NTSYS[.]DLL | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NTSYS.DLL
Size

75KB
MD5

7f4b70b9552e4388d6a4b121dc8b6938
SHA1

14ab5fc5ce72c1aa777923da7a93c66bea02eaf8
SHA256

6b27e4092a6d4f34c2d7fd4210cdfa9449ed9c4d549668c8d34ad1ea764dc194
SHA512

2abb9baffb3e7bc021d4ef5f49b02b8b468eb7580685eb85ec0ed8755821d14407a30a3f7e4e1e738db908f17b925e0d52b311e369b53947990bd261f901a763
SSDEEP

1536:3mhnal7lU+NDIbp1T6n+6xEyDOcAzeqXqjR04:2ZalhQkn+6xEgrArX34

Score

1^/10

Malware Config

Signatures

Files

NTSYS.DLL
.dll windows:5 windows x64 arch:x64

24a2173abe5b67a47306f52873031c4d

Code Sign

07:cc:c2:15:7f:65:e5:ae:1d:2b:1f:98:75:7a:e4:dd
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

05/10/2016, 00:00

Not After

20/06/2018, 12:00

Subject

CN=Quick Heal Technologies Private Limited,O=Quick Heal Technologies Private Limited,L=Pune,ST=Maharashtra,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:58:ce:c7:1d:d9:ed:ed:77:5f:34:08:ee:01:d7:70
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 00:00

Not After

20/06/2018, 12:00

Subject

SERIALNUMBER=091408,CN=Quick Heal Technologies Private Limited,O=Quick Heal Technologies Private Limited,POSTALCODE=411005,STREET=Shivaji Nagar+STREET=CTS No 1551\, Thube Park\, Behind Sancheti Physiotherapy Centre\,,L=Pune,ST=Maharashtra,C=IN,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:37:18:75:70:46:e7:c2:7c:9b:6d:28:4e:b2:4e:3f:c2:87:12:6f:89:03:ac:b7:b9:20:56:54:7b:38:1f:8a
Signer

Actual PE Digest

d4:37:18:75:70:46:e7:c2:7c:9b:6d:28:4e:b2:4e:3f:c2:87:12:6f:89:03:ac:b7:b9:20:56:54:7b:38:1f:8a

Digest Algorithm

sha256

PE Digest Matches

true

c9:b6:79:10:1f:1d:ca:0f:49:09:93:de:3c:9f:8b:8b:2e:6a:99:9f
Signer

Actual PE Digest

c9:b6:79:10:1f:1d:ca:0f:49:09:93:de:3c:9f:8b:8b:2e:6a:99:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\jenkins_source_v2\workspace\ENGINE_TRUNK\label\Win64_Vc8\native_src\trunk\native_engn\build\win\bin_native\x64\release\ntsys.pdb

Imports

ntdll

NtQueryInformationProcess
NtClose
NtQuerySecurityObject
RtlFreeHeap
NtOpenFile
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlCreateSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlQueryInformationAcl
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
RtlGetAce
RtlFreeSid
NtSetSecurityObject
RtlAllocateAndInitializeSid
RtlSetDaclSecurityDescriptor
RtlSelfRelativeToAbsoluteSD
NtOpenProcessToken
NtQueryInformationToken
_wcsicmp
NtAdjustPrivilegesToken
RtlSetOwnerSecurityDescriptor
memset
memcmp
_stricmp
strrchr
memcpy
NtQueryDirectoryFile
NtCreateFile
RtlInitUnicodeString
wcscat
wcscmp
wcsrchr
wcscpy
__chkstk
strlen
wcslen
wcsncat
wcschr
strcpy
LdrGetDllHandle
strcat
strcmp
RtlCopyUnicodeString
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlExpandEnvironmentStrings_U
wcsncpy
RtlZeroMemory
LdrLoadDll
NtSetInformationFile
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtFlushKey
NtQueryVolumeInformationFile
NtOpenDirectoryObject
NtCreateMutant
NtOpenMutant
NtReleaseMutant
NtWaitForSingleObject
NtQuerySystemInformation
_snwprintf
NtQueryInformationFile
NtFlushBuffersFile
NtWriteFile
LdrUnloadDll
LdrGetProcedureAddress
RtlInitAnsiString
NtReadFile
NtDeleteFile
_strupr
RtlAllocateHeap
RtlCreateHeap
RtlReAllocateHeap
NtDelayExecution
_vsnprintf
NtDisplayString
RtlAnsiStringToUnicodeString

Exports

Exports

CloseHandle
CreateDirectoryA
CreateMutex
ExpandEnvironmentStringsA
FreeLibrary
GetDriveTypeA
GetDriveTypeW
GetFileAttributesA
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetLongPathNameA
GetLongPathNameW
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileInt
GetPrivateProfileSection
GetPrivateProfileString
GetProcAddress
GetProfileString
GetShortPathNameA
GetShortPathNameW
GetSystemDirectoryA
GetVersionExA
GiveAllAccessRightsToFile
LoadLibraryA
LoadLibraryExA
LoadUserModeLibraries
MoveFileExA
MultiByteToWideChar
MyFindClose
MyFindFirstFileW
MyFindNextFileW
MyRegCloseKey
MyRegFlushKey
MyRegOpenKey
MyRegQueryValueKey
MyRegSetValueKey
NtStat
Ntfclose
Ntfdopen
Ntfeof
Ntferror
Ntfflush
Ntfgetc
Ntfopen
Ntfputc
Ntfread
Ntfseek
Ntftell
Ntfwrite
Ntrewind
OpenMutex
QhCreateMutexA
QhCreateMutexW
QhGlobalMemoryStatusEx
QhOpenMutexA
QhOpenMutexW
QhReleaseMutex
QhWaitForSingleObject
RegCloseKey
RegCreateKeyEx
RegDeleteKey
RegDeleteValue
RegEnumKeyEx
RegEnumValue
RegOpenKeyEx
RegQueryInfoKey
RegQueryValueEx
RegSetValueEx
ReleaseMutex
SetFileAttributesA
Sleep
WaitForSingleObject
WideCharToMultiByte
WritePrivateProfileSection
WritePrivateProfileString
WriteProfileString
_access
_chmod
_chsize
_close
_filelength
_fmode
_lseek
_lseek64
_mkdir
_open
_openwithmode
_read
_remove
_rename
_rmdir
_tell
_write
calloc
fcloseall
mycalloc
myfree
mymalloc
myprintf
myrealloc
mystrtok
mystrupr
myxrename
ntstrdup
rand

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24a2173abe5b67a47306f52873031c4d

Code Sign

07:cc:c2:15:7f:65:e5:ae:1d:2b:1f:98:75:7a:e4:ddCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

05:58:ce:c7:1d:d9:ed:ed:77:5f:34:08:ee:01:d7:70Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

d4:37:18:75:70:46:e7:c2:7c:9b:6d:28:4e:b2:4e:3f:c2:87:12:6f:89:03:ac:b7:b9:20:56:54:7b:38:1f:8aSigner

c9:b6:79:10:1f:1d:ca:0f:49:09:93:de:3c:9f:8b:8b:2e:6a:99:9fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 232B

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 230B

07:cc:c2:15:7f:65:e5:ae:1d:2b:1f:98:75:7a:e4:dd
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

05:58:ce:c7:1d:d9:ed:ed:77:5f:34:08:ee:01:d7:70
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

d4:37:18:75:70:46:e7:c2:7c:9b:6d:28:4e:b2:4e:3f:c2:87:12:6f:89:03:ac:b7:b9:20:56:54:7b:38:1f:8a
Signer

c9:b6:79:10:1f:1d:ca:0f:49:09:93:de:3c:9f:8b:8b:2e:6a:99:9f
Signer

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 232B

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 230B