General

  • Target
    EportClientSetup_V1.6.57.exe
  • Size 33.4MB
  • Sample260710-pelansbs9k
  • SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Insecure Codesign Algorithm 55 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 5 IoCs

    Codesigned file was signed by an untrusted entity.

  • NSIS installer 6 IoCs

File Explorer

  • EportClientSetup_V1.6.57.exe
    .exe 33.4MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/KillProcDLL.dll
    .dll 4KB
  • $PLUGINSDIR/LangDLL.dll
    .dll 5KB
  • $PLUGINSDIR/MessageBox.dll
    .dll 6KB
  • $PLUGINSDIR/SimpleSC.dll
    .dll 49KB
  • $PLUGINSDIR/System.dll
    .dll 10KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-wizard.bmp
    100KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • AutoUpdate.xml
    8KB
  • C:/ProgramData/SW-client/img/Windows10or11/1.png
    .png 946KB
  • C:/ProgramData/SW-client/img/Windows10or11/2.png
    .png 208KB
  • C:/ProgramData/SW-client/img/Windows10or11/3.png
    .png 937KB
  • C:/ProgramData/SW-client/img/Windows10or11/4.png
    .png 1012KB
  • C:/ProgramData/SW-client/img/Windows10or11/5.png
    .png 53KB
  • C:/ProgramData/SW-client/img/Windows10or11/6.png
    .png 1.1MB
  • C:/ProgramData/SW-client/img/WindowsServer/1.png
    .png 225KB
  • C:/ProgramData/SW-client/img/WindowsServer/10.png
    .png 393KB
  • C:/ProgramData/SW-client/img/WindowsServer/11.png
    .png 876KB
  • C:/ProgramData/SW-client/img/WindowsServer/12.png
    .png 857KB
  • C:/ProgramData/SW-client/img/WindowsServer/13.png
    .png 326KB
  • C:/ProgramData/SW-client/img/WindowsServer/2.png
    .png 181KB
  • C:/ProgramData/SW-client/img/WindowsServer/3.png
    .png 471KB
  • C:/ProgramData/SW-client/img/WindowsServer/4.png
    .png 525KB
  • C:/ProgramData/SW-client/img/WindowsServer/5.png
    .png 334KB
  • C:/ProgramData/SW-client/img/WindowsServer/6.png
    .png 479KB
  • C:/ProgramData/SW-client/img/WindowsServer/7.png
    .png 204KB
  • C:/ProgramData/SW-client/img/WindowsServer/8.png
    .png 766KB
  • C:/ProgramData/SW-client/img/WindowsServer/9.png
    .png 818KB
  • C:/ProgramData/SW-client/win10or11.html
    .html 5KB
  • C:/ProgramData/SW-client/winserver.html
    .html 7KB
  • CPUCard_Client.dll
    .dll 137KB
  • CertUpdateApi.dll
    .dll 1.1MB
  • Check903Reader.dll
    .dll 235KB
  • CnEport.Plugin.TXRN.Config.xml
    809B
  • CnEport.Pub.AutoUpdate.Updater.exe
    .exe 518KB
  • CnEport.Pub.AutoUpdate.Updater.exe.config
    1018B
  • CnEport.Pub.Config.dll
    .dll 18KB
  • CnEport.Pub.FullUpdate.exe
    .exe 270KB
  • CnEport.Pub.WebSocket.ActiveX.dll
    .dll 62KB
  • CnEport.Pub.WebSocketServer.exe
    .exe 562KB
  • CnEport.Pub.WebSocketServer.exe.config
    .xml 444B
  • CnEport.Pub.WinService.exe
    .exe 42KB
  • Ep11ReaderConfig.xml
    .xml 602B
  • EpKeyThirdHD.dll
    .dll 704KB
  • EpKeyThirdTDR.dll
    .dll 843KB
  • EpKeyThirdWDC.dll
    .dll 1.0MB
  • EpKeyThirdWQ.dll
    .dll 165KB
  • EpUserParam.ini
    1KB
  • EportGBDevConfig.xml
    .xml 858B
  • EportSMWConfig.xml
    .xml 1KB
  • HandlerSetting.xml
    4KB
  • OpsP11.dll
    .dll 1.6MB
  • OpsSd.dll
    .dll 306KB
  • OpsSkf.dll
    .dll 1003KB
  • SPSecureAPI.dll
    .dll 1.1MB
  • SetAccessControl.exe
    .exe 50KB
  • SimpleICAPI.dll
    .dll 89KB
  • USBCrw.dll
    .dll 65KB
  • UniSkf.dll
    .dll 898KB
  • UserCpuCardApi.dll
    .dll 1.2MB
  • cert/DigiCert-G4-RSA4096-SHA384-CA1.cer
    2KB
  • cert/GlobalSignRSAOVSSLCA2018.cer
    1KB
  • cert/casign.cer
    1KB
  • cert/server1s.cer
    1KB
  • conf/BaseConfig.xml
    .xml 4KB
  • conf/Infos.xml
    353B
  • conf/USBDeviceConfig.xml
    1KB
  • conf/WinService.xml
    1KB
  • decodecert.dll
    .dll 109KB
  • drives/DPInst32.exe
    .exe 510KB
  • drives/DPinst64.exe
    .exe 663KB
  • drives/HDZB_USBKEY_2G_CEP_DevServer.exe
    .exe 169KB
  • drives/HGBOT.exe
    .exe 100KB
  • drives/HGBOT_x64.exe
    .exe 119KB
  • drives/WDDriverR.exe
    .exe 1.1MB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/nsProcessW.dll
    .dll 4KB
  • $SYSDIR/WatchDataV5HaiGuan/Watchdata CSP v5.1 HaiGuan/TokenMgr.dll
    .dll 154KB
  • $SYSDIR/WatchDataV5HaiGuan/Watchdata CSP v5.1 HaiGuan/WDAlgLib.dll
    .dll 730KB
  • $SYSDIR/WatchDataV5HaiGuan/Watchdata CSP v5.1 HaiGuan/ccid_driver/registCCID.exe
    .exe 57KB
  • $SYSDIR/WatchDataV5HaiGuan/Watchdata CSP v5.1 HaiGuan/ccid_driver/usbccid.cat
    7KB
  • $SYSDIR/WatchDataV5HaiGuan/Watchdata CSP v5.1 HaiGuan/ccid_driver/usbccid.inf
    1KB
  • $SYSDIR/WatchDataV5HaiGuan/Watchdata CSP v5.1 HaiGuan/ccid_driver/usbccid.sys
    .sys 28KB
  • drives/ePass3003_SimpChinese_gfa.exe
    .exe 1.2MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/messagebox.dll
    .dll 6KB
  • $PLUGINSDIR/modern-header.bmp
    9KB
  • $PLUGINSDIR/modern-wizard.bmp
    51KB
  • $SYSDIR/GFACSP11.dll
    .dll 1.5MB
  • $SYSDIR/GFACSP11.sig
    256B
  • $SYSDIR/GFACSP11_s.dll
    .dll 47KB
  • $SYSDIR/GFACSP11_s.sig
    136B
  • $SYSDIR/MSVCP60.DLL
    .dll 404KB
  • $TEMP/RegHidDevice.dll
    .dll 113KB
  • GFACSP11_s.reg
    625B
  • GFA_Mgr_3003.exe
    .exe 390KB
  • GFA_certd3003.exe
    .exe 126KB
  • UnloadModule.exe
    .exe 40KB
  • ePass3003_cn.ini
    760B
  • ePass3003_en.ini
    720B
  • lang/escertd_GFA_1033.lng
    2KB
  • lang/escertd_GFA_2052.lng
    1KB
  • lang/escsp_GFA_1033.lng
    1KB
  • lang/escsp_GFA_2052.lng
    1KB
  • lang/esmgr_GFA_1033.lng
    13KB
  • lang/esmgr_GFA_2052.lng
    13KB
  • drives/usbccid.cat
    7KB
  • drives/usbccid.inf
    1KB
  • drives/usbccid.sys
    .sys 28KB
  • epEportBasicApp.dll
    .dll 262KB
  • epRaP11.dll
    .dll 1.6MB
  • epRaSkf.dll
    .dll 1003KB
  • eport.cer
    2KB
  • eport.pfx
    4KB
  • eptskf.dll
    .dll 1.1MB
  • eraEportBasicApp.dll
    .dll 418KB
  • eraEportBasicAppCU.dll
    .dll 418KB
  • ie_cert.ico
    283KB
  • img/Windows10or11/1.png
    .png 946KB
  • img/Windows10or11/2.png
    .png 208KB
  • img/Windows10or11/3.png
    .png 937KB
  • img/Windows10or11/4.png
    .png 1012KB
  • img/Windows10or11/5.png
    .png 53KB
  • img/Windows10or11/6.png
    .png 1.1MB
  • img/WindowsServer/1.png
    .png 225KB
  • img/WindowsServer/10.png
    .png 393KB
  • img/WindowsServer/11.png
    .png 876KB
  • img/WindowsServer/12.png
    .png 857KB
  • img/WindowsServer/13.png
    .png 326KB
  • img/WindowsServer/2.png
    .png 181KB
  • img/WindowsServer/3.png
    .png 471KB
  • img/WindowsServer/4.png
    .png 525KB
