falsified medicines app v50 interface[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

falsified medicines app v50 interface.zip
Size

14.7MB
MD5

c3d0f854b30d331c481ae4daad2e6ba7
SHA1

fa60a263e22ec3784200a226f618764552984d9a
SHA256

e2be881c9a0099d6073993b287a01b669f2863e5058f6df631a6d04715af9a43
SHA512

bac865e37262262eb02024e089e6d91e874dca6188c91dd250ac544a28469888db36474ba57e67399add48a7cd5a7b59fad72cc0610b6137acb96180ba8ef55e
SSDEEP

393216:hWJJhbS/EJR+8DkK7iNc/e02h5trr56uBt72SZFqz48:hgJhFIo0h5trrguBTFsf

Score

7^/10

pdf link upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Falsified_medicines_app_vs4.00_32bit.exe	upx
static1/unpack001/Falsified_medicines_app_vs4.00_64bit.exe	upx

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/Instructions vs 1.10odt.pdf	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Falsified_medicines_app_vs4.00_32bit.exe
unpack002/out.upx
unpack001/Falsified_medicines_app_vs4.00_64bit.exe
unpack003/out.upx

Files

falsified medicines app v50 interface.zip
.zip
Falsified_medicines_app_vs4.00_32bit.exe
.exe windows:5 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 630KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Falsified_medicines_app_vs4.00_64bit.exe
.exe windows:5 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 778KB - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Instructions vs 1.10odt.pdf
.pdf
- https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in
- https://www.microsoft.com/en-gb/download/details.aspx?id=13255
- https://www.acronis.com/en-us/articles/telnet/
- https://146.185.100.28:8443/WS_SINGLE_TRANSACTIONS_V1
- https://howsmyssl.com/a/check
- https://146.185.100.28:8448/WS_SUPPORT_V1/SupportServiceV30
- http://www.codecorp.com/assets/data_sheet/D004477-CR2600-TAM-ENG-Data-Sheet.pdf
- http://www.codecorp.com/assets/data_sheet/D030457-CR1500-TAM-ENG-Data-Sheet.pdf
- http://www.codecorp.com/assets/data_sheet/D006432-CR1000-TAM-ENG-Data-Sheet.pdf
SQL_builder.txt
T&C.doc
.doc windows office2003
decommission_settings.txt
electronic.mdb
images/black/abkgd.png
.png
images/black/bbkgd.png
.png
images/black/bkgd.png
.png
images/black/bulkbkgd.png
.png
images/black/dbkgd.png
.png
images/black/minbkgd.png
.png
images/black/minbkgd1.png
.png
images/black/rbkgd.png
.png
images/black/sabkgd.png
.png
images/black/sbkgd.png
.png
images/black/tbkgd.png
.png
images/black/vbkgd.png
.png
images/green/MINbkgd.png
.png
images/green/abkgd.png
.png
images/green/bbkgd.png
.png
images/green/bkgd.png
.png
images/green/bulkbkgd.png
.png
images/green/dbkgd.png
.png
images/green/rbkgd.png
.png
images/green/sbkgd.png
.png
images/green/tbkgd.png
.png
images/green/vbkgd.png
.png
images/orig/MINbkgd.png
.png
images/orig/abkgd.png
.png
images/orig/bbkgd.png
.png
images/orig/bkgd.png
.png
images/orig/bkgd1.png
.png
images/orig/bulkbkgd.png
.png
images/orig/dbkgd.png
.png
images/orig/rbkgd.png
.png
images/orig/sbkgd.png
.png
images/orig/tbkgd.png
.png
images/orig/vbkgd.png
.png
images/pink/abkgd.png
.png
images/pink/bbkgd.png
.png
images/pink/bkgd.png
.png .ps1
images/pink/bulkbkgd.png
.png
images/pink/dbkgd.png
.png
images/pink/minbkgd.png
.png
images/pink/rbkgd.png
.png
images/pink/sbkgd.png
.png
images/pink/tbkgd.png
.png
images/pink/vbkgd.png
.png

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.6MB

UPX1 Size: 5.3MB - Virtual size: 5.3MB

.rsrc Size: 209KB - Virtual size: 212KB

Headers

File Characteristics

Sections

.text Size: 630KB - Virtual size: 629KB

.rdata Size: 142KB - Virtual size: 141KB

.data Size: 13KB - Virtual size: 40KB

.rsrc Size: 6.1MB - Virtual size: 6.1MB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.7MB

UPX1 Size: 5.4MB - Virtual size: 5.4MB

.rsrc Size: 209KB - Virtual size: 212KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 778KB - Virtual size: 778KB

.rdata Size: 226KB - Virtual size: 226KB

.data Size: 14KB - Virtual size: 47KB

.pdata Size: 28KB - Virtual size: 27KB

.gfids Size: 512B - Virtual size: 236B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 6.1MB - Virtual size: 6.1MB

UPX0
Size: - Virtual size: 1.6MB

UPX1
Size: 5.3MB - Virtual size: 5.3MB

.rsrc
Size: 209KB - Virtual size: 212KB

.text
Size: 630KB - Virtual size: 629KB

.rdata
Size: 142KB - Virtual size: 141KB

.data
Size: 13KB - Virtual size: 40KB

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

UPX0
Size: - Virtual size: 1.7MB

UPX1
Size: 5.4MB - Virtual size: 5.4MB

.rsrc
Size: 209KB - Virtual size: 212KB

.text
Size: 778KB - Virtual size: 778KB

.rdata
Size: 226KB - Virtual size: 226KB

.data
Size: 14KB - Virtual size: 47KB

.pdata
Size: 28KB - Virtual size: 27KB

.gfids
Size: 512B - Virtual size: 236B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 6.1MB - Virtual size: 6.1MB