��L�q��IK���'G���U��WI�A+���ț�cצA���_B7�}�Wx����FyX�Hp��<�#�� �.�X�ne̾�Z��f@�ǫ�GlJ��l�;��6���� �dJW;&O� g/0���I�G�1c����/�M�@� ���wH e;�X1�j�_EP�-"���g;���u]��7���I��rr<��-�lӡK/p��5�m��.@"_w����:H�r����;�� @9��I�Z��腓���u�Y�!�<d���ᓛ��67���� 6��_�>�H�p�u< ��W�=�uÌ]H�mGl��}�A5����� �âCͺ�����~:&u ��v�qY�O ������ >�*� ����p�:'Ӿ ���� i7 n0�4'H���?��Qœӈ�@Wl���Hsr������(�N�7�}�k� ܜ�g���/6s��Bޛ(��7w�0*�3�80 ��� �S, �fI�xK�c�@=�(ݮn����<A�YI��C )����>F��Y(qi�iF�*��*phSRׯ}��Gcveii : l�W}9�M�p��C?8��e��tj���q���ב�i(��� ���1�6y+�i�Ҭ Rg%>� i��plb�9=�m �Q�i{=�=h@z��ժ���������%���wz�rj?�1S�,M4�x�_G�eޜ%R��Xy����T +-�� �����R)�װ��͜ �t��*�������Jכz��Y�? �|f�f}���bxy9I�l�������P�Ӣa�w�0ž����xU����oC Hy9 m<�:Am� ��~�<��<+���2�d�����G��-Z������Q��&��?��2W�er��� ��UX%�,����X;*�?��q�X��^,�����2q^i��,O�ߕ�����v���"�U,(���U�ݕ�"P |��0���2 �o�'��?X��ش���/��TfG�����"C�����4;��;5��ڒ�uKY ����oDy_�^I��|ݷ��O�"�1�u%�./i q����Um���d8{��V��W�d<���.��ܚ/�Z���� SHٌB�Kޒ�Q�����ƀ���1�b�����/o$� �� r� ��l?�HXLa��^�]!l����Lt) 0� Dא�$��2<* q3La,��~���,�#j\�#��,2��B��ўG�����(����. �����+�T�;�xy��������r��EV�ޒ2A��w�Hd�D ���Ɠ7�o�$��H���(mO���B {�? ��!�x.*V�xν +��R�y�z�mD�q$�;.�6�[�^m@�a ����=G��,��ӕ�GI w�?1�>Z7��vH>5+ �a����J9�GHY���j��sg��&� ku3阐�^����i.�K�=LQV^y�����-��?��w�P��D�p ��F���r8�X�F�7�� �˓��V���,6���S>���Yb9 X�� �,B��N?��K�𫕏�a��R FE�j���l��1�C����g���-��� �k��(q'��� DE?��Phr����x���3y%��k����*oQđ�w��~s �Z���K4M�^b�!n��"���uDR9!�������v�1�q�й:�"�Q�h��Y�$�V�����5�I ���4Dx��"�P?0�� )׃�\�c��?> �D�H�8��6���L_CR������>��X�r�@'�M�&u���H�������ʼnR�a��"�/ev7�ϳg��^ 'y��+��_��.K;�լ#��]����P|�N��r*��o ��|s�k� �766�Wi�4�8w��s�V�K0z�w����5�gI9�Qߨ����x-Y�ا�8�����9✞�:V^���!�A��ә�A�jdg "K 7o�lC�I�z���ƭcء��݆���� S@�'7!�~� ]�5�y�fy ���t��%��(�4i ��o��l ]��u(6��ˀ����lQ��d �h@W��A[+����V0x�&N�c���>(��X���_g���嬳j ��-W�a��2�����]E��#+R��-��Q��5յ��R�#ҐJ�Wo6��ѪF5"�� j�\�qW4� ��r��̣<DqN�� b���҈��l5Z�g]ڭ���d�����I�J�I�����[/�ak}�u�\��`~�ґ'���|ӏ�����!��ˊ�/�*��� f���Tڞcc��|���!�ɦ�7c��R~�h��w ? �]��n9r{��px�ukRͣ�j蜇og�/��AQԳ0���{�;J���%� ��V)��r�1��g�ƾ�����uh�`6�mvĵE�ې�<i�� IB# @`f S��cК��,b � ��uT ����m�I�Ν��7YP� �X�� �FY�6u_�x�L/�لR�+�Z@��?�0� �Hp��/���fpX·�S�!~�F±C�M��!�������K�Id��ʪ%���>�&6�&�l��m0���u�:$ .ڶ�oH9��̝�HXX��s����`������/�lū����,�D������٦<�y��n-� ���@���X.&�l-N|�*� D����@D��zd ��p��e��)Ȗؤ�k{�ՔM���ٍ�?��P:��ot�[6�����j(��֒���C�4e���~qvq���W2B��C���5�j7��u}/y��-'�N����Î0�#��t=ݍ�;8�'��Ϥ%����09Tm R*}+� c1�$xx��Z9�b:�˳��r����������}c��n���� n�L:(�8J5��.����J�6��:�����@Ff������"&�t�>l�Bi؎�i: #�9&��Oy^�&[ �1��s� �Ō:��r3��أ@������z�6�i��$N���R�g��%�����N�>�x���jnv���X�u���1����Y��� �?��R }�c�V��i+��J���{�wD)ʂ�λ�؉=���{����v�A(-P� e/g� jh[��jq����O�k�ګ�7q-����fz$e�1�ը��y$V$L�T������-�,���(��qunj+ �k��{7��&���L��[�R���
General
-
Target
