General

  • Target

    0b560b556ae202686f589fa0e91eeb9b4cd35222f47ed6e256bde714c152e7c6

  • Size

    2.1MB

  • MD5

    830fafe27d97c0e122bda52b682772d6

  • SHA1

    0efafb93cf9f113d64a608d787ac8205c166b472

  • SHA256

    0b560b556ae202686f589fa0e91eeb9b4cd35222f47ed6e256bde714c152e7c6

  • SHA512

    e736c0e2f1c0b79ef7af91d160be1baffac2e661d284b9f99f04c134fb2cbeba2e39331b84e51575a8317d3a072b011f2f8b7744e6dcc271dd4e82aebf58af60

  • SSDEEP

    49152:TXfURfWS+BWF89MAoeiDIrjt2BggZst16EQ75Yl6A4n:TXfofWS+BWWOrU/t2qgOhQdvn

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • 0b560b556ae202686f589fa0e91eeb9b4cd35222f47ed6e256bde714c152e7c6
    .zip
  • DefPlugins/AntiFireTools.lua
  • DefPlugins/ChatTools.cfg
  • DefPlugins/ChatTools.lua
  • DefPlugins/CloneCD.lua
  • DefPlugins/CloneCD.lua.bak
  • DefPlugins/MediaPlayTools.lua
  • DefPlugins/Mofirefox.lua
  • DefPlugins/MsIE.lua
  • DefPlugins/NetDownload.lua
  • DefPlugins/NetDownload.lua.bak
  • DefPlugins/Office.lua
  • DefPlugins/OtherTools.cfg
  • DefPlugins/OtherTools.lua
  • DefPlugins/PaintTools.lua
  • DefPlugins/Secretset.sfg
  • DefPlugins/System.lua
  • DefPlugins/WinRun.lua
  • DefPlugins/WordEditTools.lua
  • DefPlugins/ZipTools.lua
  • DefPlugins/img/Page.ico
  • Eraser.dll
    .dll windows:5 windows x86

    b5a732d3c1a351c82ee5651fc954314c


    Headers

    Imports

    Exports

    Sections

  • Erasext.dll
    .dll regsvr32 windows:5 windows x86

    e0ea2e2a2809d8a1c7339c9f3b7b2ff1


    Headers

    Imports

    Exports

    Sections

  • Language/en.lng
  • Language/zh_cn.lng
  • Language/zh_tw.lng
  • NTFS转换.bat
  • PluginMaker.exe
    .exe windows:5 windows x86

    81127eb082960a7ab72cfdce62ea1931


    Headers

    Imports

    Sections

  • Plugins/Self-Denifition.wyz
  • Plugins/WywzSelfDefDel.cms
  • Wywz.exe
    .exe windows:5 windows x86

    b90998a81b1fc71023857778f2f35a1f


    Headers

    Imports

    Sections

  • config.ini
  • filed.dll
    .dll regsvr32 windows:4 windows x86

    539e751b99aab94dd23f581ba33f6ddb


    Headers

    Imports

    Exports

    Sections

  • filed.sys
    .sys windows:5 windows x86

    bb6c7138f250c4628d217397491c1120


    Headers

    Imports

    Sections

  • lua5.1.dll
    .dll windows:5 windows x86

    a705208ddd2c1f577b5f9cc472efd1aa


    Headers

    Imports

    Exports

    Sections

  • native.bin
    .sys windows:5 windows x86

    c3096b741b78ce506708a9692a46316f


    Headers

    Imports

    Sections

  • subinacl.exe
    .exe windows:5 windows x86

    2eaf7681cf60327cff49f2244e0aa8b4


    Headers

    Imports

    Sections

  • vcl.dll
    .dll windows:4 windows x86


    Headers

    Exports

    Sections

  • wywz.dat
  • wywz.dll
  • wyzl.dll
    .dll windows:5 windows x86

    ee68c389d44dc0aa49950679a8c08de7


    Headers

    Imports

    Exports

    Sections