cdad6cbe20ed253419fa2856b922fcf4dc02b5ac5eb5875739edc8e414e1dfc9

Sharing

Copy URL Twitter E-mail

General

Target

cdad6cbe20ed253419fa2856b922fcf4dc02b5ac5eb5875739edc8e414e1dfc9
Size

6.8MB
MD5

3f6122f5055e4179ffca2876438c981f
SHA1

afe19e07839ea2c4f5cea70fa46a852c9e4e01a7
SHA256

cdad6cbe20ed253419fa2856b922fcf4dc02b5ac5eb5875739edc8e414e1dfc9
SHA512

6b67750b66c3535656458915abeda36bab24b861ec10e96387bb200ad41228158c6e403c7ca130f9bcc65fc0870154410b0599bad4c1a8f0601caf29eb30d060
SSDEEP

196608:hnAWtbSE0N2LtyNPU+y6Q4F1Vg9b+s/5v4:hAWtGEK2QFE9bp5v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdad6cbe20ed253419fa2856b922fcf4dc02b5ac5eb5875739edc8e414e1dfc9

Files

cdad6cbe20ed253419fa2856b922fcf4dc02b5ac5eb5875739edc8e414e1dfc9
.dll windows:5 windows x86 arch:x86

f055d6e6c1132c0df36969fcf56264d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\workspace\YHKJ\NationECCode\Release\NationECCode.pdb

Imports

kernel32

GetOEMCP
IsValidCodePage
SetHandleCount
GetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetConsoleCtrlHandler
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
GetDriveTypeW
GetCommandLineA
CreateThread
ExitThread
DecodePointer
EncodePointer
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SetConsoleMode
GetNumberFormatW
GetFileInformationByHandle
FindFirstFileExA
GetDriveTypeA
GetACP
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
lstrcpynW
WaitCommEvent
GetCommMask
GetExitCodeThread
BuildCommDCBW
SetCommState
GetCommState
ClearCommError
PurgeComm
GetCommTimeouts
SetCommMask
ResetEvent
GetOverlappedResult
SetCommTimeouts
SetupComm
WaitForMultipleObjects
DosDateTimeToFileTime
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
VirtualQuery
VirtualAlloc
HeapQueryInformation
GetFileType
SetStdHandle
RaiseException
RtlUnwind
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
GetTempFileNameW
GlobalFindAtomW
GlobalFlags
lstrcpyW
GetSystemDirectoryW
lstrlenA
GlobalGetAtomNameW
GetVolumeInformationW
DuplicateHandle
lstrcmpiW
GetFileTime
GetFileSizeEx
SetFileTime
CompareStringW
InterlockedIncrement
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalAddAtomW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
lstrcmpA
GlobalDeleteAtom
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
lstrcmpW
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
InitializeCriticalSectionAndSpinCount
ActivateActCtx
DeactivateActCtx
FileTimeToLocalFileTime
FileTimeToSystemTime
SetLastError
GlobalFree
CopyFileW
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetEnvironmentVariableA
GetCurrentDirectoryW
DeleteFileA
AreFileApisANSI
GetSystemTime
LocalFree
GetTempPathA
DeleteFileW
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
FlushFileBuffers
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
FormatMessageW
LoadLibraryW
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
OutputDebugStringW
GetCurrentProcessId
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
WaitForSingleObject
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
TryEnterCriticalSection
SetFilePointer
HeapCompact
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
lstrlenW
GetLastError
CreateMutexW
Sleep
GetTickCount
WritePrivateProfileStringA
CreateProcessW
GetStartupInfoW
GetModuleFileNameA
ExitProcess
FreeResource
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
SetUnhandledExceptionFilter
CreateDirectoryA
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetCurrentThreadId
CreateFileA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetLocalTime
CreateDirectoryW
GetModuleFileNameW
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
ReadConsoleInputA

user32

IsRectEmpty
DestroyMenu
GetMenuItemInfoW
InflateRect
DestroyIcon
ShowWindow
MoveWindow
IsDialogMessageW
CheckDlgButton
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
IsWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
RedrawWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
OffsetRect
DeferWindowPos
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
GetScrollInfo
SetScrollInfo
GetWindowThreadProcessId
GetParent
SetParent
GetSystemMetrics
SetWindowPlacement
GetWindowPlacement
CallWindowProcW
GetMenu
InvalidateRect
UpdateWindow
RealChildWindowFromPoint
GetWindow
GetDlgCtrlID
GetClassNameW
PtInRect
SetWindowTextW
EndPaint
BeginPaint
GetWindowDC
LoadMenuW
GetSystemMenu
SetCapture
ReleaseCapture
MessageBeep
DrawStateW
DrawIconEx
DrawEdge
TranslateAcceleratorW
DrawFrameControl
DrawFocusRect
CopyAcceleratorTableW
ToUnicodeEx
MapVirtualKeyW
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetClassInfoW
DefWindowProcW
MapWindowPoints
SetLayeredWindowAttributes
GetKeyboardLayout
DestroyAcceleratorTable
CreatePopupMenu
WindowFromPoint
NotifyWinEvent
GetAsyncKeyState
SetClassLongW
EqualRect
GetWindowLongW
SetWindowLongW
GetClientRect
SetWindowPos
MessageBoxW
IsIconic
ScreenToClient
IsZoomed
KillTimer
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetGUIThreadInfo
InvalidateRgn
GetCaretBlinkTime
GetCaretPos
SetCaretPos
ShowCaret
CreateCaret
CharPrevW
CharNextW
RegisterClassExW
wvsprintfW
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
SetTimer
GetWindowRect
SetWindowRgn
GetActiveWindow
SetActiveWindow
SetFocus
CloseClipboard
OpenClipboard
EmptyClipboard
PostMessageW
wsprintfW
SendMessageW
FindWindowW
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuW
GetMenuItemID
AppendMenuW
GetMenuStringW
GetMenuState
GetDesktopWindow
UnhookWindowsHookEx
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
IsWindowVisible
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
SetWindowsHookExW
SetCursor
ShowOwnedPopups
EnableWindow
IsWindowEnabled
GetLastActivePopup
UnregisterClassW
GetSysColorBrush
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableW
InsertMenuItemW
LoadImageW
ReuseDDElParam
UnpackDDElParam
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
MonitorFromPoint
UnionRect
EnableScrollBar
UpdateLayeredWindow
IsMenu
CreateMenu
PostThreadMessageW
WaitMessage
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
GetMenuDefaultItem
SetClipboardData
RegisterClipboardFormatW
CopyIcon
CharUpperBuffW
GetDoubleClickTime
GetIconInfo
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
SubtractRect
InvertRect
HideCaret
GetNextDlgGroupItem
MapDialogRect
DrawIcon
DestroyCursor
SetRect
SetCursorPos
BringWindowToTop
LockWindowUpdate
IntersectRect
GetSysColor
ReleaseDC
GetDC
LoadCursorW
GetWindowRgn
CharUpperW
GetWindowTextW
GetWindowTextLengthW
DeleteMenu
CopyRect
SetRectEmpty
GetMonitorInfoW
SystemParametersInfoW
EnumDisplayMonitors
CopyImage

gdi32

SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
SelectPalette
GetObjectType
CreateHatchBrush
GetTextExtentPoint32W
CreateDIBSection
CreatePolygonRgn
GetBkColor
GetTextColor
PatBlt
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetRectRgn
DPtoLP
OffsetRgn
GetRgnBox
SetDIBColorTable
RealizePalette
StretchBlt
SetPixel
RoundRect
Rectangle
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
EnumFontFamiliesExW
GetTextFaceW
SetPixelV
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetTextCharsetInfo
EnumFontFamiliesW
GetTextMetricsW
BitBlt
CreateCompatibleDC
CreateRectRgnIndirect
CreateCompatibleBitmap
GetObjectW
CreateFontIndirectW
CreatePatternBrush
CreateSolidBrush
CreatePen
GetStockObject
CreateDIBitmap
CreateRoundRectRgn
DeleteObject
CreateDCW
CreateBitmap
CreatePenIndirect
GetCharABCWidthsW
GetObjectA
GetDeviceCaps
DeleteDC
CopyMetaFileW
CombineRgn
SetViewportOrgEx

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW

shell32

SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHAppBarMessage
DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteW

comctl32

ImageList_GetIconSize
_TrackMouseEvent
ord17

shlwapi

PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW

ole32

CoInitializeEx
CoUninitialize
CoInitialize
CLSIDFromString
CoCreateInstance
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CLSIDFromProgID

oleaut32

SysAllocStringLen
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VarBstrFromDate
VariantInit
VariantChangeType
SysAllocString
SysFreeString
VariantClear

gdiplus

GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipCloneBrush
GdipGetFamily
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImage
GdipDrawString
GdipGraphicsClear
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateLineBrushI
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdipDrawImageI
GdipGetImageGraphicsContext

ws2_32

WSACleanup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
inet_ntoa
bind
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
gethostbyname
gethostname
getaddrinfo
sendto
recvfrom
WSAStartup
accept
ioctlsocket
listen
shutdown

netapi32

Netbios

hid

HidD_FlushQueue
HidD_FreePreparsedData
HidD_SetFeature
HidD_GetPreparsedData
HidP_GetCaps

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW

Exports

Exports

AsyncSend2Com
AsyncSend2Hid
CloseComm
GetAppRunCount
GetAppVersion
GetVersionBit
NationEcTrans
OpenSpecifiedCom
Send2com
Send2comAndRead
SetDragonflyCallback

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f055d6e6c1132c0df36969fcf56264d3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

ws2_32

netapi32

hid

version

wldap32

oleacc

imm32

winmm

setupapi

Exports

Exports

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 72KB - Virtual size: 131KB

Shared Size: 512B - Virtual size: 4B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 303KB - Virtual size: 302KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 72KB - Virtual size: 131KB

Shared
Size: 512B - Virtual size: 4B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 303KB - Virtual size: 302KB