General

  • Target

    Susp_Payload.7z

  • Size

    498KB

  • MD5

    e9843a668cedb7bf0adf04e745683446

  • SHA1

    c8b41797f50cd3f0e797df80e56a54243f6bf16a

  • SHA256

    39031824dec82b0a2b56385f599804e0764ecb45fa0768c5d02012fcb64962fb

  • SHA512

    6e81403689a402553819f2c2631d11f132e03762cc1cbe3bc5a1d33ad1a82aa0f17ba15fe9fd92dcb01991b42257a0d4bf43fd03c101fe34bfd9c22119c9111d

  • SSDEEP

    12288:0/oyw+uLH6BPDqsyXZc2HWrAny+Rtb2E4Hku/k:Zp1HMDNyX9W12

Score
3/10

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Susp_Payload.7z
    .7z

    Password: infected

  • DllHijacking/3BD4774E.exe
    .exe windows x86

    9f7d35d13d490935ed4b82591527ee84


    Code Sign

    Headers

    Imports

    Sections

  • DllHijacking/AliwangwangFramework.dll
    .dll windows x86

    122ca2364f51f2fb4f5d7337aabac123


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DllHijacking/UpdateAssist.dll
    .dll windows x86

    5da04e9834aebe1743fa702b682b7816


    Headers

    Imports

    Exports

    Sections

  • DllHijacking/ZP.log