7b7b4209ea6f2fc06014baae24589f35

Sharing

Copy URL Twitter E-mail

General

Target

7b7b4209ea6f2fc06014baae24589f35
Size

918KB
MD5

7b7b4209ea6f2fc06014baae24589f35
SHA1

d03079b1c78e7a4dfb18d96af926f922a88ea14c
SHA256

52f9e4723de7f4709bee1b4608fbde8109172f6db249521eb832bb25f137cd11
SHA512

39167069068048bdae21d7bf5d99c4e3b8ab2f999dcaf8347b89666d41c64b350cd989d4dd04b67a5d3fa0e8aacc2556293f1807ffb3e58be1b85b6981650f81
SSDEEP

24576:wjdC30HH2dUt4ZQIoeqMn1x3OVBnaCMyytCb5Tdq6y:mdC8H2dPQLYgVNLgCNU

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/INSTALL/COMFORT.EXE	upx
static1/unpack004/INSTALL/COMFORT.EXE	upx
static1/unpack006/INSTALL/COMFORT.EXE	upx
static1/unpack008/INSTALL/COMFORT.EXE	upx

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack003/out.upx	autoit_exe
static1/unpack005/out.upx	autoit_exe
static1/unpack007/out.upx	autoit_exe
static1/unpack009/out.upx	autoit_exe

Unsigned PE 12 IoCs

Checks for missing Authenticode signature.

resource
unpack002/INSTALL/COMFORT.EXE
unpack003/out.upx
unpack002/INSTALL/PEiDLL.DLL
unpack004/INSTALL/COMFORT.EXE
unpack005/out.upx
unpack004/INSTALL/PEiDLL.DLL
unpack006/INSTALL/COMFORT.EXE
unpack007/out.upx
unpack006/INSTALL/PEiDLL.DLL
unpack008/INSTALL/COMFORT.EXE
unpack009/out.upx
unpack008/INSTALL/PEiDLL.DLL

Files

7b7b4209ea6f2fc06014baae24589f35
.7z
AspirinJunkie/comfortinstaller0.92.rar
.rar
INSTALL/COMFORT.EXE
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 392KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 217KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/PEiDLL.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FileEntropy
GetPEiDScanMode
MultiScanDir
PEiDLLVersion
PEiDVersion
ScanWithPEiD
Scan_Deep
Scan_Hard
Scan_Norm
SetPluginOptions
SetScanOptions

Sections

packerBY
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bero^fr
Size: 232KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 612B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INSTALL/set.ini
INSTALL/userdb.txt
entries.ini
AspirinJunkie/comfortinstaller0.94.rar
.rar
INSTALL/COMFORT.EXE
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 392KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 217KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/PEiDLL.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FileEntropy
GetPEiDScanMode
MultiScanDir
PEiDLLVersion
PEiDVersion
ScanWithPEiD
Scan_Deep
Scan_Hard
Scan_Norm
SetPluginOptions
SetScanOptions

Sections

packerBY
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bero^fr
Size: 232KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 612B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INSTALL/set.ini
INSTALL/userdb.txt
entries.ini
AspirinJunkie/comfortinstaller0.95.rar
.rar
INSTALL/COMFORT.EXE
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 392KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 217KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/PEiDLL.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FileEntropy
GetPEiDScanMode
MultiScanDir
PEiDLLVersion
PEiDVersion
ScanWithPEiD
Scan_Deep
Scan_Hard
Scan_Norm
SetPluginOptions
SetScanOptions

Sections

packerBY
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bero^fr
Size: 232KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 612B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INSTALL/set.ini
INSTALL/userdb.txt
entries.ini
AspirinJunkie/comfortinstaller0.96.rar
.rar
INSTALL/COMFORT.EXE
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 392KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 217KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/PEiDLL.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FileEntropy
GetPEiDScanMode
MultiScanDir
PEiDLLVersion
PEiDVersion
ScanWithPEiD
Scan_Deep
Scan_Hard
Scan_Norm
SetPluginOptions
SetScanOptions

Sections

packerBY
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bero^fr
Size: 232KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 612B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INSTALL/set.ini
INSTALL/userdb.txt
entries.ini
DavenLite/Comfort.zip
.zip
DavenLite/source.zip
.zip

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 392KB

UPX1 Size: 217KB - Virtual size: 220KB

.rsrc Size: 29KB - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 399KB - Virtual size: 398KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 11KB - Virtual size: 99KB

.rsrc Size: 36KB - Virtual size: 40KB

Headers

File Characteristics

Exports

Exports

Sections

packerBY Size: - Virtual size: 271KB

bero^fr Size: 232KB - Virtual size: 236KB

.rsrc Size: 612B - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 392KB

UPX1 Size: 217KB - Virtual size: 220KB

.rsrc Size: 29KB - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 399KB - Virtual size: 398KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 11KB - Virtual size: 99KB

.rsrc Size: 36KB - Virtual size: 40KB

Headers

File Characteristics

Exports

Exports

Sections

packerBY Size: - Virtual size: 271KB

bero^fr Size: 232KB - Virtual size: 236KB

.rsrc Size: 612B - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 392KB

UPX1 Size: 217KB - Virtual size: 220KB

.rsrc Size: 29KB - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 399KB - Virtual size: 398KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 11KB - Virtual size: 99KB

.rsrc Size: 36KB - Virtual size: 40KB

Headers

File Characteristics

Exports

Exports

Sections

packerBY Size: - Virtual size: 271KB

bero^fr Size: 232KB - Virtual size: 236KB

.rsrc Size: 612B - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 392KB

UPX1 Size: 217KB - Virtual size: 220KB

UPX0
Size: - Virtual size: 392KB

UPX1
Size: 217KB - Virtual size: 220KB

.rsrc
Size: 29KB - Virtual size: 32KB

.text
Size: 399KB - Virtual size: 398KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 11KB - Virtual size: 99KB

.rsrc
Size: 36KB - Virtual size: 40KB

packerBY
Size: - Virtual size: 271KB

bero^fr
Size: 232KB - Virtual size: 236KB

.rsrc
Size: 612B - Virtual size: 32KB

UPX0
Size: - Virtual size: 392KB

UPX1
Size: 217KB - Virtual size: 220KB

.rsrc
Size: 29KB - Virtual size: 32KB

.text
Size: 399KB - Virtual size: 398KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 11KB - Virtual size: 99KB

.rsrc
Size: 36KB - Virtual size: 40KB

packerBY
Size: - Virtual size: 271KB

bero^fr
Size: 232KB - Virtual size: 236KB

.rsrc
Size: 612B - Virtual size: 32KB

UPX0
Size: - Virtual size: 392KB

UPX1
Size: 217KB - Virtual size: 220KB

.rsrc
Size: 29KB - Virtual size: 32KB

.text
Size: 399KB - Virtual size: 398KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 11KB - Virtual size: 99KB

.rsrc
Size: 36KB - Virtual size: 40KB

packerBY
Size: - Virtual size: 271KB

bero^fr
Size: 232KB - Virtual size: 236KB

.rsrc
Size: 612B - Virtual size: 32KB

UPX0
Size: - Virtual size: 392KB

UPX1
Size: 217KB - Virtual size: 220KB

.rsrc
Size: 29KB - Virtual size: 32KB

.text
Size: 399KB - Virtual size: 398KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 11KB - Virtual size: 99KB

.rsrc
Size: 36KB - Virtual size: 40KB

packerBY
Size: - Virtual size: 271KB

bero^fr
Size: 232KB - Virtual size: 236KB

.rsrc
Size: 612B - Virtual size: 32KB