General

  • Target

    c245fc9000c19fc5a0172030e520a620.exe

  • Size

    14.3MB

  • MD5

    c245fc9000c19fc5a0172030e520a620

  • SHA1

    59649265b194ff9535994555cafd1188299011d7

  • SHA256

    d05bb25c945e50c553017615e4cf16c0858bf7b1e0d3e9f195f78eefc16f18a9

  • SHA512

    21f10204329eb106c74c6415566f5829f98d3b7f9d0d2f0304281630f232a9b458456c9c89a270a6c7a764415154b6375ca83d1a91889c2c12b3f846675ef9d0

  • SSDEEP

    393216:Veiu21tVa32z0DjgPM7g5VxCKUYKwSckOSjKjEhMsK2Iq:VeL21tc2gDjgSgwrw5kNjKjEhpIq

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • c245fc9000c19fc5a0172030e520a620.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    8df26927f8978d4eb40ff179c0aa961b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/processwork.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Microsoft.VC90.CRT.manifest
  • UboxWebServer.exe
    .exe windows:5 windows x86 arch:x86

    2bc70a50eb1eff095ee08df5f054f66e


    Headers

    Imports

    Sections

  • config.ini
  • libeay32.dll
    .dll windows:6 windows x86 arch:x86

    fa418f447b8ebbcc8fe582306cd4fe43


    Headers

    Imports

    Exports

    Sections

  • msvcm90.dll
    .dll windows:5 windows x86 arch:x86

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • phonic_ubox.dll
    .dll windows:5 windows x86 arch:x86

    adfae113669d9b366cdaf8a7129ea0b3


    Headers

    Imports

    Exports

    Sections

  • phonic_utool.dll
    .dll windows:5 windows x86 arch:x86

    e234903eb6576653e7e27d76b2495ca2


    Headers

    Imports

    Exports

    Sections

  • phonic_utoolI.dll
    .dll windows:5 windows x86 arch:x86

    131a487dec6de690c74e3678b7c29d98


    Headers

    Imports

    Exports

    Sections

  • phonic_utoolII.dll
    .dll windows:5 windows x86 arch:x86

    e234903eb6576653e7e27d76b2495ca2


    Headers

    Imports

    Exports

    Sections

  • phonic_utoolIIEx.dll
    .dll windows:5 windows x86 arch:x86

    e234903eb6576653e7e27d76b2495ca2


    Headers

    Imports

    Exports

    Sections

  • server.key
  • server.pem
  • sqlite3.dll
    .dll windows:4 windows x86 arch:x86

    3383b124ed8c9ce3f21583eb8ccd4efc


    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:6 windows x86 arch:x86

    0743ed19f776ceb54e2fd871d19e6fec


    Headers

    Imports

    Exports

    Sections

  • test.wav
  • tip.wav
  • ubox.ini
  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/processwork.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • voice/_buzzer-ring.wav
  • voice/busy.wav
  • voice/buzzer-ring.wav
  • voice/dial.wav
  • webroot/Style.css
  • webroot/doc/README.md
    .js
  • webroot/doc/css/vue.css
  • webroot/doc/help.pdf
    .pdf
    • http://127.0.0.1:8054/

  • webroot/doc/images/3001install.jpg
    .jpg
  • webroot/doc/images/3002install.jpg
    .jpg
  • webroot/doc/images/3101install.jpg
    .jpg
  • webroot/doc/images/BillWeixin.jpg
    .jpg
    • https://u.wechat.com/MDeVkXAvXskVOgwL8FjsUus

  • webroot/doc/images/Fi3301-connect.png
    .png
  • webroot/doc/images/Fi3301-setSampleRate.png
    .png
  • webroot/doc/images/audio-settting.png
    .png
  • webroot/doc/images/audio-settting2.png
    .png
  • webroot/doc/images/audio-settting3.png
    .png
  • webroot/doc/images/clip_image001.jpg
    .jpg
  • webroot/doc/images/exitserver.png
    .png
  • webroot/doc/images/mic-secret1.png
    .png
  • webroot/doc/images/mic-secret2.png
    .png
  • webroot/doc/images/mic-secret3.png
    .png
  • webroot/doc/images/remotecontrol.png
    .png
  • webroot/doc/images/tip.png
    .png
  • webroot/doc/images/usb-audio.png
    .png
  • webroot/doc/images/widnow-audio-service.png
    .png
  • webroot/doc/index.html
    .html
  • webroot/doc/js/[email protected]
    .js
  • webroot/doc/js/prism-bash.min.js
    .js
  • webroot/doc/js/prism-php.min.js
    .js
  • webroot/doc/sw.js
    .js
  • webroot/favicon.ico
  • webroot/index.html
    .html
  • webroot/js/ByteArray.js
    .js
  • webroot/js/FileSaver.js
    .js
  • webroot/js/jquery.min.js
    .js
  • webroot/js/uboxweb.js
    .js