69743f161c1e4f35a73bcb66db70bbb097abf463dc1940de75c6e5bd4afa5f32

Sharing

Copy URL Twitter E-mail

General

Target

69743f161c1e4f35a73bcb66db70bbb097abf463dc1940de75c6e5bd4afa5f32
Size

546KB
MD5

eb0a8375141637d16ed026ed9e898e6e
SHA1

23f09c8c02e2c732270c27558ee576469e2a6b46
SHA256

69743f161c1e4f35a73bcb66db70bbb097abf463dc1940de75c6e5bd4afa5f32
SHA512

11a6e7cc4124b128affd3efe1aefb10459137632a82bd9e2bed5593678941424a4f902eb8e686673be32a635a36d88974f522a2312934475e7bd771b9b740188
SSDEEP

12288:PPU/CD5YhdE0KKJnHpup9oCdGOSOnmz22lBOXKALzVKxd7AuE0XVn:kQ0d+KhpGWCdpBmz2Y0XVnsxiuBVn

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TFSC_W.dll
unpack001/UserTool.exe
unpack001/WTSKFInterface.dll

Files

69743f161c1e4f35a73bcb66db70bbb097abf463dc1940de75c6e5bd4afa5f32
.zip
TFSC_W.dll
.dll windows:4 windows x86 arch:x86

b0f64e386f7ade2e169520950a32bb9a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetErrorMode
QueryPerformanceFrequency
DisableThreadLibraryCalls
GetLogicalDriveStringsA
FreeLibrary
GetProcAddress
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LocalFree
WaitForSingleObject
CreateMutexA
GetVersionExA
ReleaseMutex
GetCurrentProcessId
DeviceIoControl
GetDriveTypeA
GetSystemDirectoryA
GetVolumeInformationA
ReadFile
SetFilePointer
WriteFile
QueryPerformanceCounter
GetLogicalDrives
DeleteFileA
SetFileAttributesA
FindClose
FindFirstFileA
GetVersion
CreateFileA
CloseHandle
GetLastError
Sleep

user32

wsprintfA

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo

shell32

SHGetSpecialFolderLocation

ole32

CoInitialize
CoUninitialize

msvcrt

malloc
_adjust_fdiv
_initterm
_onexit
__dllonexit
_strnicmp
sprintf
_mbsupr
_memicmp
free

Exports

Exports

SDSCBeginTransaction
SDSCConnectDev
SDSCDisconnectDev
SDSCEndTransaction
SDSCGetDriveName
SDSCGetFirmwareVer
SDSCGetFlashID
SDSCGetSCIOType
SDSCListDevs
SDSCListRemovableDrives
SDSCRegisterHWPNP
SDSCResetCard
SDSCResetController
SDSCTransmit
SDSCTransmitEx
SDSCTransmitSpecial
SDSCTransmitSpecialEx
SDSCUnregisterHWPNP

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UserTool.exe
.exe windows:5 windows x86 arch:x86

8a9f89cdf7a48bb89e5588d1c6e73863

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertSetCertificateContextProperty
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CertGetNameStringA
CertFreeCertificateContext
CertNameToStrA
CertCreateCertificateContext

kernel32

WideCharToMultiByte
lstrcpyW
GetTempFileNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
OpenFileMappingW
UnmapViewOfFile
FileTimeToSystemTime
LoadLibraryW
FileTimeToLocalFileTime
MapViewOfFile
LoadLibraryA
CreateMutexW
WaitForSingleObject
FreeLibrary
LocalFree
CreateFileMappingW
GetModuleHandleW
CreateProcessW
SystemTimeToFileTime
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
lstrcatW
GetTempPathA
GetPrivateProfileStringW
MultiByteToWideChar
HeapSize
GetSystemDirectoryW
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
lstrlenW
HeapFree
CreateSemaphoreW
FindResourceW
LoadResource
LockResource
FreeResource
GetVersionExW
SetThreadUILanguage
GetThreadLocale
SetThreadLocale
SizeofResource
GetTickCount
FindVolumeClose
FindNextVolumeA
SetFilePointerEx
GetLogicalDriveStringsA
GetLocalTime
SetVolumeLabelA
CreateFileA
SetVolumeMountPointA
GetLastError
Sleep
GetVolumePathNamesForVolumeNameA
GetVolumeNameForVolumeMountPointA
GetVolumeInformationA
FindFirstVolumeA
QueryDosDeviceA
GetDriveTypeA
DeviceIoControl
WriteFile
DeleteVolumeMountPointA
SetLastError
ReadFile
VirtualFreeEx
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
WriteConsoleW
GetFileAttributesExW
SetEndOfFile
SetStdHandle
ReadProcessMemory
VirtualAllocEx
GetProcAddress
GetSystemInfo
CloseHandle
OpenProcess
GetModuleHandleA
ReleaseMutex
GetCurrentDirectoryW
GetACP
GetFileSize
CreateFileW
MulDiv
GetCurrentProcess
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
DosDateTimeToFileTime
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetConsoleMode
ReadConsoleW
GetConsoleCP
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
LCMapStringW
GetStringTypeW

user32

DestroyWindow
SetWindowPos
IsWindowVisible
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
PtInRect
GetParent
GetWindow
wvsprintfW
SetCursor
OffsetRect
LoadCursorW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
CharPrevW
DrawTextW
FillRect
SetRect
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MoveWindow
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetMessageW
IsIconic
IsWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
MessageBoxW
RemovePropW
GetSystemMetrics
CreatePopupMenu
TrackPopupMenu
ShowWindow
RegisterDeviceNotificationW
AttachThreadInput
GetForegroundWindow
SetPropW
LoadIconW
wsprintfW
AppendMenuW
PostQuitMessage
UnregisterDeviceNotification
SetForegroundWindow
GetCursorPos
PostMessageW
GetPropW
GetWindowThreadProcessId
FindWindowExW
SendMessageW
FindWindowW
GetWindowLongW
GetWindowRect
SetWindowRgn
ScreenToClient
LoadStringW
SetWindowLongW
GetClientRect

gdi32

DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreatePatternBrush
GetObjectA
GetDeviceCaps
GdiFlush
CreateRoundRectRgn
DeleteObject
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
TextOutW
ExtTextOutW
GetTextExtentPointW

comdlg32

GetOpenFileNameW

advapi32

GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteW
Shell_NotifyIconW
ShellExecuteA

ole32

CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

setupapi

SetupDiGetClassDevsW
CM_Get_Device_IDW
SetupDiGetDeviceInterfaceDetailW
CM_Get_Child
CM_Get_Sibling
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

shlwapi

PathFileExistsW
wnsprintfW

comctl32

ord17
_TrackMouseEvent

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionFontW
ImmSetCompositionWindow

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

gdiplus

GdipSetPixelOffsetMode
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetStringFormatLineAlign
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign

Sections

.text
Size: 467KB - Virtual size: 466KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WTSKFInterface.dll
.dll windows:5 windows x86 arch:x86

696bb7f356a91f5032c978a02a8ba471

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
CloseHandle
CreateThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
CreateMutexA
ReleaseMutex
LocalFree
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentThreadId
GetProcAddress
LoadLibraryA
GetModuleFileNameA
CompareStringW
CreateFileW
ReadFile
GetProcessHeap
SetEndOfFile
WriteConsoleW
FlushFileBuffers
IsProcessorFeaturePresent
SetStdHandle
CreateFileA
ResetEvent
CreateEventA
Sleep
SetEvent
FreeLibrary
WaitForSingleObject
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapSize
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
RtlUnwind
SetFilePointer
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
LoadLibraryW
HeapReAlloc
GetStringTypeW
SetEnvironmentVariableA

user32

GetMessageA
CreateDialogParamA
IsDialogMessageA
TranslateMessage
EndDialog
SetWindowPos
ShowWindow
PostMessageA
DispatchMessageA
UnregisterDeviceNotification
RegisterDeviceNotificationA

advapi32

SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl

Exports

Exports

SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DeleteKeyPairOrCert
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCDecrypt
SKF_ECCDecryptExWT
SKF_ECCExportSessionKey
SKF_ECCSignData
SKF_ECCSignDataExWT
SKF_ECCVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_GenECCKeyPair
SKF_GenECCKeyPairExWT
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRSAKeyPairExWT
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKeyWithECC
SKF_GetContainerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_GetSecureState
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportExtECCKeyPair
SKF_ImportExtRSAKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_OpenApplication
SKF_OpenContainer
SKF_RSADecrypt
SKF_RSADecryptExWT
SKF_RSAExportSessionKey
SKF_RSASignData
SKF_RSASignDataExWT
SKF_RSAVerify
SKF_ReadFile
SKF_RemoteUnblockPIN
SKF_SetLabel
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteFile

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0f64e386f7ade2e169520950a32bb9a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

msvcrt

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 440B

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 4KB - Virtual size: 1KB

8a9f89cdf7a48bb89e5588d1c6e73863

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

setupapi

shlwapi

comctl32

imm32

oleaut32

gdiplus

Sections

.text Size: 467KB - Virtual size: 466KB

.rdata Size: 117KB - Virtual size: 117KB

.data Size: 6KB - Virtual size: 12KB

.gfids Size: 512B - Virtual size: 284B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 167KB - Virtual size: 166KB

.reloc Size: 26KB - Virtual size: 25KB

696bb7f356a91f5032c978a02a8ba471

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 20KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 440B

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 467KB - Virtual size: 466KB

.rdata
Size: 117KB - Virtual size: 117KB

.data
Size: 6KB - Virtual size: 12KB

.gfids
Size: 512B - Virtual size: 284B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 167KB - Virtual size: 166KB

.reloc
Size: 26KB - Virtual size: 25KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 20KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB