0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85

Sharing

Copy URL Twitter E-mail

General

Target
0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85
Size 275KB
Sample260916-xpnsjsch26
SHA256 0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85
MD5 42227b236bcd657b27929939af79f0b6
SHA1 ee48b1f47551736a9c81b8e313931904433033bd
SHA512 bea64d3d4cd62990233be23570be9a34e2c4c79132a578b46d1992efc453d0b813965378e17daea376abf104df3b56a854f6c59e3e795a1a2f39c2a6c023d7e0
SSDEEP 6144:4wu1P9ymUXzPv11JqDPbBWesYVoMfI1Op6lBuxzsK:4wu1P9P27JqDjBW5Yx3
TLSH
T19F54D54AB7258D62D922D4BEC1879F8ADB7338415B10CBCB03258B5E5E3B3E1B934365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85

File Explorer

0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85

.dll 275KB

0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85

IMPHASH e04519e0aadd146021723c4c94c9c228
SHA256 0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85
MD5 42227b236bcd657b27929939af79f0b6
SHA1 ee48b1f47551736a9c81b8e313931904433033bd
SHA512 bea64d3d4cd62990233be23570be9a34e2c4c79132a578b46d1992efc453d0b813965378e17daea376abf104df3b56a854f6c59e3e795a1a2f39c2a6c023d7e0
SSDEEP 6144:4wu1P9ymUXzPv11JqDPbBWesYVoMfI1Op6lBuxzsK:4wu1P9P27JqDjBW5Yx3
TLSH
T19F54D54AB7258D62D922D4BEC1879F8ADB7338415B10CBCB03258B5E5E3B3E1B934365
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ed:cf:d1:e9:5c:7a:2c:21:4c:b6:b4:db:5f:6c:47:74:99:d3:fb:eb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bank Taiwan Securities Co.\,Ltd,O=Bank Taiwan Securities Co.\,Ltd,L=Taipei,ST=Taiwan,C=TW

Chains

May 20, 2013

CN=Bank Taiwan Securities Co.\,Ltd,O=Bank Taiwan Securities Co.\,Ltd,L=Taipei,ST=Taiwan,C=TW

Minor OS version

Major OS version

Entry point

168496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

crypt32

CryptSignAndEncodeCertificate CryptExportPublicKeyInfo CertSetCertificateContextProperty CryptMsgClose CryptMsgOpenToDecode CertOpenStore PFXImportCertStore PFXVerifyPassword PFXIsPFXBlob CertDuplicateCertificateContext CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CertEnumCertificatesInStore CertDeleteCertificateFromStore PFXExportCertStore CertAddCertificateContextToStore CryptMsgGetParam CryptMsgUpdate CryptMsgOpenToEncode CertGetCertificateChain CryptEncodeObject CertFreeCertificateContext CertGetIntendedKeyUsage CertCreateCertificateContext CertNameToStrA CertGetNameStringA CertCloseStore CertGetCertificateContextProperty CertOpenSystemStoreA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

iphlpapi

GetAdaptersInfo

shlwapi

PathFileExistsA

mfc80

ord300 ord306 ord3126 ord3094 ord393 ord2936 ord795 ord921 ord925 ord734 ord541 ord1508 ord6165 ord305 ord2969 ord1107 ord1458 ord6336 ord641 ord5131 ord392 ord4036 ord4148 ord2301 ord2485 ord1248 ord1505 ord310 ord5606 ord5572 ord2159 ord1501 ord757 ord797 ord4124 ord1100 ord922 ord3799 ord2192 ord3800 ord2691 ord583 ord3233 ord4527 ord3027 ord2896 ord5242 ord1618 ord1679 ord1680 ord1991 ord5217 ord1380 ord5009 ord3383 ord793 ord3840 ord6327 ord1541 ord2200 ord2206 ord2439 ord2421 ord2419 ord2437 ord2449 ord2426 ord2442 ord2447 ord2430 ord2432 ord2434 ord2428 ord2444 ord2424 ord949 ord945 ord947 ord943 ord938 ord5275 ord5277 ord6004 ord1619 ord4323 ord4763 ord3441 ord5256 ord4226 ord6323 ord5115 ord1935 ord5194 ord4285 ord1421 ord3984 ord1642 ord1645 ord5959 ord3090 ord632 ord617 ord362 ord3220 ord4303 ord5245 ord1420 ord5956 ord3089 ord1570 ord316 ord1695 ord2048 ord4932 ord4776 ord4253 ord5224 ord1821 ord6112 ord4621 ord3679 ord3268 ord2994 ord4279 ord2120 ord3917 ord3202 ord4273 ord1564 ord2114 ord598 ord670 ord5910 ord5917 ord5759 ord3972 ord568 ord6049 ord5757 ord6050 ord5758 ord6227 ord6221 ord5534 ord4147 ord796 ord589 ord774 ord265 ord1944 ord2276 ord1064 ord3868 ord769 ord4077 ord4053 ord6326 ord3839 ord6324 ord4367 ord2091 ord2046 ord5626 ord3844 ord1025 ord5144 ord6266 ord5424 ord3870 ord1947 ord2965 ord5266 ord5268 ord3986 ord4609 ord5272 ord5255 ord5609 ord2571 ord2765 ord2869 ord4348 ord2748 ord2872 ord2574 ord2680 ord2567 ord3756 ord3757 ord3747 ord2678 ord3987 ord4522 ord4302 ord3371 ord577 ord3721 ord1202 ord266 ord320 ord890 ord6373 ord1204 ord1208 ord776 ord1052 ord1108 ord321 ord777 ord1224 ord1226 ord1114 ord379 ord592 ord1227 ord1194 ord1192 ord1218 ord1136 ord6325 ord1694 ord1184

msvcr80

__crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __CppXcptFilter _amsg_exit _encoded_null _initterm_e _initterm _malloc_crt _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock ?terminate@@YAXXZ strtok strstr sprintf memmove _write _open _filelength _read _close free __CxxFrameHandler3 memcmp _mbsnbcpy_s malloc memcpy_s wcslen strcat isalpha isdigit memcpy strlen _recalloc _purecall _resetstkoflw __C_specific_handler memset strcat_s wcsncpy_s strcpy_s __clean_type_info_names_internal

kernel32

lstrcmpiA lstrlenA GetModuleFileNameA DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WideCharToMultiByte MultiByteToWideChar IsDBCSLeadByte FileTimeToSystemTime FileTimeToLocalFileTime GetTickCount CompareFileTime Sleep LocalAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary SizeofResource LoadResource FindResourceA LoadLibraryExA GetModuleHandleA GetFileAttributesA CreateDirectoryA SystemTimeToFileTime GetSystemTime GetWindowsDirectoryA GetEnvironmentVariableA GetVersionExA LocalFree FormatMessageA GetSystemInfo GetACP GetLocaleInfoA GetThreadLocale GetLastError GetTempPathA

user32

SendMessageA EnableWindow SetWindowPos CharNextA wsprintfA GetSystemMetrics CharUpperBuffA UnregisterClassA

advapi32

CryptAcquireContextA CryptGenKey CryptDestroyKey CryptReleaseContext CryptEnumProvidersA RegCreateKeyA RegQueryValueExA CryptCreateHash CryptSetHashParam CryptSignHashA CryptGetUserKey CryptExportKey RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA CryptGetProvParam

shell32

SHGetMalloc SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHCreateDirectoryExA

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance StringFromGUID2 CoTaskMemAlloc

oleaut32

SysStringByteLen SysAllocStringByteLen LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysStringLen SysAllocString SysAllocStringLen SysFreeString

DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer Java_com_BOT_BTSecATL_AcceptPKCS7 Java_com_BOT_BTSecATL_ChangePfxPasswd Java_com_BOT_BTSecATL_CopyLocalFile Java_com_BOT_BTSecATL_CreatePKCS10 Java_com_BOT_BTSecATL_EnumProviders Java_com_BOT_BTSecATL_ExportMobileFromIE Java_com_BOT_BTSecATL_ExportMobileFromPfx Java_com_BOT_BTSecATL_ExportPfx Java_com_BOT_BTSecATL_GetCapiErrorCode Java_com_BOT_BTSecATL_GetCapiErrorMsg Java_com_BOT_BTSecATL_GetCertFinger Java_com_BOT_BTSecATL_GetCertIssuer Java_com_BOT_BTSecATL_GetCertNotAfter Java_com_BOT_BTSecATL_GetCertNotBefore Java_com_BOT_BTSecATL_GetCertSerial Java_com_BOT_BTSecATL_GetCertSubject Java_com_BOT_BTSecATL_GetCertSubjectCN Java_com_BOT_BTSecATL_GetDefaultCertPath Java_com_BOT_BTSecATL_GetErrorCode Java_com_BOT_BTSecATL_GetErrorMsg Java_com_BOT_BTSecATL_GetExportedPfxFileName Java_com_BOT_BTSecATL_GetExportedPfxFilePath Java_com_BOT_BTSecATL_GetMacAddress Java_com_BOT_BTSecATL_GetRegisterPfxFileName Java_com_BOT_BTSecATL_GetRegisterPfxFilePath Java_com_BOT_BTSecATL_GetRegisterUserMode Java_com_BOT_BTSecATL_GetRtnCert Java_com_BOT_BTSecATL_GetVersion Java_com_BOT_BTSecATL_GetWindowsSystemName Java_com_BOT_BTSecATL_Hash Java_com_BOT_BTSecATL_HashFile Java_com_BOT_BTSecATL_ImportPfxToIE Java_com_BOT_BTSecATL_PresetPasswdLengthRange Java_com_BOT_BTSecATL_QueryUserInfo Java_com_BOT_BTSecATL_RegReadHKCU Java_com_BOT_BTSecATL_RegWriteHKCUInt Java_com_BOT_BTSecATL_RegWriteHKCUStr Java_com_BOT_BTSecATL_RegisterPfx Java_com_BOT_BTSecATL_SelectCertFromIE Java_com_BOT_BTSecATL_SelectLocalFolder Java_com_BOT_BTSecATL_SetGenKeyFlags Java_com_BOT_BTSecATL_SetKeyBits Java_com_BOT_BTSecATL_SetKeySpec Java_com_BOT_BTSecATL_SetProviderName Java_com_BOT_BTSecATL_SetProviderType Java_com_BOT_BTSecATL_SignPkcs1 Java_com_BOT_BTSecATL_SignPkcs7 Java_com_BOT_BTSecATL_UpdateRegisterMode

Sharing

General

Malware Config

Signatures

File Explorer

0ca702f19300e74c869b11dd42ea1823af12f3902a2bd2dc7b073d440f0efc85

PE Signature issue

version

crypt32

rpcrt4

iphlpapi

shlwapi

mfc80

msvcr80

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic