Overview

overview

7

Static

static

7

conhost.exe

windows7-x64

7

conhost.exe

windows10-2004-x64

7

lib/Archive/Zip.ps1

windows7-x64

1

lib/Archive/Zip.ps1

windows10-2004-x64

1

lib/auto/Cwd/Cwd.dll

windows7-x64

1

lib/auto/Cwd/Cwd.dll

windows10-2004-x64

1

lib/auto/F...tl.dll

windows7-x64

1

lib/auto/F...tl.dll

windows10-2004-x64

1

lib/auto/F...ob.dll

windows7-x64

7

lib/auto/F...ob.dll

windows10-2004-x64

7

lib/auto/IO/IO.dll

windows7-x64

7

lib/auto/IO/IO.dll

windows10-2004-x64

7

lib/auto/L...il.dll

windows7-x64

1

lib/auto/L...il.dll

windows10-2004-x64

1

lib/auto/P...ng.dll

windows7-x64

1

lib/auto/P...ng.dll

windows10-2004-x64

1

lib/auto/P...ar.dll

windows7-x64

1

lib/auto/P...ar.dll

windows10-2004-x64

1

lib/auto/P...ia.dll

windows7-x64

1

lib/auto/P...ia.dll

windows10-2004-x64

1

lib/auto/S...et.dll

windows7-x64

1

lib/auto/S...et.dll

windows10-2004-x64

7

lib/auto/re/re.dll

windows7-x64

7

lib/auto/re/re.dll

windows10-2004-x64

1

lib/warnings.vbs

windows7-x64

1

lib/warnings.vbs

windows10-2004-x64

1

libeay32.dll

windows7-x64

1

libeay32.dll

windows10-2004-x64

1

netmon

ubuntu-18.04-amd64

netmon

debian-9-armhf

netmon

debian-9-mips

netmon

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target

    52ff111544fa2a189dcec99c00e90ea9

  • Size

    1.4MB

  • MD5

    52ff111544fa2a189dcec99c00e90ea9

  • SHA1

    be45ee55d7d911fdb85d4532ca2e4d20cfdbd2c4

  • SHA256

    2a865f1482ad2c254a1b14fd35ecb58356d1b73ac9ed6df0061fec19e8cd7454

  • SHA512

    098a02a93771d6fcfddb473004532e8023609cf90f308ce9cb4ebccba0fe35d635bc8ce0058adee8a2f75f6eecb9efe513b79c95a04247337ecebdccdb84e4ea

  • SSDEEP

    24576:4FcjpeD11UgxdVzOzsJ/RokNbLVGBKwihVcfYNovuaw8K0ZulxE2ZYV7u:4Ojp/gxdFOQZykNbLVQuVYYJjxHlx1+I

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 11 IoCs

    Detects file using ACProtect software.

  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

Files

  • 52ff111544fa2a189dcec99c00e90ea9
    .zip
  • conhost.exe
    .exe .js windows:4 windows x86 arch:x86 polyglot

    efcb43a6574fd48d389eb490e5ba28ce


    Headers

    Imports

    Sections

  • lib/Archive/Zip.pm
    .ps1
  • lib/AutoLoader.pm
  • lib/Carp.pm
  • lib/Carp/Heavy.pm
  • lib/Compress/Zlib.pm
  • lib/Config.pm
  • lib/Cwd.pm
  • lib/DB.pm
  • lib/Digest.pm
  • lib/Digest/HMAC.pm
  • lib/Digest/HMAC_MD5.pm
  • lib/Digest/HMAC_SHA1.pm
  • lib/Digest/MD5.pm
  • lib/Digest/SHA.pm
  • lib/Digest/SHA1.pm
  • lib/Digest/base.pm
  • lib/Digest/file.pm
  • lib/DynaLoader.pm
  • lib/Env.pm
  • lib/Errno.pm
  • lib/Exporter.pm
  • lib/Exporter/Heavy.pm
  • lib/Fcntl.pm
  • lib/File/Basename.pm
  • lib/File/CheckTree.pm
  • lib/File/Compare.pm
  • lib/File/Copy.pm
  • lib/File/DosGlob.pm
  • lib/File/Find.pm
  • lib/File/Glob.pm
  • lib/File/Listing.pm
  • lib/File/Path.pm
  • lib/File/Spec.pm
  • lib/File/Spec/Cygwin.pm
  • lib/File/Spec/Epoc.pm
  • lib/File/Spec/Functions.pm
  • lib/File/Spec/Mac.pm
  • lib/File/Spec/OS2.pm
  • lib/File/Spec/Unix.pm
  • lib/File/Spec/VMS.pm
  • lib/File/Spec/Win32.pm
  • lib/File/Temp.pm
  • lib/File/stat.pm
  • lib/HTTP/Config.pm
  • lib/HTTP/Cookies.pm
  • lib/HTTP/Cookies/Microsoft.pm
  • lib/HTTP/Cookies/Netscape.pm
  • lib/HTTP/Daemon.pm
  • lib/HTTP/Date.pm
  • lib/HTTP/Headers.pm
  • lib/HTTP/Headers/Auth.pm
  • lib/HTTP/Headers/ETag.pm
  • lib/HTTP/Headers/Util.pm
  • lib/HTTP/Message.pm
  • lib/HTTP/Negotiate.pm
  • lib/HTTP/Request.pm
  • lib/HTTP/Request/Common.pm
  • lib/HTTP/Response.pm
  • lib/HTTP/Status.pm
  • lib/IO.pm
  • lib/IO/AtomicFile.pm
  • lib/IO/Compress/Adapter/Bzip2.pm
  • lib/IO/Compress/Adapter/Deflate.pm
  • lib/IO/Compress/Adapter/Identity.pm
  • lib/IO/Compress/Base.pm
  • lib/IO/Compress/Base/Common.pm
  • lib/IO/Compress/Bzip2.pm
  • lib/IO/Compress/Deflate.pm
  • lib/IO/Compress/Gzip.pm
  • lib/IO/Compress/Gzip/Constants.pm
  • lib/IO/Compress/RawDeflate.pm
  • lib/IO/Compress/Zip.pm
  • lib/IO/Compress/Zip/Constants.pm
  • lib/IO/Compress/Zlib/Constants.pm
  • lib/IO/Compress/Zlib/Extra.pm
  • lib/IO/Dir.pm
  • lib/IO/File.pm
  • lib/IO/Handle.pm
  • lib/IO/InnerFile.pm
  • lib/IO/Lines.pm
  • lib/IO/Pipe.pm
  • lib/IO/Poll.pm
  • lib/IO/Scalar.pm
  • lib/IO/ScalarArray.pm
  • lib/IO/Seekable.pm
  • lib/IO/Select.pm
  • lib/IO/Socket.pm
  • lib/IO/Socket/INET.pm
  • lib/IO/Socket/UNIX.pm
  • lib/IO/String.pm
  • lib/IO/Stringy.pm
  • lib/IO/Uncompress/Adapter/Bunzip2.pm
  • lib/IO/Uncompress/Adapter/Identity.pm
  • lib/IO/Uncompress/Adapter/Inflate.pm
  • lib/IO/Uncompress/AnyInflate.pm
  • lib/IO/Uncompress/AnyUncompress.pm
  • lib/IO/Uncompress/Base.pm
  • lib/IO/Uncompress/Bunzip2.pm
  • lib/IO/Uncompress/Gunzip.pm
  • lib/IO/Uncompress/Inflate.pm
  • lib/IO/Uncompress/RawInflate.pm
  • lib/IO/Uncompress/Unzip.pm
  • lib/IO/Wrap.pm
  • lib/IO/WrapTie.pm
  • lib/IO/Zlib.pm
  • lib/LWP.pm
  • lib/LWP/Authen/Basic.pm
  • lib/LWP/Authen/Digest.pm
  • lib/LWP/Authen/Ntlm.pm
  • lib/LWP/ConnCache.pm
  • lib/LWP/Debug.pm
  • lib/LWP/DebugFile.pm
  • lib/LWP/MediaTypes.pm
  • lib/LWP/MemberMixin.pm
  • lib/LWP/Protocol.pm
  • lib/LWP/Protocol/GHTTP.pm
  • lib/LWP/Protocol/cpan.pm
  • lib/LWP/Protocol/data.pm
  • lib/LWP/Protocol/file.pm
  • lib/LWP/Protocol/ftp.pm
  • lib/LWP/Protocol/gopher.pm
  • lib/LWP/Protocol/http.pm
  • lib/LWP/Protocol/http10.pm
  • lib/LWP/Protocol/https.pm
  • lib/LWP/Protocol/https10.pm
  • lib/LWP/Protocol/loopback.pm
  • lib/LWP/Protocol/mailto.pm
  • lib/LWP/Protocol/nntp.pm
  • lib/LWP/Protocol/nogo.pm
  • lib/LWP/RobotUA.pm
  • lib/LWP/Simple.pm
  • lib/LWP/UserAgent.pm
  • lib/LWP/media.types
  • lib/List/Util.pm
  • lib/POSIX.pm
  • lib/PerlIO.pm
  • lib/PerlIO/encoding.pm
  • lib/PerlIO/scalar.pm
  • lib/PerlIO/via.pm
  • lib/PerlIO/via/QuotedPrint.pm
  • lib/Safe.pm
  • lib/Scalar/Util.pm
  • lib/SelectSaver.pm
  • lib/Socket.pm
  • lib/Symbol.pm
  • lib/Tie/Handle.pm
  • lib/Time/Local.pm
  • lib/UNIVERSAL.pm
  • lib/URI.pm
  • lib/URI/Escape.pm
  • lib/URI/Heuristic.pm
  • lib/URI/IRI.pm
  • lib/URI/QueryParam.pm
  • lib/URI/Split.pm
  • lib/URI/URL.pm
  • lib/URI/WithBase.pm
  • lib/URI/_foreign.pm
  • lib/URI/_generic.pm
  • lib/URI/_idna.pm
  • lib/URI/_ldap.pm
  • lib/URI/_login.pm
  • lib/URI/_punycode.pm
  • lib/URI/_query.pm
  • lib/URI/_segment.pm
  • lib/URI/_server.pm
  • lib/URI/_userpass.pm
  • lib/URI/data.pm
  • lib/URI/file.pm
  • lib/URI/file/Base.pm
  • lib/URI/file/FAT.pm
  • lib/URI/file/Mac.pm
  • lib/URI/file/OS2.pm
  • lib/URI/file/QNX.pm
  • lib/URI/file/Unix.pm
  • lib/URI/file/Win32.pm
  • lib/URI/ftp.pm
  • lib/URI/gopher.pm
  • lib/URI/http.pm
  • lib/URI/https.pm
  • lib/URI/ldap.pm
  • lib/URI/ldapi.pm
  • lib/URI/ldaps.pm
  • lib/URI/mailto.pm
  • lib/URI/mms.pm
  • lib/URI/news.pm
  • lib/URI/nntp.pm
  • lib/URI/pop.pm
  • lib/URI/rlogin.pm
  • lib/URI/rsync.pm
  • lib/URI/rtsp.pm
  • lib/URI/rtspu.pm
  • lib/URI/sip.pm
  • lib/URI/sips.pm
  • lib/URI/snews.pm
  • lib/URI/ssh.pm
  • lib/URI/telnet.pm
  • lib/URI/tn3270.pm
  • lib/URI/urn.pm
  • lib/URI/urn/isbn.pm
  • lib/URI/urn/oid.pm
  • lib/XSLoader.pm
  • lib/attributes.pm
  • lib/auto/Compress/Zlib/autosplit.ix
  • lib/auto/Cwd/Cwd.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/Cwd/Cwd.exp
  • lib/auto/Cwd/Cwd.lib
  • lib/auto/DynaLoader/autosplit.ix
  • lib/auto/DynaLoader/dl_expandspec.al
  • lib/auto/DynaLoader/dl_find_symbol_anywhere.al
  • lib/auto/DynaLoader/dl_findfile.al
  • lib/auto/Fcntl/Fcntl.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/Fcntl/Fcntl.exp
  • lib/auto/Fcntl/Fcntl.lib
  • lib/auto/File/Glob/Glob.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/File/Glob/Glob.exp
  • lib/auto/File/Glob/Glob.lib
  • lib/auto/IO/IO.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/IO/IO.exp
  • lib/auto/IO/IO.lib
  • lib/auto/List/Util/Util.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/List/Util/Util.exp
  • lib/auto/List/Util/Util.lib
  • lib/auto/PerlIO/encoding/encoding.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/PerlIO/encoding/encoding.exp
  • lib/auto/PerlIO/encoding/encoding.lib
  • lib/auto/PerlIO/scalar/scalar.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/PerlIO/scalar/scalar.exp
  • lib/auto/PerlIO/scalar/scalar.lib
  • lib/auto/PerlIO/via/via.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • lib/auto/PerlIO/via/via.exp
  • lib/auto/PerlIO/via/via.lib
  • lib/auto/Socket/Socket.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • lib/auto/Socket/Socket.exp
  • lib/auto/Socket/Socket.lib
  • lib/auto/re/re.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • lib/auto/re/re.exp
  • lib/auto/re/re.lib
  • lib/base.pm
  • lib/constant.pm
  • lib/integer.pm
  • lib/lib.pm
  • lib/open.pm
  • lib/ops.pm
  • lib/overload.pm
  • lib/re.pm
  • lib/strict.pm
  • lib/utf8.pm
  • lib/vars.pm
  • lib/warnings.pm
    .vbs
  • lib/warnings/register.pm
  • libeay32.dll
    .dll windows:4 windows x86 arch:x86

    89f345225babfbe999ba7372ae3aeb07


    Headers

    Imports

    Exports

    Sections

  • netmon
    .sh linux
  • perl58.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • ssleay32.dll
    .dll windows:4 windows x86 arch:x86

    e7ee93661ad1f52dc2b0f299d89f644f


    Headers

    Imports

    Exports

    Sections