Ntssc[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Ntssc.dll
Size

344KB
MD5

8bcb3be2a4d12ba3a29eb78e32c98177
SHA1

2e6ff417d5dfca6812c56f1e1411a80f8e85b944
SHA256

54dfa9da37cbf72a676da1d3109b134f57eb298fd050afff4f2650687270c27f
SHA512

1dec2fe3c1398ae178f6f2aaae51051e38896dbcb721582e8805f445f2ba18a838101d0de715503a4fdad65e1033ebeb34a1f27f6540f77c7d812acf6bcd877c
SSDEEP

3072:GUHtj61XwLparDHTlc5Isdgfqwdj6Pn+xrDNUEMSHvAMSHvv1iJ8oNTtMF:v2x2ZwR6Pn+xdUEMSHvAMSHvv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ntssc.dll

Files

Ntssc.dll
.dll windows:4 windows x86 arch:x86

5b36be7473a7f9733a5ac55081334e76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetPrivateProfileStringA
RaiseException
GetLocaleInfoW
SetEndOfFile
CloseHandle
CreateFileA
GetTickCount
WriteFile
ReadFile
SetCommTimeouts
PurgeComm
SetCommState
GetCommState
SetupComm
GetLastError
DeleteFileA
CopyFileA
GetCommTimeouts
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetFilePointer
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
SetStdHandle
FlushFileBuffers

user32

MessageBoxA

dcp3

P3_IC_LcdClrScrn
P3_IC_InitComm_Baud
P3_IC_PlayVoice
P3_IC_GetInputPass
P3_IC_ExitComm
P3_IC_DispInfo

hid

HidD_GetHidGuid
HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_FlushQueue
HidD_GetFeature
HidD_GetAttributes
HidD_SetFeature

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList

Exports

Exports

JS_CardApdu
JS_CardPowerOff
JS_CardPowerOn
JS_iCardControl
JS_iCardControlX
JS_iCardReadAtr
JS_iCardReadAtrX
JS_iClosePort
JS_iOpenPort
JS_iReadCard
JS_iReadCardEX
JS_iReadCardFlag
JS_iReadCardFlagX
JS_iReadCardNo
JS_iReadCardNoX
JS_iReadCardX
JS_iReadIDMsg
JS_iReadPin
JS_iReadPinX
JS_iReadPsamX
JS_iReadVer
JS_iWriteCard
JS_iWriteCardEX
JS_iWriteCardX
iCertCardInfosForNT
iChangePin
iClosePort
iGetDllVer
iOpenPort
iReadCardNo
iReadPsamNo
iResetPin

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b36be7473a7f9733a5ac55081334e76

Headers

File Characteristics

Imports

kernel32

user32

dcp3

hid

setupapi

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 163KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 32KB - Virtual size: 50KB

.rsrc Size: 4KB - Virtual size: 992B

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 164KB - Virtual size: 163KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 32KB - Virtual size: 50KB

.rsrc
Size: 4KB - Virtual size: 992B

.reloc
Size: 12KB - Virtual size: 11KB