Overview
overview
3Static
static
1Ionic.Zlib.dll
windows7-x64
1Ionic.Zlib.dll
windows10-2004-x64
1IronRuby.L...ml.dll
windows7-x64
1IronRuby.L...ml.dll
windows10-2004-x64
1IronRuby.L...es.dll
windows7-x64
1IronRuby.L...es.dll
windows10-2004-x64
1IronRuby.dll
windows7-x64
1IronRuby.dll
windows10-2004-x64
1MBControls.dll
windows7-x64
1MBControls.dll
windows10-2004-x64
1Microsoft.Dynamic.dll
windows7-x64
1Microsoft.Dynamic.dll
windows10-2004-x64
1Microsoft....ta.dll
windows7-x64
1Microsoft....ta.dll
windows10-2004-x64
1Microsoft....ng.dll
windows7-x64
1Microsoft....ng.dll
windows10-2004-x64
PBSEditor.exe
windows7-x64
1PBSEditor.exe
windows10-2004-x64
3PBSEditor.exe.xml
windows7-x64
1PBSEditor.exe.xml
windows10-2004-x64
1PBSEditor.pdb
windows7-x64
3PBSEditor.pdb
windows10-2004-x64
3RPG_XP.dll
windows7-x64
1RPG_XP.dll
windows10-2004-x64
1ReleaseNote.txt
windows7-x64
1ReleaseNote.txt
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Ionic.Zlib.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Ionic.Zlib.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
IronRuby.Libraries.Yaml.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
IronRuby.Libraries.Yaml.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
IronRuby.Libraries.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
IronRuby.Libraries.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
IronRuby.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
IronRuby.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
MBControls.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
MBControls.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Microsoft.Dynamic.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Microsoft.Dynamic.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
Microsoft.Scripting.Metadata.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Microsoft.Scripting.Metadata.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Microsoft.Scripting.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Microsoft.Scripting.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
PBSEditor.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
PBSEditor.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
PBSEditor.exe.xml
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
PBSEditor.exe.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
PBSEditor.pdb
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
PBSEditor.pdb
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
RPG_XP.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
RPG_XP.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
ReleaseNote.txt
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
ReleaseNote.txt
Resource
win10v2004-20220901-en
General
-
Target
PBSEditor2.0_Beta1.8.zip
-
Size
2.2MB
-
MD5
bb86ca9912aa9d6846f71f0b36656c8d
-
SHA1
9748a08640b8fa768d03870f2f500dea69ab0ece
-
SHA256
bfbe8e024f27557f7c2e65e8edbe71345f3e7ff64fd332f85c07eef2f0655ed1
-
SHA512
058a290315cb43e53932f0e9391cab4c59decd4d7601cfea2633b03c2e1b32039de2d4faf5e5ffe5dbe056e4b0026468fd0b6023c8a7b2e9cd300fb7f603bd5c
-
SSDEEP
49152:OSDWXHLqM7hLuap1pOVwHz7HfQptXWn7anFfIpvQNxhqG81V2OmitcaxjiO9hN:rcHLz7F70Viz7H4po7anM4pqG8SOmfaX
Malware Config
Signatures
Files
-
PBSEditor2.0_Beta1.8.zip.zip
-
Ionic.Zlib.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
IronRuby.Libraries.Yaml.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
IronRuby.Libraries.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 758KB - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
IronRuby.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 931KB - Virtual size: 930KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
MBControls.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorDllMain
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Dynamic.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 1006KB - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Scripting.Metadata.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Scripting.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
PBSEditor.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
PBSEditor.exe.config.xml
-
PBSEditor.pdb
-
PBSEditor_Creditos.txt
-
RPG_XP.dll.dll .ps1 windows x86
-
ReleaseNote.txt