General

  • Target

    1.7z

  • Size

    76.1MB

  • MD5

    8515426fda80e8e9033163854eaba17c

  • SHA1

    7f2ed4b40448f2e9d9cbfd35a5b6cc1f3121a93c

  • SHA256

    bb8b878a8fc6838c3396d1e344bdbefb8234d9330ae6cd603b3e244e8c94a988

  • SHA512

    eedc410c74871b1b49784823d8c139a31e69d9a86c5aa28703ea673c161cc1377311dc2300d31ea86acd6aef6e412fa3dcc9df3efcca45a1a2f84c489ca27056

  • SSDEEP

    1572864:/ZLX3s0nvLhicu1aq2qQQdGrcIqrWjv5ziG7XXk9/8SHF3T5:Fc0nv4X2hj4IqCwG7HU/8Sl1

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1.7z
    .7z

    Password: infected

  • application.7z
    .7z

    Password: infected

  • nvdia.display.exe
    .exe windows x64

    Password: infected

    c8b78ec2a5027b092e12b201c75984ed


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/app.asar
  • resources/elevate.exe
    .exe windows x86

    Password: infected

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Code Sign

    Headers

    Imports

    Sections

  • resources/native/BGXNative.node
    .dll windows x64

    Password: infected

    faec1730f41dc078f472d5304d52f193


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • conhost.exe
    .exe windows x64

    Password: infected


    Headers

    Sections