General

  • Target

    d0437f784fad.rar

  • Size

    11.5MB

  • MD5

    c6c8739562f5b961d4d77f9535b8c975

  • SHA1

    d37c396e6017d09c8daedf2edce19aae586b5d5c

  • SHA256

    1d8045657b97d8793dd946e226f402a06014a99b7d568b18d4062148e2203561

  • SHA512

    c7ae0b98e94557a81baf2fabc3bc00329b017632ad47b3a6321f3c8e911b35921baec812a05d6d85fab842c4841baac5a9d632f34988bce800b644c2d1f805e2

  • SSDEEP

    196608:cfhXJs3FrVqDT1pmv96Ew5THPc619fm1cgQsh3MU1/ndvtOxFd:CXJiVqDTOv9x6HUeVm1cbsh3ndndMxT

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • d0437f784fad.rar
    .rar

    Password: 0795ea6f59475671GHB

  • WPerceptionsimulation/AMPPL/155.5563.621.mifest
  • WPerceptionsimulation/AMPPL/2008351634a1d.urma
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/1.bat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/61BBBC212B6BA90Ds
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/A
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/APKwait.bat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/APXhttp.dll
    .dll windows:6 windows x86

    Password: 0795ea6f59475671GHB

    7f63d85b2e576f8e68a2d78d2ba24512


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/APXmodule-2.0.dll
    .dll windows:6 windows x86

    Password: 0795ea6f59475671GHB

    066106b4c4d4352dea7a3117de4fd1b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Agent
    .exe windows:5 windows x86

    Password: 0795ea6f59475671GHB

    d8fc1a3614d526e7111f36ddb837bb41


    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/B
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Bouken
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/BoukenP
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Browser_1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Browser_1.bat
    .bat .vbs
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Browser_2.bat
    .bat .vbs
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Browser_4.bat
    .bat .vbs
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Browser_5.bat
    .bat .vbs
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/CD8BB3B7B8DCE98As
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/DataTransform.ini
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Haloonoroff.exe
    .exe windows:4 windows x86

    Password: 0795ea6f59475671GHB

    60897a2e76a56fd8f1c6d52e76b01fda


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/CIM_ResourceAllocationSettingData.xsd
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/CIM_VirtualSystemSettingData.xsd
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/DrawContent/DrawContentNoname.exe
    .exe windows:5 windows x86

    Password: 0795ea6f59475671GHB

    f47ec2fe2c389851e885ba9314ee0b2a


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/Ico2.exe
    .exe windows:5 windows x86

    Password: 0795ea6f59475671GHB

    673ad2a6779b55e3c98d3eedbb538a66


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/LICENSE.3rd
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/LICENSE.libcodecs
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/LICENSE.libdt
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/Microsoft.VC80.ATL.manifest
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/Microsoft.VC80.CRT.manifest
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/common.xsd
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/hi.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/hr.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/hu.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/lco.exe
    .exe windows:4 windows x86

    Password: 0795ea6f59475671GHB


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86


    Headers

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/li.dat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/livehis.dat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/package.json
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/rpi.dat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/slist.dat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/version
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/HoursBroker/xml.xsd
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Lnnloader.exe
    .exe windows:4 windows x86

    Password: 0795ea6f59475671GHB

    1e1abe87215c90d7e07888b82973f23f


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Lost
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/LostP
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/LostPShe
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/LostShe
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Microsoft_VC90_CRT_manifest
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/NULL.bin
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/NVIDIA_GeForce_Experience_json
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/OTGContainer.exe
    .exe windows:6 windows x86

    50744a0a61693b7f1394d0365708fbe2


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/Microsoft.VC80.ATL.manifest
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/Microsoft.VC80.CRT.manifest
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/am.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/ar.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/bg.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/vd.ico
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/plugins/version
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/ca.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/cs.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/da.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/isolinux.bin
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/ovf-vmware.xsd
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/ovfenv-vmware.xsd
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/themes/sample.flp
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Optimizat/vmPerfmon.h
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/PSpendZ.exe
    .exe windows:5 windows x86

    6e9a261f58f47d82fb85893416a0d9b3


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Ptuity.plx
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/SysP1.bat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/SysP2.bat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/TDPCONTROL.dll
    .dll windows:4 windows x86

    f083989eaad32331d88d19387138caa9


    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/TDPINFO.dll
    .dll windows:4 windows x86

    1675840b660a646313d567cceefa9762


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/TDPSTAT.dll
    .dll windows:4 windows x86

    91271297850ff15a68e5dabad09850ab


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/TP.ini
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/TPClnVM.dll
    .dll windows:6 windows x86

    9c6f328f2cb781ece4da7a0d2c0597cc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/UPSDK.dll
    .dll windows:4 windows x86

    55bf9a5229a3edbfcc0416da74373cca


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/VNL.ini
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/WGLogin.olg
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Win.rbg
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/XLGameUpdate.exe
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/XorTps.exe
    .exe windows:5 windows x86

    d1db6b730ea33596a60d163b85eefb8b


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/Xorapi
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/cbg.sig
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/cdm.sig
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/cefvidf.dll
    .dll windows:5 windows x86

    3d057c1548b19ad5f73e5bdd0dfa3047


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/contribscr.ini
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/cor.sig
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/intchar32
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/intchar64
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/intl.dll
    .dll windows:6 windows x86

    0d5036fd971e20d4cb7ffe6bc5540c58


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/libEGL.dll
    .dll windows:5 windows x86

    b7c0ca2c7eadf6e169e6d987180f93a8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/libcurl.dll
    .dll windows:4 windows x86

    d998ac89bfbbbdcc0f1d517c56821da6


    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/libexpat.dll
    .dll windows:4 windows x86

    7f25d670ad586476ea3f34af147d59da


    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/libtemp.bat
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/msvcp140.dll
    .dll windows:6 windows x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/Microsoft.VC80.ATL.manifest
    .xml
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/Microsoft.VC80.CRT.manifest
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/RunHours/es-419.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/RunHours/es.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/RunHours/et.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/RunHours/fa.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/de.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/el.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/en-GB.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/en-US.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/plugins/version
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/qvlnk.bro
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/rar.exe
    .exe windows:5 windows x86

    85996a3c955c1cdb00ed9e4698bbe557


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/settingss
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/settingss2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/somextrainfo.ini
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/station.bin
    .dll windows:6 windows x86

    144166113ab4a5e253b0d586d0c21c38


    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/vcruntime140.dll
    .dll windows:6 windows x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/vcruntime140_1.dll
    .dll windows:6 windows x64

    ae0bde6314fa2027b54ce04898f6ab69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/AARV1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/AARV2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/AuLibV1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/AuLibV2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/CharMainoV1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/CharMainoV2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/ComeOn
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/Shell
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/WinCall
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/globalV1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/globalV2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/qvlnkbroV1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/qvlnkbroV2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/settingV1
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/version/settingV2
  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/vmauthd.dll
    .dll windows:6 windows x86

    63232ad55dfff77477034ee948581832


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/ARMonitorControl/vnetlib32
  • WPerceptionsimulation/AMPPL/ALGinfo/RTCOM64/iso2win.vlcl
  • WPerceptionsimulation/AMPPL/ALGinfo/RTCOM64/isodata.vlcl
  • WPerceptionsimulation/AMPPL/ALGinfo/RTCOM64/question.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/RTCOM64/zh-CN.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/RTCOM64/zh-TW.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/ms.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/nb.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/run_upgrader.sh
    .sh linux
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/scrnsave/5G4C4g5a.ROM
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/scrnsave/AHCI.ROM
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/scrnsave/gos.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/scrnsave/host.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/vmnetUserif.sys
    .sys windows:10 windows x64

    32ac3357add9a76de708a1785e370328


    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/ALGinfo/plugins/vmnetuserif.cat
  • WPerceptionsimulation/AMPPL/ALGinfo/rtmpal/action.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/rtmpal/cluster.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/rtmpal/ovftool-warning.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/rtmpal/stask.vmsg
  • WPerceptionsimulation/AMPPL/ALGinfo/rtmpal/th.pak
  • WPerceptionsimulation/AMPPL/ALGinfo/rtmpal/tr.pak
  • WPerceptionsimulation/AMPPL/LICENSE
  • WPerceptionsimulation/AMPPL/extensions.on
  • WPerceptionsimulation/AMPPL/lang.conf
  • WPerceptionsimulation/AMPPL/launcher.qm
  • WPerceptionsimulation/AMPPL/manifest.json
  • WPerceptionsimulation/AMPPL/prelo.pb
  • WPerceptionsimulation/AMPPL/vk_.json
  • WPerceptionsimulation/AMPPL/wdscore/Microsoft.VC80.ATL.manifest
    .xml
  • WPerceptionsimulation/AMPPL/wdscore/Microsoft.VC80.CRT.manifest
  • WPerceptionsimulation/AMPPL/wdscore/attributes.kuip
    .xml
  • WPerceptionsimulation/AMPPL/wdscore/common.kuip
    .xml
  • WPerceptionsimulation/AMPPL/wdscore/ipaip2.exe
    .exe windows:4 windows x86

    34ccdad5d2edaac0c9254bfe123410b8


    Code Sign

    Headers

    Imports

    Sections

  • WPerceptionsimulation/AMPPL/wdscore/livehis.dat
  • WPerceptionsimulation/AMPPL/wdscore/msvcp80.dll
    .dll windows:4 windows x86

    6488997e312be12f8300ea7b1c34d497


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/wdscore/msvcr80.dll
    .dll windows:4 windows x86

    7fecbc4a16a5dc85a5394a1df6217680


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WPerceptionsimulation/AMPPL/wdscore/slist.dat
  • WPerceptionsimulation/P2psvcBlack/lang.conf
  • WPerceptionsimulation/P2psvcBlack/launcher.qm
  • WPerceptionsimulation/P2psvcBlack/version
  • WPerceptionsimulation/PulgPlay/setup.cfg
  • WPerceptionsimulation/PulgPlay/version
  • WPerceptionsimulation/PulgPlay/wpptb2_kso.cfg