Overview

overview

7

Static

static

7

5c16a59e2f...6d.exe

windows7-x64

3

5c16a59e2f...6d.exe

windows10-2004-x64

3

$PLUGINSDI...am.dll

windows7-x64

3

$PLUGINSDI...am.dll

windows10-2004-x64

3

$PLUGINSDI...ew.dll

windows7-x64

3

$PLUGINSDI...ew.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

1

$PLUGINSDI...ns.dll

windows10-2004-x64

1

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ta.dll

windows7-x64

3

$PLUGINSDI...ta.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

1

$PLUGINSDI...LL.dll

windows10-2004-x64

1

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDI...gr.dll

windows7-x64

3

$PLUGINSDI...gr.dll

windows10-2004-x64

3

$PLUGINSDI...xt.dll

windows7-x64

3

$PLUGINSDI...xt.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...dt.dll

windows7-x64

1

$PLUGINSDI...dt.dll

windows10-2004-x64

1

$PLUGINSDI...nd.dll

windows7-x64

3

$PLUGINSDI...nd.dll

windows10-2004-x64

3

$PLUGINSDIR/stack.dll

windows7-x64

3

$PLUGINSDIR/stack.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

$SYSDIR/Zi...64.dll

windows7-x64

7

$SYSDIR/Zi...64.dll

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    5c16a59e2f530e7edc39b76578a6af6d

  • Size

    6.6MB

  • MD5

    5c16a59e2f530e7edc39b76578a6af6d

  • SHA1

    5ca5e9d0f09c1fb8f7ca9d803b1dccfcd0aee8eb

  • SHA256

    eafd9b3e6b929f3df6aff55e72c6a8a8987ef85877116a068b71f0eeec394a78

  • SHA512

    e7f17b13fab00ccafd25775510dc7286469d9df63d0bfe2a2cb423363034958a47ba964d31bcc9e6450dd695271c9818c6f196b811ed24c03db35e5909041e29

  • SSDEEP

    196608:ulY9ZUdDMWZfsmJ/+EP3o9RST4ahoewZ3X8ixY4U:u3dwCfseP42EaGeClRU

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 60 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 5c16a59e2f530e7edc39b76578a6af6d
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/DLLWaitForKillProgram.dll
    .dll windows:4 windows x86 arch:x86

    2e92645153848ef99816d61ac6e2a921


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/DLLWebCount_new.dll
    .dll windows:4 windows x86 arch:x86

    eef21a13a3a20993251273037c6620dd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IEFunctions.dll
    .dll windows:4 windows x86 arch:x86

    d3ade25d7710cc7b0801440c6df6098c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IsVista.dll
    .dll windows:4 windows x86 arch:x86

    efa700f367af492674a29b601d27bd91


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    602d7a78172a6f5b4541df0fb5a6b875


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SelfDelete.dll
    .dll windows:4 windows x86 arch:x86

    3d91458bc90a151726bcfdaeff902d08


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserMgr.dll
    .dll windows:4 windows x86 arch:x86

    bac2b3d4a0df9a23aee940b8ecd0d168


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/gettext.dll
    .dll windows:4 windows x86 arch:x86

    afc7f45ec0ac7d42202c555f96ed7d93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisdt.dll
    .dll windows:1 windows x86 arch:x86

    aa911a57ef69e33e93666ad699a8d7be


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/processes_second.dll
    .dll windows:4 windows x86 arch:x86

    522ca24d77f428ea710f83ca6b5d4867


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stack.dll
    .dll windows:4 windows x86 arch:x86

    55ae76a2cfe164921f566c03cfbba5ec


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:4 windows x86 arch:x86

    b5ed5b3a951d4443ce56e5453702d536


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/ZipShell_x64.dll
    .dll regsvr32 windows:4 windows x64 arch:x64

    68e68e9bff46a0dcfe08d38646469d38


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/szDropTarget.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6f07465bdeed4fb895cdf8401cb6e330


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/szMenu.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b9b91031410b091eb34afcd72e4b5b43


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/sznewcon.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2f1741b33b70fe4a5d35470ae441c12a


    Headers

    Imports

    Exports

    Sections

  • $TEMP/test.xml
    .xml
  • 7za.dll
    .dll windows:4 windows x86 arch:x86

    d7a92883cbd6af4624ba58e77c43b796


    Headers

    Imports

    Exports

    Sections

  • ALZ.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • CDX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6de549268d03ec35a36712d1b8fa6386


    Headers

    Imports

    Exports

    Sections

  • Languages/korean.ini
  • SFXEng/ztv_Arj.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXEng/ztv_Bh.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXEng/ztv_Zip.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXEng/ztv_ace.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXEng/ztv_lha.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXEng/ztv_rar.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXKor/ztv_Arj.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXKor/ztv_Bh.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXKor/ztv_Zip.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXKor/ztv_ace.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXKor/ztv_lha.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • SFXKor/ztv_rar.SFX
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • StarZip.exe
    .exe windows:4 windows x86 arch:x86

    b3494700200d884489f09ec83dc7d13f


    Headers

    Imports

    Sections

  • StartoolsLauncher.exe
    .exe windows:4 windows x86 arch:x86

    9400555104d808018106f29adfad4244


    Headers

    Imports

    Sections

  • XceedZip.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    326affdee153de9790ed22aef13e606e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin.dll
    .dll windows:4 windows x86 arch:x86

    87a48173b4821367c1f76dbfab87aafc


    Headers

    Imports

    Exports

    Sections

  • cpio.dll
    .dll windows:4 windows x86 arch:x86

    5cc7595f24159829285ce65eca07c097


    Headers

    Imports

    Exports

    Sections

  • fpdfview.dll
    .dll windows:4 windows x86 arch:x86

    d742859854b599a369fc30eede8a5062


    Headers

    Imports

    Exports

    Sections

  • iso.dll
    .dll windows:4 windows x86 arch:x86

    71afdeec35a45b70de8da79378ed1bb4


    Headers

    Imports

    Exports

    Sections

  • lcd.dll
    .dll windows:4 windows x86 arch:x86

    32138a93608871706d1dbd23f821eaa2


    Headers

    Imports

    Exports

    Sections

  • nrg.dll
    .dll windows:4 windows x86 arch:x86

    32138a93608871706d1dbd23f821eaa2


    Headers

    Imports

    Exports

    Sections

  • rpm.dll
    .dll windows:4 windows x86 arch:x86

    5cc7595f24159829285ce65eca07c097


    Headers

    Imports

    Exports

    Sections

  • startools_multiup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/DLLWaitForKillProgram.dll
    .dll windows:4 windows x86 arch:x86

    2e92645153848ef99816d61ac6e2a921


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/DLLWebCount_new.dll
    .dll windows:4 windows x86 arch:x86

    eef21a13a3a20993251273037c6620dd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IEFunctions.dll
    .dll windows:4 windows x86 arch:x86

    d3ade25d7710cc7b0801440c6df6098c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    602d7a78172a6f5b4541df0fb5a6b875


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SelfDelete.dll
    .dll windows:4 windows x86 arch:x86

    3d91458bc90a151726bcfdaeff902d08


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • STARUpdate.exe
    .exe windows:4 windows x86 arch:x86

    13a2fe22aaafd3dd19b2f2bce5b78c7d


    Headers

    Imports

    Sections

  • uninstall.exe.nsis
  • starzipextchg.exe
    .exe windows:4 windows x86 arch:x86

    bcb22e4ac6add1a10a43bbbc042cc8e1


    Headers

    Imports

    Sections

  • starzipup.exe
    .exe windows:4 windows x86 arch:x86

    8da9ec112a4da84dbf97db166c934e3b


    Headers

    Imports

    Sections

  • szDocks.ini
  • szIcons.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • szVCDMod.exe
    .exe windows:4 windows x86 arch:x86

    d34c0152c974e20988da8fa8ffd2f422


    Headers

    Imports

    Sections

  • xcdsfxbz.bin
    .exe windows:4 windows x86 arch:x86

    a0b36d31aba77d7cacfa586a4d9cac4a


    Headers

    Imports

    Sections

  • zipsfx32.bin
    .exe windows:4 windows x86 arch:x86

    a0b36d31aba77d7cacfa586a4d9cac4a


    Headers

    Imports

    Sections

  • znaLic.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • ztvcabinet.dll
    .dll windows:5 windows x86 arch:x86

    ea4cbf3c305bfb43c7e36a485e58acb4


    Headers

    Imports

    Exports

    Sections

  • ztvunace26.dll
    .dll windows:1 windows x86 arch:x86

    8390514c40641509cd0941c1fb7588ab


    Headers

    Imports

    Exports

    Sections

  • ztvunrar38.dll
    .dll windows:4 windows x86 arch:x86

    b4d076238051fcc22607f17c728e83bc


    Headers

    Imports

    Exports

    Sections