  • img/WindowsServer/5.png
    .png 334KB
  • img/WindowsServer/6.png
    .png 479KB
  • img/WindowsServer/7.png
    .png 204KB
  • img/WindowsServer/8.png
    .png 766KB
  • img/WindowsServer/9.png
    .png 818KB
  • install.ico
    85KB
  • libs/CnEport.Plugin.Cus.Old.Security.dll
    .dll 446KB
  • libs/CnEport.Plugin.Cus.PdfScan.dll
    .dll 26KB
  • libs/CnEport.Plugin.Cus.PdfSign.dll
    .dll 74KB
  • libs/CnEport.Plugin.Cus.Pdfes.dll
    .dll 25KB
  • libs/CnEport.Plugin.Cus.Security.dll
    .dll 98KB
  • libs/CnEport.Plugin.FileUpload.dll
    .dll 298KB
  • libs/CnEport.Plugin.JSCA.Security.dll
    .dll 34KB
  • libs/CnEport.Plugin.MOFCOM.Security.dll
    .dll 46KB
  • libs/CnEport.Plugin.Pub.Base.dll
    .dll 78KB
  • libs/CnEport.Plugin.RA.Security.dll
    .dll 57KB
  • libs/CnEport.Plugin.TXRN.Security.dll
    .dll 54KB
  • libs/CnEport.Pub.AutoUpdate.Core.dll
    .dll 17KB
  • libs/CnEport.Pub.AutoUpdate.Core.dll.config
    .xml 225B
  • libs/CnEport.Pub.Utils.dll
    .dll 390KB
  • libs/CnEport.Pub.WebSocketLib.dll
    .dll 102KB
  • libs/MOFCOM/Ds20Sign.dll
    .dll 903KB
  • libs/MOFCOM/GFACertEnroll.dll
    .dll 239KB
  • libs/MOFCOM/Interop.DS20SignLib.dll
    .dll 39KB
  • libs/MOFCOM/Interop.GFACertEnrollLib.dll
    .dll 13KB
  • libs/others/BouncyCastle.Crypto.dll
    .dll 2.5MB
  • libs/others/ESBasic.dll
    .dll 395KB
  • libs/others/Newtonsoft.Json.dll
    .dll 551KB
  • libs/others/System.ServiceProcess.dll
    .dll 119KB
  • libs/pdf/PdfUtilCom.dll
    .dll 23KB
  • libs/pdf/Spire.License.dll
    .dll 50KB
  • libs/pdf/Spire.License.xml
    .xml 4KB
  • libs/pdf/Spire.Pdf.dll
    .dll 11.6MB
  • libs/pdf/Spire.Pdf.xml
    .xml 1.0MB
  • libs/pdf/iDocScanInterface.dll
    .dll 1.1MB
  • libs/pdf/iDocService.dll
    .dll 4.3MB
  • out.upx
    .dll 7.9MB
  • libs/pdf/itextsharp.dll
    .dll 3.6MB
  • libs/pdf/itextsharp5513.dll
    .dll 3.9MB
  • libs/pdfes/ExtractSealAPI.dll
    .dll 78KB
  • libs/pdfes/PdfUtil.dll
    .dll 47KB
  • libs/pdfes/opencv_core2413.dll
    .dll 2.0MB
  • libs/pdfes/opencv_highgui2413.dll
    .dll 2.0MB
  • libs/pdfes/opencv_imgproc2413.dll
    .dll 1.8MB
  • libs/txrn/AxCryp_Ctl.dll
    .dll 18KB
  • libs/txrn/Cryp_Ctl.dll
    .dll 20KB
  • libs/txrn/dyck.dll
    .dll 1.5MB
  • msvcp100.dll
    .dll 415KB
  • msvcr100.dll
    .dll 759KB
  • restart.ico
    100KB
  • stop.ico
    264KB
  • tools/CertMgr.Exe
    .exe 66KB
  • tools/InstallUtil.exe
    .exe 36KB
  • tools/RegAsm.exe
    .exe 60KB
  • tools/fr.exe
    .exe 7.2MB
  • uninst.exe
    .exe 156KB
  • $PLUGINSDIR/KillProcDLL.dll
    .dll 4KB
  • $PLUGINSDIR/LangDLL.dll
    .dll 5KB
  • $PLUGINSDIR/System.dll
    .dll 10KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • win10or11.html
    .html 5KB
  • winserver.html
    .html 7KB

EportClientSetup_V1.6.57.exe

  • IMPHASH 16cdca0a54bf8076dc7e57fab55dbc5b
  • SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fc:b8:2a:fe:cb:73:09:47:51:f3:c2:4c:05:a3:b4:6a:32:b3:a8:e7:13:7e:dd:a3:61:76:44:d1:86:0d:b0:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=中国电子口岸数据中心,O=中国电子口岸数据中心,ST=Beijing,C=CN
Minor OS version
0
Major OS version
4
Entry point
14055
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths