeStatus
NS_Upload

Sections

.text
Size: 888KB - Virtual size: 884KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d61bdf6561989bff6638a75482e44d9

Headers

File Characteristics

Imports

ws2_32

kernel32

advapi32

user32

Exports

Exports

Sections

.text Size: 888KB - Virtual size: 884KB

.rdata Size: 256KB - Virtual size: 252KB

.data Size: 80KB - Virtual size: 1.3MB

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 68KB - Virtual size: 65KB

.text
Size: 888KB - Virtual size: 884KB

.rdata
Size: 256KB - Virtual size: 252KB

.data
Size: 80KB - Virtual size: 1.3MB

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 68KB - Virtual size: 65KB