General

  • Target

    9864533ae2246c970cb50cb667ce41e3

  • Size

    3.3MB

  • MD5

    9864533ae2246c970cb50cb667ce41e3

  • SHA1

    b23b693b6cc12ad3ff93397daf3b3d837066d7c2

  • SHA256

    692a45e032fb25a2f44ac26065e834e63bf1540deed3066407202d882a8449cc

  • SHA512

    3c23ae93e69439b1cdcc75fd63505a703c518c3f28e0a2f5979bad3577057311e6298583a0fe38ebff2e17c587d2f1c8014f3ce6aab3d97565ec13dda8fc7e3f

  • SSDEEP

    49152:B9Eqr58vFf+4jWMC50tCP36RktzuuTT+pwsdPd5XDv1TDIkXSWa6KPkwgmPm4GtR:4quvK1GtCPRhTT+xdPdlr1/nU9kwRLEj

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 12 IoCs

Files

  • 9864533ae2246c970cb50cb667ce41e3
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Banner.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Microsoft.VC90.CRT.manifest
  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bundle.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • MainInstaller.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • PingMe.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Setup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    a49b0342971aa199fc6349725b90146d


    Headers

    Imports

    Exports

    Sections

  • 2YourFace.crx
    .zip
  • 2YourFace_Util.dll
    .dll windows:5 windows x86 arch:x86

    c4e2a78dbc9a9da5259408e5bfa37d43


    Headers

    Imports

    Exports

    Sections

  • AddInstall.js
    .js
  • Chrome.pem
  • background.html
    .html .js polyglot
  • manifest.json
  • FF8Installer.exe
    .exe windows:5 windows x86 arch:x86

    21c9a9aca328f35740eb29d062cd9815


    Headers

    Imports

    Sections

  • bho.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    5a8ad9fb5a09fa00ef5edb0f90bc35af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffextension/chrome.manifest
  • ffextension/chrome/content/ff-overlay.js
    .js
  • ffextension/chrome/content/ff-overlay.xul
    .xml
  • ffextension/chrome/content/overlay.js
    .js
  • ffextension/chrome/locale/en-US/overlay.dtd
  • ffextension/chrome/locale/en-US/overlay.properties
  • ffextension/chrome/skin/overlay.css
  • ffextension/defaults/preferences/prefs.js
  • ffextension/install.rdf
    .xml
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • MyBabylonTB.exe
    .exe windows:5 windows x86 arch:x86

    31d1a26c07f1e9296c25e08a0a63385e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/layout.html
    .html .js polyglot
  • $PLUGINSDIR/msvcm90.dll
    .dll windows:5 windows x86 arch:x86

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/tools.dll
    .dll windows:5 windows x86 arch:x86

    1b63fbcb3a1760b366862b3a44b1895b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • FileHunter.exe
    .exe windows:5 windows x86 arch:x86

    d4fea7215cf0fa5c2fd2203c684bc755


    Headers

    Imports

    Sections

  • pumpa.exe
    .exe windows:5 windows x86 arch:x86

    ea31cbdb7a736b79763951a0a9de1201


    Headers

    Imports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections