General

  • Target

    Downloads_2017.zip

  • Size

    93.7MB

  • MD5

    d07b1dfd9cde0e0e6d12ecc7ac051944

  • SHA1

    e3ce5f93179460b9057b649aa7e0a5cba84b7857

  • SHA256

    bae61389db8695c1b0a6f94e808df916888ced00bd20166faa3e8e36b1f7f8cd

  • SHA512

    9d59737a78624a1a43fee10e043bcc06b55e7927d97b62aa578df44abc831ac8a142967414ad430e59563428ef083f18f69e2e100d88cceab52fea8208b57425

  • SSDEEP

    1572864:ExjoG0Gkm5VAsGNjgtnmNOGOSHhYBwq0pb7goIP0GidVBIeIwTeZ+AuvuGguyj:E9oG5kKAsGNss/OSHhYCRGidVBIeIwIZ

Score
3/10

Malware Config

Signatures

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Downloads_2017.zip
    .zip

    Password: infected

  • 09e642dcb3a912cecef1e0627b5814e8
    .zip

    Password: infected

  • AnimationEditor.rbxmx
    .js
  • PhysicsAnalyzer.rbxmx
    .js
  • TerrainTools.rbxmx
  • TransformDragger.rbxmx
  • UIEditor.rbxmx
    .js
  • VideoDocumentation.rbxmx
  • terrain/00 - terrain.lua
  • terrain/01 - builder.lua
  • terrain/02 - remover.lua
  • terrain/03 - elevation.lua
  • terrain/04 - brush.lua
  • terrain/06 - craters.lua
  • terrain/08 - roads.lua
  • terrain/09 - materialpaint.lua
    .js
  • terrain/10 - stamper.lua
    .js
  • terrain/11 - floodfill.lua
    .js
  • terrain/12 - smooth.lua
    .js
  • terrain/brush.png
    .png
  • terrain/builder.png
    .png
  • terrain/craters.png
    .png
  • terrain/destroyer.png
    .png
  • terrain/elevation.png
    .png
  • terrain/floodFill.png
    .png
  • terrain/materialBrush.png
    .png
  • terrain/roads.png
    .png
  • terrain/smooth.png
    .png
  • terrain/stamp.png
    .png
  • terrain/terrain.png
    .png
  • 0c2f65b69d6372a0d8451494a87946bf
    .zip

    Password: infected

  • RobloxProxy.dll
    .dll regsvr32 windows:5 windows x86

    Password: infected

    e83ba91127c2f7214609986ff1d5d4a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RobloxProxy64.dll
    .dll regsvr32 windows:6 windows x64

    Password: infected

    d698fad40f3f0486425eb862b7dc8558


    Headers

    Imports

    Exports

    Sections

  • 34236df77e1db95af82c573fa5f51039
    .zip

    Password: infected

  • diffuse.dds
  • diffusearray.dds
  • materials.json
  • normal.dds
  • normalarray.dds
  • specular.dds
  • speculararray.dds
  • 495bfbeb13187a54fae0b8ef1d138895
    .zip

    Password: infected

  • Microsoft.VC90.CRT/Microsoft.VC90.CRT.manifest
    .xml
  • Microsoft.VC90.CRT/msvcm90.dll
    .dll windows:5 windows x86

    Password: infected

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC90.CRT/msvcp90.dll
    .dll windows:5 windows x86

    Password: infected

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC90.CRT/msvcr90.dll
    .dll windows:5 windows x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC90.MFC/Microsoft.VC90.MFC.manifest
    .xml
  • Microsoft.VC90.MFC/mfc90.dll
    .dll windows:5 windows x86

    f2d8030f2fb5ae92ea26c320740a673b


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.VC90.MFC/mfcm90.dll
    .dll windows:5 windows x86

    7dabdb1d81bc318202cca27aed9c03e6


    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC90.OPENMP/Microsoft.VC90.OpenMP.manifest
    .xml
  • Microsoft.VC90.OPENMP/vcomp90.dll
    .dll windows:5 windows x86

    718f76580a1c6ed142d2ebb3755ae79c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp110.dll
    .dll windows:6 windows x86

    098e9eddf1a24b3fd9465ee992148a02


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr110.dll
    .dll windows:6 windows x86

    e057a95f8936f77238b048f253956b3b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 4d3f1199b7e12b7cf3638c5f7b8cfb6d
    .zip .ps1
  • 5b8d09738df4367ca6fa9dcf4c7c89f6
    .zip
  • 5c65cc3f733ce4f734f1b0ea77a9967f
    .zip
  • 6f4d7f590cf93b7193f2b900e699f067
    .zip
  • 781540e40f824c74ea6e1aa21472a4c8
    .zip
  • 8ca4a2a087972783ab017a88ac1d73ec
    .zip
  • 8fd6a1dfe358dc0e2d109370dd7f050d
    .zip
  • 9094da786145ad9d6bcdb3a06756ac04
    .zip
  • 923cbcce59e328414a141c3910de0858
    .zip
  • 940afa5527c2f1455f7e8dbcef0e966b
  • 94b8a657a876504c7e6cf65ba8710f3f
    .zip
  • 98b902f5b59e9f5a0d10248703f8326b
    .zip
  • 9ebb8d34b6749fa192c88ffa813d0754
    .zip
  • d28d324d1d03c10d7ac0c1b0987c9b65
    .zip
  • df7408e17a7d8b3c80b453023ec0fdba
    .zip
  • e3356fe84fbfa7f1bb792608fa11f013
    .zip
  • e79b7cee19eabb84b56e1cc73f8d7cb5
    .zip
  • f55910ed52a4566afd9d27cd39b76cbc
    .zip