General

  • Target

    7d9cc63111da61cd3ed7dafa866bcee5

  • Size

    5.6MB

  • MD5

    7d9cc63111da61cd3ed7dafa866bcee5

  • SHA1

    3eeb2e2c66b29d74c1ace8e1956f381b352568b0

  • SHA256

    848ea19315d3c6d60dc09d832615dc1fa52f2ae9ab8a0ba086750a28b8833dd9

  • SHA512

    c415dac3e7c276b75d467656460da36e5baf3226daa52dbe62e2ee11c23e904840eeceed169dce47dedf33d7b5ada5b441c90db5a92e1a00b673c0df525860db

  • SSDEEP

    98304:K9E0Lb+B8O0vZBlv+NB4KhNb0C3x3/q/hfukE7XFiI2Azur7hO+BZBSI3dEKP:K20LnO0vHh+N9NJh3/ChfukU1iI2UuJh

Score
3/10

Malware Config

Signatures

  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • 7d9cc63111da61cd3ed7dafa866bcee5
    .exe windows:4 windows x86 arch:x86

    1cf4252ebbb4f173d97a6ef4f79a60b5


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AccessControl.dll
    .dll windows:4 windows x86 arch:x86

    4f442ed10b44738ac5be186be50eb28e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    922b855d216a21490e4bcbf6c29b7f7d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    ee01c5cc33cdb3294484fc93e41c14ad


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    a75ed4b57a83b633f5cb5d4939d72f27


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ewidooptions.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $R0
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • Modules/autostartviewer.dll
    .dll windows:4 windows x86 arch:x86

    10357718f7917213033418bb9d0da030


    Headers

    Imports

    Exports

    Sections

  • Modules/connectionWatch.dll
    .dll windows:4 windows x86 arch:x86

    c6201ce3a8794d16c617e44574df1711


    Headers

    Imports

    Exports

    Sections

  • Modules/processviewer.dll
    .dll windows:4 windows x86 arch:x86

    964c63e4f33e6d99f5247778696a5e0b


    Headers

    Imports

    Exports

    Sections

  • SecuritySuite.exe
    .exe windows:4 windows x86 arch:x86

    a4a075d73bcebc6c70d705410e2406c3


    Headers

    Imports

    Exports

    Sections

  • Signatures/1318.dat
  • alert.wav
  • archive.dll
    .dll windows:4 windows x86 arch:x86

    4a4dc5437abf706e5562455ea79bd840


    Headers

    Imports

    Exports

    Sections

  • chinese.mo
  • configuration.dll
    .dll windows:4 windows x86 arch:x86

    ab71ddd5a695ab52f4007ca6e73dcf27


    Headers

    Imports

    Exports

    Sections

  • context.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d729b7390aaa1715717ed83bf511f5a2


    Headers

    Imports

    Exports

    Sections

  • dutch.mo
  • engine.dll
    .dll windows:4 windows x86 arch:x86

    0af3e50dd69f2e6df8508fa12192a3df


    Headers

    Imports

    Exports

    Sections

  • english.mo
  • ewidoctrl.exe
    .exe windows:4 windows x86 arch:x86

    a4248a3a67c2737bda8a68e502f1a082


    Headers

    Imports

    Sections

  • ewidoguard.exe
    .exe windows:4 windows x86 arch:x86

    93b8401b8f062f0aa411b6499f843e9c


    Headers

    Imports

    Sections

  • framework.dll
    .dll windows:4 windows x86 arch:x86

    373415729211c4739d0f9ecba725cc44


    Headers

    Imports

    Exports

    Sections

  • french.mo
  • gdiplus.dll
    .dll windows:5 windows x86 arch:x86

    7d265bc0350ed04fb2dffec878eb283e


    Headers

    Imports

    Exports

    Sections

  • german.mo
  • guard.sys
    .sys windows:5 windows x86 arch:x86

    b90ad9bf12443988038be29e14e97ed1


    Headers

    Imports

    Sections

  • heuristic.dat
  • infection.wav
  • info.dll
    .dll windows:4 windows x86 arch:x86

    48ae29e48997ce819e15cff958072e1f


    Headers

    Imports

    Exports

    Sections

  • italian.mo
  • japanese.mo
  • lang.dll
    .dll windows:4 windows x86 arch:x86

    4b35f5aab7e8d0630aa0e9aab422243f


    Headers

    Imports

    Exports

    Sections

  • notification.wav
  • portuguese.mo
  • quarantine.dll
    .dll windows:4 windows x86 arch:x86

    c04edf855f6bf8ac56e2881178135584


    Headers

    Imports

    Exports

    Sections

  • resources.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • romanian.mo
  • scan.dll
    .dll windows:4 windows x86 arch:x86

    8d67969af6e7002a1371f4d86377cc18


    Headers

    Imports

    Exports

    Sections

  • shellhook.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    21e2481defe05e9fbd0a07bba82a1b2f


    Headers

    Imports

    Exports

    Sections

  • spanish.mo
  • t.dat
  • tray_dll.dll
    .dll windows:4 windows x86 arch:x86

    ad20a80e1855fe58cc5332e7d4b8df3b


    Headers

    Imports

    Sections

  • tscan1.dll
    .dll windows:4 windows x86 arch:x86

    c2e5731dbdaba02ecf960c623afb9651


    Headers

    Imports

    Exports

    Sections

  • update.dll
    .dll windows:4 windows x86 arch:x86

    aef66c78ba3f6c4bc7f48558d7beaedf


    Headers

    Imports

    Exports

    Sections

  • update_core.dll
    .dll windows:4 windows x86 arch:x86

    5db47b03f55b258ac92f2f0796ba38e2


    Headers

    Imports

    Exports

    Sections

  • wizard.dll
    .dll windows:4 windows x86 arch:x86

    42fe7864d595cee4bab248159a1f3760


    Headers

    Imports

    Exports

    Sections

  • zlib.dll
    .dll windows:4 windows x86 arch:x86

    e5c5650f0b0c0414d7e983aacdedc6c6


    Headers

    Imports

    Exports

    Sections