c6ddce7621da883b2829f04e76661a86c2dc2b7f486457c29c78aaadbda6f9d1
-
Size
19.9MB
-
MD5
e21c65b4dc8e9bd1d08db2c5cb8fd958
-
SHA1
d3e8bcf4c3827a1e65db76b2ebc96e57ae85adc4
-
SHA256
c6ddce7621da883b2829f04e76661a86c2dc2b7f486457c29c78aaadbda6f9d1
-
SHA512
43c230e49cbef28f9329ba5742f25d3984dcde0b48a1d968bc3612cc57d900840c9e490a0312fb6316f3aac1d55f2aec7111c17a94ae950d97907355d507614b
-
SSDEEP
393216:LPeTzrr7ujvDW6MwVN1wrRdjWT84eRdXy3bcsAJWqg0icY:yfrOjSBqbwrRyPAJWV0hY
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
-
One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
Files
-
c6ddce7621da883b2829f04e76661a86c2dc2b7f486457c29c78aaadbda6f9d1
-
Blackshades NET Setup Tutorial.pdf
-
http://www.no-ip.com/
-
https://www.no-ip.com/downloads.php
-
http://portforward.com/
-
http://www.apachefriends.org/download.php?xampplite-win32-1.7.3.exe
-
http://localhost/security/xamppsecurity.php
-
http://dev.mysql.com/downloads/connector/odbc/5.1.html
-
http://www.apachefriends.org/download.ph...-1.7.3.exe
-
http://yournick.no-ip.biz
-
-
Blackshades NET User Guide.pdf
-
http://gmail.com
-
http://fileave.com
-
-
Injector.exe
48ccd7fe571282759f5e5830f25912c8
Headers
Imports
Sections
-
Logs.txt
-
Read Me.txt
-
client.exe
723304d3c0707758bfdabcc8546fc72b
Headers
Imports
Exports
Sections
-
client.ini
-
data/CODEJO~1.oca
Headers
Sections
-
data/CODEJO~2.oca
Headers
Sections
-
data/CODEJO~3.oca
Headers
Sections
-
data/Codejock.Controls.Unicode.v12.0.2.ocx
56accb93af10812d19391799de9a7230
Code Sign
Headers
Imports
Exports
Sections
-
data/Codejock.SkinFramework.v12.0.2.ocx
b97546b32de3f20f9d20a53cbd559da6
Code Sign
Headers
Imports
Exports
Sections
-
data/IPList.dat
-
data/MSCOMCTL.OCX
b22bd7d6f2b83c193c4c7e9c0a2de8b2
Code Sign
Headers
Imports
Exports
Sections
-
data/MSCOMCTL.oca
Headers
Sections
-
data/MSDATGRD.OCX
876294974e137decb1d3a02e0db7e3b1
Code Sign
Headers
Imports
Exports
Sections
-
data/MSDATGRD.oca
Headers
Sections
-
data/MSINET.OCX
96286284ff8e040938ba779778d1542e
Code Sign
Headers
Imports
Exports
Sections
-
data/MSInet.oca
Headers
Sections
-
data/MSWINSCK.OCX
5270274b4ff20c6f050b9c66331e50cb
Code Sign
Headers
Imports
Exports
Sections
-
data/RICHTX32.OCX
aaca01ab2cd35af160b8025e9dcfad9f
Code Sign
Headers
Imports
Exports
Sections
-
data/RICHTX32.oca
Headers
Sections
-
data/Registrator.exe
7e753ff681654f6baf71d608521060db
Code Sign
Headers
Imports
Sections
-
data/icons/1.gif
-
data/icons/10.gif
-
data/icons/100.gif
-
data/icons/101.gif
-
data/icons/102.gif
-
data/icons/103.gif
-
data/icons/104.gif
-
data/icons/105.gif
-
data/icons/106.gif
-
data/icons/107.gif
-
data/icons/108.gif
-
data/icons/109.gif
-
data/icons/11.gif
-
data/icons/110.gif
-
data/icons/111.gif
-
data/icons/112.gif
-
data/icons/113.gif
-
data/icons/114.gif
-
data/icons/115.gif
-
data/icons/116.gif
-
data/icons/117.gif
-
data/icons/118.gif
-
data/icons/119.gif
-
data/icons/12.gif
-
data/icons/120.gif
-
data/icons/121.gif
-
data/icons/122.gif
-
data/icons/123.gif
-
data/icons/124.gif
-
data/icons/125.gif
-
data/icons/126.gif
-
data/icons/127.gif
-
data/icons/128.gif
-
data/icons/129.gif
-
data/icons/13.gif
-
data/icons/130.gif
-
data/icons/131.gif
-
data/icons/132.gif
-
data/icons/133.gif
-
data/icons/134.gif
-
data/icons/135.gif
-
data/icons/136.gif
-
data/icons/137.gif
-
data/icons/138.gif
-
data/icons/139.gif
-
data/icons/14.gif
-
data/icons/140.gif
-
data/icons/141.gif
-
data/icons/142.gif
-
data/icons/143.gif
-
data/icons/144.gif
-
data/icons/145.gif
-
data/icons/146.gif
-
data/icons/147.gif
-
data/icons/148.gif
-
data/icons/149.gif
-
data/icons/15.gif
-
data/icons/150.gif
-
data/icons/151.gif
-
data/icons/152.gif
-
data/icons/153.gif
-
data/icons/154.gif
-
data/icons/155.gif
-
data/icons/156.gif
-
data/icons/157.gif
-
data/icons/158.gif
-
data/icons/159.gif
-
data/icons/16.gif
-
data/icons/160.gif
-
data/icons/161.gif
-
data/icons/162.gif
-
data/icons/163.gif
-
data/icons/164.gif
-
data/icons/165.gif
-
data/icons/166.gif
-
data/icons/167.gif
-
data/icons/168.gif
-
data/icons/169.gif
-
data/icons/17.gif
-
data/icons/170.gif
-
data/icons/171.gif
-
data/icons/172.gif
-
data/icons/173.gif
-
data/icons/174.gif
-
data/icons/175.gif
-
data/icons/176.gif
-
data/icons/177.gif
-
data/icons/178.gif
-
data/icons/179.gif
-
data/icons/18.gif
-
data/icons/180.gif
-
data/icons/181.gif
-
data/icons/182.gif
-
data/icons/183.gif
-
data/icons/184.gif
-
data/icons/185.gif
-
data/icons/186.gif
-
data/icons/187.gif
-
data/icons/188.gif
-
data/icons/189.gif
-
data/icons/19.gif
-
data/icons/190.gif
-
data/icons/191.gif
-
data/icons/192.gif
-
data/icons/193.gif
-
data/icons/194.gif
-
data/icons/195.gif
-
data/icons/196.gif
-
data/icons/197.gif
-
data/icons/198.gif
-
data/icons/199.gif
-
data/icons/2.gif
-
data/icons/20.gif
-
data/icons/200.gif
-
data/icons/201.gif
-
data/icons/202.gif
-
data/icons/203.gif
-
data/icons/204.gif
-
data/icons/205.gif
-
data/icons/206.gif
-
data/icons/207.jpg
-
data/icons/208.gif
-
data/icons/209.gif
-
data/icons/21.gif
-
data/icons/210.gif
-
data/icons/211.gif
-
data/icons/212.gif
-
data/icons/213.gif
-
data/icons/214.gif
-
data/icons/215.gif
-
data/icons/216.gif
-
data/icons/217.gif
-
data/icons/218.gif
-
data/icons/219.gif
-
data/icons/22.gif
-
data/icons/220.gif
-
data/icons/221.gif
-
data/icons/222.gif
-
data/icons/223.gif
-
data/icons/224.gif
-
data/icons/225.gif
-
data/icons/226.gif
-
data/icons/227.gif
-
data/icons/228.gif
-
data/icons/229.gif
-
data/icons/23.gif
-
data/icons/230.gif
-
data/icons/231.gif
-
data/icons/232.gif
-
data/icons/233.gif
-
data/icons/234.gif
-
data/icons/235.gif
-
data/icons/236.gif
-
data/icons/237.gif
-
data/icons/238.gif
-
data/icons/239.gif
-
data/icons/24.gif
-
data/icons/240.gif
-
data/icons/241.gif
-
data/icons/25.gif
-
data/icons/26.gif
-
data/icons/27.gif
-
data/icons/28.gif
-
data/icons/29.gif
-
data/icons/3.gif
-
data/icons/30.gif
-
data/icons/31.gif
-
data/icons/32.gif
-
data/icons/33.gif
-
data/icons/34.gif
-
data/icons/35.gif
-
data/icons/36.gif
-
data/icons/37.gif
-
data/icons/38.gif
-
data/icons/39.gif
-
data/icons/4.gif
-
data/icons/40.gif
-
data/icons/41.gif
-
data/icons/42.gif
-
data/icons/43.gif
-
data/icons/44.gif
-
data/icons/45.gif
-
data/icons/46.gif
-
data/icons/47.gif
-
data/icons/48.gif
-
data/icons/49.gif
-
data/icons/5.gif
-
data/icons/50.gif
-
data/icons/51.gif
-
data/icons/52.gif
-
data/icons/53.gif
-
data/icons/54.gif
-
data/icons/55.gif
-
data/icons/56.gif
-
data/icons/57.gif
-
data/icons/58.gif
-
data/icons/59.gif
-
data/icons/6.gif
-
data/icons/60.gif
-
data/icons/61.gif
-
data/icons/62.gif
-
data/icons/63.gif
-
data/icons/64.gif
-
data/icons/65.gif
-
data/icons/66.gif
-
data/icons/67.gif
-
data/icons/68.gif
-
data/icons/69.gif
-
data/icons/7.gif
-
data/icons/70.gif
-
data/icons/71.gif
-
data/icons/72.gif
-
data/icons/73.gif
-
data/icons/74.gif
-
data/icons/75.gif
-
data/icons/76.gif
-
data/icons/77.gif
-
data/icons/78.gif
-
data/icons/79.gif
-
data/icons/8.gif
-
data/icons/80.gif
-
data/icons/81.gif
-
data/icons/82.gif
-
data/icons/83.gif
-
data/icons/84.gif
-
data/icons/85.gif
-
data/icons/86.gif
-
data/icons/87.gif
-
data/icons/88.gif
-
data/icons/89.gif
-
data/icons/9.gif
-
data/icons/90.gif
-
data/icons/91.gif
-
data/icons/92.gif
-
data/icons/93.gif
-
data/icons/94.gif
-
data/icons/95.gif
-
data/icons/96.gif
-
data/icons/97.gif
-
data/icons/98.gif
-
data/icons/99.gif
-
data/icons/basic.png
-
data/icons/connections.png
-
data/icons/group.png
-
data/icons/misc.png
-
data/icons/star.png
-
data/icons/user.png
-
data/icons/user_gray.png
-
data/mswinsck.oca
Headers
Sections
-
data/plugins/dos_sock.bss
-
data/plugins/nir_cmd.bss
-
data/plugins/pws_cdk.bss
-
data/plugins/pws_chro.bss
-
data/plugins/pws_ff.bss
-
data/plugins/pws_mail.bss
-
data/plugins/pws_mess.bss
-
data/skins/Luna Royale.msstyles
Headers
Sections
-
data/skins/Mint.msstyles
Headers
Sections
-
data/skins/Orion.msstyles
Headers
Sections
-
data/skins/areao4 (2).msstyles
Headers
Sections
-
data/skins/bss-black.skn
Headers
Sections
-
data/skins/bss-brown.skn
Headers
Sections
-
data/skins/bss-flashy-black.skn
Headers
Sections
-
data/skins/bss-grey.skn
Headers
Sections
-
data/skins/bss-light-gray.skn
Headers
Sections
-
data/skins/bss-lines.skn
Headers
Sections
-
data/skins/bss-mac-osx.skn
Headers
Sections
-
data/skins/bss-office2k7.skn
Code Sign
Headers
Sections
-
data/skins/bss-simple-black.skn
Headers
Sections
-
data/skins/bss-smooth.skn
Headers
Sections
-
data/skins/bss-xpryoal.skn
Code Sign
Headers
Sections
-
data/station.bin
17887a44650fddb784069b34a95f3f62
Headers
Imports
Sections
-
data/stub.bin
d7bb01f12bf05bc215cc79d5f95b57f8
Headers
Imports
Sections
-
data/upx.exe
Headers
Sections
-
data/web/countries.bss
-
data/web/ddos.bss
-
data/web/ddosfail.bss
-
data/web/ddosstats.bss
-
data/web/dload.bss
-
data/web/dloadfail.bss
-
data/web/full.bss
-
data/web/login.bss
-
data/web/loginfail.bss
-
data/web/main.bss
-
data/web/os.bss
-
data/web/pws.bss
-
data/web/settings.bss
-
data/web/unauth.bss
-
data/web/users.txt
-
remote database viewer/README.txt
-
remote database viewer/dbview/Connections/.DS_Store
-
remote database viewer/dbview/Connections/_notes/dwsync.xml
-
remote database viewer/dbview/Connections/bssnet.php
-
remote database viewer/dbview/SpryAssets/_notes/dwsync.xml
-
remote database viewer/dbview/SpryAssets/dataTables.scrollingPagination.js
-
remote database viewer/dbview/SpryAssets/editable_ajax.php
-
remote database viewer/dbview/SpryAssets/jquery.dataTables.js
-
remote database viewer/dbview/SpryAssets/jquery.jeditable.js
-
remote database viewer/dbview/SpryAssets/jquery.js
-
remote database viewer/dbview/SpryAssets/jquery.quicksearch.js
-
remote database viewer/dbview/SpryAssets/xpath.js
-
remote database viewer/dbview/cddel.php
-
remote database viewer/dbview/cdkey.php
-
remote database viewer/dbview/conn.php
-
remote database viewer/dbview/conndel.php
-
remote database viewer/dbview/css/_notes/dwsync.xml
-
remote database viewer/dbview/css/demo_page.css
-
remote database viewer/dbview/css/demo_table.css
-
remote database viewer/dbview/css/menu_style.css
-
remote database viewer/dbview/css/oneColLiqCtrHdr.css
-
remote database viewer/dbview/css/style.css
-
remote database viewer/dbview/images/_notes/dwsync.xml
-
remote database viewer/dbview/images/b-content3.jpg
-
remote database viewer/dbview/images/bottom3.jpg
-
remote database viewer/dbview/images/bottom_bar2.jpg
-
remote database viewer/dbview/images/button2.png
-
remote database viewer/dbview/images/button3.png
-
remote database viewer/dbview/images/content2.png
-
remote database viewer/dbview/images/copy document.psd
-
remote database viewer/dbview/images/copy.png
-
remote database viewer/dbview/images/copy_hover.png
-
remote database viewer/dbview/images/csv.png
-
remote database viewer/dbview/images/csv_hover.png
-
remote database viewer/dbview/images/current-bg.gif
-
remote database viewer/dbview/images/details_close.png
-
remote database viewer/dbview/images/details_open.png
-
remote database viewer/dbview/images/file_types.psd
-
remote database viewer/dbview/images/menu-bg.gif
-
remote database viewer/dbview/images/menu6.jpg
-
remote database viewer/dbview/images/print.png
-
remote database viewer/dbview/images/print_hover.png
-
remote database viewer/dbview/images/printer.psd
-
remote database viewer/dbview/images/top.png
-
remote database viewer/dbview/images/x.gif
-
remote database viewer/dbview/images/x.jpg
-
remote database viewer/dbview/images/xls.png
-
remote database viewer/dbview/images/xls_hover.png
-
remote database viewer/dbview/index.php
-
remote database viewer/dbview/keylog.php
-
remote database viewer/dbview/media/as3/ZeroClipboard.as
-
remote database viewer/dbview/media/as3/ZeroClipboardPdf.as
-
remote database viewer/dbview/media/as3/lib/AlivePDF.swc
-
remote database viewer/dbview/media/css/TableTools.css
-
remote database viewer/dbview/media/css/TableTools_JUI.css
-
remote database viewer/dbview/media/css/_notes/dwsync.xml
-
remote database viewer/dbview/media/images/_notes/dwsync.xml
-
remote database viewer/dbview/media/images/background.png
-
remote database viewer/dbview/media/images/collection.png
-
remote database viewer/dbview/media/images/collection_hover.png
-
remote database viewer/dbview/media/images/copy.png
-
remote database viewer/dbview/media/images/copy_hover.png
-
remote database viewer/dbview/media/images/csv.png
-
remote database viewer/dbview/media/images/csv_hover.png
-
remote database viewer/dbview/media/images/pdf.png
-
remote database viewer/dbview/media/images/pdf_hover.png
-
remote database viewer/dbview/media/images/print.png
-
remote database viewer/dbview/media/images/print_hover.png
-
remote database viewer/dbview/media/images/xls.png
-
remote database viewer/dbview/media/images/xls_hover.png
-
remote database viewer/dbview/media/js/TableTools.js
-
remote database viewer/dbview/media/js/TableTools.min.js
-
remote database viewer/dbview/media/js/TableTools.min.js.gz
-
remote database viewer/dbview/media/js/ZeroClipboard.js
-
remote database viewer/dbview/media/js/_notes/dwsync.xml
-
remote database viewer/dbview/media/swf/copy_cvs_xls.swf
-
remote database viewer/dbview/media/swf/copy_cvs_xls_pdf.swf
-
remote database viewer/dbview/pws.php
-
remote database viewer/dbview/pwsdel.php
-
remote database viewer/dbview/rev.php
-
remote database viewer/dbview/xml/_notes/dwsync.xml
-
remote database viewer/dbview/xml/_notes/spryconn.php.mno
-
remote database viewer/dbview/xml/_notes/sprykl.php.mno
-
remote database viewer/dbview/xml/_notes/sprypws.php.mno
-
remote database viewer/dbview/xml/server_cdk.php
-
remote database viewer/dbview/xml/server_conn.php
-
remote database viewer/dbview/xml/server_pws.php
-
remote database viewer/dbview/xml/server_pwsedit.php
-
sql/README.txt
-
sql/bssnet.sql