Errors

Reason
scan timeout

General

  • Target

    Setup.zip

  • Size

    15.9MB

  • MD5

    10139400b7ce0e0c45036663aef3fa82

  • SHA1

    5acd25ca75a013c3f2a80d99d4acc37a31915ac8

  • SHA256

    6a796d57263229de4d857c5c119656b158f9e788aa971a2a209aa22a8079a239

  • SHA512

    c15ae010f082f75c74ce4673ea689911c3f86f051d15eb1180d74428d95f51ad6ef6ccb1e5915ae202c5548565013642698e6d8c2b163a61473116af098914c9

  • SSDEEP

    393216:EVvD7PnMNzBqDCjppLM2ZK/QM4vHDDXIR1GnAmMry:aMRBoiKzweWYu

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/rcmaehl/MSEdgeRedirect/releases/download/0.6.1.0/MSEdgeRedirect.exe

Signatures

Files

  • Setup.zip
    .zip
  • Setup.exe
    .exe windows x86

    c1cc4e11cf032e0c26dcda8c169b90e8


    Headers

    Imports

    Sections

  • data/apps11.txt
  • data/opentweaks_gamingProfile.tiw1
  • data/opentweaks_oobeProfile.tiw1
  • data/packages11.xml
  • data/plugins/Albacore.ViVe.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • data/plugins/Disable TPM 2.0 Check.ini
  • data/plugins/Enable AutoAdminLogon.ini
  • data/plugins/Enable Classic Context menus.ini
  • data/plugins/Join Domain.ini
  • data/plugins/Win10X Boot Animation.ini
  • data/plugins/aal_off.bat
  • data/plugins/aal_on.bat
  • data/plugins/tpm_off.bat
  • data/plugins/tpm_on.bat
  • data/scripts/Apps/Enable apps dark mode.ps1
  • data/scripts/Apps/Install apps.ps1
  • data/scripts/Apps/Reinstall all built-in apps.ps1
  • data/scripts/Apps/Remove OneDrive.ps1
    .ps1
  • data/scripts/Apps/Remove default apps (Provisioned).ps1
  • data/scripts/Apps/Remove default apps (Recommended).ps1
  • data/scripts/Apps/Update Store apps.ps1
    .ps1
  • data/scripts/Edge/Bypass Edge as default handler for web searches.ps1
    .ps1
  • data/scripts/Edge/Run MSEdgeRedirect.ps1
    .ps1
  • data/scripts/Energy/Ultimate Performance mode.ps1
  • data/scripts/Privacy/Disable Services.ps1
    .ps1
  • data/scripts/Privacy/Remove telemetry of third-party apps.ps1
    .ps1
  • data/scripts/Storage/Clean up Windows.ps1
    .ps1
  • platforms/qwindows.dll
    .dll windows x64

    033d09d773d3e334541b49e065bca8a2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources.pak
  • resources/app.asar
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-1.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-10.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-10_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-10_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-1_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-1_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-2.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-2_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-2_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-3.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-3_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-3_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-4.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-4_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-4_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-5.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-5_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-5_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-6.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-6_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-6_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-7.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-7_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-7_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-8.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-8_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-8_white.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-9.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-9_black.ico
  • resources/app.asar.unpacked/build/assets/images/menubar icons/win32/lock-9_white.ico
  • resources/relays.json
  • resources/talpid_openvpn_plugin.dll
    .dll windows x64

    c5236841ee8eecb9a2f11975c9a23816


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/windns.dll
    .dll windows x64

    9b617ea0db0b41a6cab86a4fd62d15b2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/winfw.dll
    .dll windows x64

    b3c179a81944b80f8ae07c1a1c70198a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/winnet.dll
    .dll windows x64

    651a29b435f81b0e8ad2eacb78d8bf1c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/wintun.dll
    .dll windows x64

    fb80e633863ed8c533980106499de45f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcomp140.dll
    .dll windows x64

    b0dceb96b51d2648c4e665c9ec09b163


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140.dll
    .dll windows x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections