1257b242fe1a74d5347aa913738685057ccc2df76aec72cb6729fca020f98b36

Sharing

Copy URL Twitter E-mail

General

Target

1257b242fe1a74d5347aa913738685057ccc2df76aec72cb6729fca020f98b36
Size

492KB
MD5

8e3142e3c2e8345b27533cca4ccca315
SHA1

1c05eb54ab93880cfcd7d733d2395034e5091844
SHA256

1257b242fe1a74d5347aa913738685057ccc2df76aec72cb6729fca020f98b36
SHA512

3649cb1eea9ea1cf7359a24bfb0a76e11c0f72bb833d818a478bbaf51b29cd08c77d66fa73bbea88f47c51e1a7cdccc84c49b64f28e9743de237a28e707a9eda
SSDEEP

12288:KwyVDckvQUcdTSLBCeTCUpd2bwWm06c7:KwyOkIUcooeTZKb76c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1257b242fe1a74d5347aa913738685057ccc2df76aec72cb6729fca020f98b36

Files

1257b242fe1a74d5347aa913738685057ccc2df76aec72cb6729fca020f98b36
.dll windows:4 windows x86 arch:x86

ac4042f9cc24f5527079988d84977aee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select
recv
send
ioctlsocket
connect
getsockopt
__WSAFDIsSet
shutdown
WSACleanup
getservbyport
gethostbyaddr
getservbyname
inet_addr
WSASetLastError
htonl
WSAStartup
gethostname
gethostbyname
inet_ntoa
socket
setsockopt
bind
closesocket
ntohs
WSAGetLastError
ntohl
htons

kernel32

CompareStringW
CompareStringA
CloseHandle
CreateFileA
GetLastError
ReadFile
WriteFile
SetFilePointer
OutputDebugStringA
GetModuleFileNameA
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetDiskFreeSpaceExA
Sleep
DeleteFileA
FindClose
FindFirstFileA
GetLocaleInfoW
SetEndOfFile
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetLocalTime
WaitForSingleObject
ReleaseSemaphore
GetCurrentProcess
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetStringTypeW
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
UnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
CreateDirectoryA
FindNextFileA
CreateSemaphoreA
GetFileInformationByHandle
GetFileType
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
VirtualFree
SetEnvironmentVariableA
GetTickCount
GetTimeZoneInformation
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
HeapSize
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
SetLastError
GetFileAttributesA
ExitThread
CreateThread
GetVersion
GetCommandLineA
HeapReAlloc
RtlUnwind
HeapAlloc
HeapFree
RaiseException
GetSystemTime
ExitProcess
TerminateProcess

advapi32

GetSecurityInfo

user32

InvalidateRect
GetClientRect
ShowWindow

Exports

Exports

NS_AudioPlayPasue
NS_AudioPlayResume
NS_BMPCapture
NS_ChangeRange
NS_CloseSound
NS_D3DCapture
NS_Decrypt
NS_Download
NS_EnableIVS
NS_Encrypt
NS_ExportDeviceConfig
NS_ExportDeviceLog
NS_ExportFile
NS_ExportReport
NS_FECRigisterDrawFun
NS_FEC_CapturePIC
NS_FEC_GetParam
NS_FEC_GetSpecialViewParam
NS_FEC_GetViewParam
NS_FEC_IsInFinshDraw
NS_FEC_PTZ2WindowEx
NS_FEC_Play
NS_FEC_Set3DModelParam
NS_FEC_SetCorrectEffect
NS_FEC_SetDisplayRegion
NS_FEC_SetDrawType
NS_FEC_SetFinshDraw
NS_FEC_SetViewParam
NS_FEC_TestScan
NS_FEC_UpDateParam
NS_Fast
NS_FiniLib
NS_FrameForward
NS_GetAudioPlayedTime
NS_GetAudioVolume
NS_GetDownLoadFiles
NS_GetDownloadStatus
NS_GetEngineSupport
NS_GetFormUploadErrorInfo
NS_GetHTTPErrorInfo
NS_GetIpcImportErrorInfo
NS_GetLastError
NS_GetNetworkInfo
NS_GetOSDTime
NS_GetPictureSize
NS_GetPlayedTime
NS_GetRecordFileSize
NS_GetScale
NS_GetSycVAStatus
NS_GetUploadErrorInfo
NS_GetVolume
NS_ImportDeviceConfig
NS_InitLib
NS_JPEGCapture
NS_OpenSound
NS_Pause
NS_Play
NS_Play_V20
NS_RefreshPlay
NS_RegAdditionFun
NS_RenderPrivateDataEx
NS_ResetPlayWnd
NS_Resume
NS_ReversePlay
NS_RigisterAudioDrawFun
NS_RigisterDrawFun
NS_SR_Rotate
NS_SendHttpSynRequest
NS_SetAudioPlayStatus
NS_SetAudioVolume
NS_SetDVRMessageCallBack
NS_SetDisplayBuf
NS_SetDisplayCallBack
NS_SetDisplayRegion
NS_SetFishMsgCallBack
NS_SetHttpRequestCallBack
NS_SetLocalAlarmPicLoacation
NS_SetMessageHandler
NS_SetOverlayPriInfoFlag
NS_SetPicInfoToPlayer
NS_SetPicOrRegionFillPara
NS_SetReconnectInfo
NS_SetSecretKey
NS_SetTrackDurationTime
NS_SetVoiceAdditionDataCallBack
NS_SetVoiceMsgCallBack
NS_SetVolume
NS_Slow
NS_StartAlarmChan
NS_StartAsynUpload
NS_StartAudioPlay
NS_StartAudioRecord
NS_StartDownload
NS_StartDownloadEx
NS_StartFishListener
NS_StartFormAsynUpload
NS_StartSave
NS_StartSycAudioPlay
NS_StartUpgrade
NS_StartVoiceTalk
NS_Stop
NS_StopAlarmChan
NS_StopAsynUpload
NS_StopAudioPlay
NS_StopAudioRecord
NS_StopDownload
NS_StopFishListener
NS_StopFormAsynUpload
NS_StopHttpRequest
NS_StopSave
NS_StopSycAudioPlay
NS_StopSycVAFiles
NS_StopUpgrade
NS_StopVoiceTalk
NS_SubmitHttpRequest
NS_SwitchFile
NS_SycVideoAndAudioFiles
NS_USB_GetDeviceSerial
NS_USB_LoginDefaultDevice
NS_USB_LogoutDevice
NS_UpgradeStatus
NS_Upload

Sections

.text
Size: 332KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac4042f9cc24f5527079988d84977aee

Headers

File Characteristics

Imports

ws2_32

kernel32

advapi32

user32

Exports

Exports

Sections

.text Size: 332KB - Virtual size: 330KB

.rdata Size: 52KB - Virtual size: 48KB

.data Size: 72KB - Virtual size: 1.4MB

.rsrc Size: 4KB - Virtual size: 784B

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 332KB - Virtual size: 330KB

.rdata
Size: 52KB - Virtual size: 48KB

.data
Size: 72KB - Virtual size: 1.4MB

.rsrc
Size: 4KB - Virtual size: 784B

.reloc
Size: 28KB - Virtual size: 27KB