General

  • Target

    7041ce12bcb31770b813c13e01f8c5ee

  • Size

    3.3MB

  • MD5

    7041ce12bcb31770b813c13e01f8c5ee

  • SHA1

    4576c03cd9d1ed4786d51c2b9f59daf33764c49b

  • SHA256

    475510168f01162490855f2c54ae959a065994837c598e6aeeeb8aa57806dab5

  • SHA512

    3f04e6f38a1a673a632ae0a85edbb72ac925f09b60419ddb6faa462180977687c739993c97dd13437df0a2d0c40d4c4a1128254fcc071d9ddb4e911e3af82dc9

  • SSDEEP

    49152:09Eqr58vFf+4jWMC50tCP36RktzuuTT+pwsdPd5XDv1TDIkXSWa6KPkwgmPm4GtR:RquvK1GtCPRhTT+xdPdlr1/nU9kwRLEj

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 12 IoCs

Files

  • 7041ce12bcb31770b813c13e01f8c5ee
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Banner.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Microsoft.VC90.CRT.manifest
  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bundle.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • MainInstaller.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • PingMe.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Setup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    a49b0342971aa199fc6349725b90146d


    Headers

    Imports

    Exports

    Sections

  • 2YourFace.crx
    .zip
  • 2YourFace_Util.dll
    .dll windows:5 windows x86 arch:x86

    c4e2a78dbc9a9da5259408e5bfa37d43


    Headers

    Imports

    Exports

    Sections

  • AddInstall.js
    .js
  • Chrome.pem
  • background.html
    .html .js polyglot
  • manifest.json
  • FF8Installer.exe
    .exe windows:5 windows x86 arch:x86

    21c9a9aca328f35740eb29d062cd9815


    Headers

    Imports

    Sections

  • bho.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    5a8ad9fb5a09fa00ef5edb0f90bc35af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffextension/chrome.manifest
  • ffextension/chrome/content/ff-overlay.js
    .js
  • ffextension/chrome/content/ff-overlay.xul
    .xml
  • ffextension/chrome/content/overlay.js
    .js
  • ffextension/chrome/locale/en-US/overlay.dtd
  • ffextension/chrome/locale/en-US/overlay.properties
  • ffextension/chrome/skin/overlay.css
  • ffextension/defaults/preferences/prefs.js
  • ffextension/install.rdf
    .xml
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • MyBabylonTB.exe
    .exe windows:5 windows x86 arch:x86

    31d1a26c07f1e9296c25e08a0a63385e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/layout.html
    .html .js polyglot
  • $PLUGINSDIR/msvcm90.dll
    .dll windows:5 windows x86 arch:x86

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/tools.dll
    .dll windows:5 windows x86 arch:x86

    1b63fbcb3a1760b366862b3a44b1895b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • FileHunter.exe
    .exe windows:5 windows x86 arch:x86

    d4fea7215cf0fa5c2fd2203c684bc755


    Headers

    Imports

    Sections

  • pumpa.exe
    .exe windows:5 windows x86 arch:x86

    ea31cbdb7a736b79763951a0a9de1201


    Headers

    Imports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections