General

  • Target

    clmods.zip

  • Size

    74.0MB

  • MD5

    99d656ef19a49451e9c5bf51cc7062d5

  • SHA1

    d95f6ed4410f6e109d3402e83626169d11461fc4

  • SHA256

    941c55c178d109c1af6ca548fbc8d5cf2abe6a7ae9c9517348f499e015ce14fc

  • SHA512

    b3552a706a0578e1fe0970752400cab7d25d38c20eec802e0c0b51210b070ac45b61374647da6cf7dcb73187ed2dd736c0336faade4a76ed521808aa9793ba54

  • SSDEEP

    1572864:hiXYlkT70XUDNMiOBLblUmHwOh05RzQKaiaA8wAXKWv5:MYU0XUDfOBLamQO8I9J

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • clmods.zip
    .zip
  • Awesomium.dll
    .dll windows:5 windows x86 arch:x86

    71652659d3facda326aa791d5a00273c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • AwesomiumProcess.exe
    .exe windows:4 windows x86 arch:x86

    2a58c60a02ce08c159e49d027fdec0a9


    Headers

    Imports

    Sections

  • Core.dll
    .dll windows:4 windows x86 arch:x86

    4ce78a09bdf0a410e75c0449b85813b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • D3DDrv.dll
    .dll windows:4 windows x86 arch:x86

    a7829f3a73e9c32ce5fd4b321836eef5


    Headers

    Imports

    Exports

    Sections

  • D3DX9_40.dll
    .dll windows:6 windows x86 arch:x86

    e22d801543b0946d1782f9cb30c03d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DSETUP.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Engine.dll
    .dll windows:4 windows x86 arch:x86

    bde8a3445e0fc0e3e39b6626b469def3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Fire.dll
    .dll windows:4 windows x86 arch:x86

    bd01f6a19d5d795481ddb30deed85e97


    Headers

    Imports

    Exports

    Sections

  • L2.bin
    .exe windows:4 windows x86 arch:x86

    37a9e780894af893ba0e02b5aedbe550


    Headers

    Imports

    Exports

    Sections

  • clmods.dll
    .dll windows:6 windows x86 arch:x86

    a70012f90abd177d786fec5501b51c75


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • en-US.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • l2.exe
    .exe windows:6 windows x86 arch:x86

    a841fb9fae64c13b7ff2dd8bafe938e0


    Code Sign

    Headers

    Imports

    Sections