General

  • Target

    99e9b07c08bc61f23d5befb67ffae135

  • Size

    3.6MB

  • MD5

    99e9b07c08bc61f23d5befb67ffae135

  • SHA1

    b8f7c443178515f701c1f1442d6c5dfc638d32ca

  • SHA256

    898afd6a9a30b774d8f6183de0c8ea19b54b69bc362af208e0960c5fe9fb52ad

  • SHA512

    37f95d47dcd0f78725d54ef9d9d11e4ada0b103aeb1dfebf0537381bd604fe242e2862982ee341ab440a9393768950dd4bfd785b67c984b06b7ce7801c3b8ace

  • SSDEEP

    98304:YI/2zQ8ENFN7wgO9dtN/poVlFCvLdkqN8:b2s7NF97O9p/poVdA8

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • 99e9b07c08bc61f23d5befb67ffae135
    .rar
  • IconixSetup.exe
    .exe windows:4 windows x86 arch:x86

    97318da386948415d08cef4a9006d669


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AutoUpdateAgreement.ini
  • $PLUGINSDIR/IEHoster.dll
    .dll windows:4 windows x86 arch:x86

    d45586ff4b2f3d533e94f8f7dd1ac1f9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    6bc108eed3ca99f68adee56e9c99fac6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • .autoreg
  • .autoreg2
  • .autoreg3
  • AOLBasic_3.CAB
    .cab
  • AOLBasicCommons.js
  • AOLBasicConstants.js
  • AOLBasicPrgCommons.js
  • AOLBasicPrgProcessEmail.js
  • AOLBasicPrgProcessEmailBulk.js
  • AOLBasicStatic.js
  • AOLBasicUtils.js
  • OSD93DD.OSD
  • URLRegExp.rul
  • AOL_4.CAB
    .cab
  • AOLCommons.js
  • AOLConstants.js
  • AOLInjectedEventSimulator.js
  • AOLPrgChangeLogo.js
  • AOLPrgCheckPreviewEvents.js
  • AOLPrgCommons.js
  • AOLPrgProcessEmail.js
  • AOLPrgProcessEmailBulk.js
  • AOLPrgRecordEvent.js
  • AOLStatic.js
  • AOLUtils.js
  • OSD93BC.OSD
  • URLRegExp.rul
  • Commons_31.CAB
    .cab
  • Commons.js
  • Constants.js
  • ConstantsUI.js
  • InjectedUI.htm
  • InjectedUI.js
  • OSD93EA.OSD
  • ProgramBillingCommit.js
  • arraylib.js
  • headers.js
  • injectorlib.js
  • json.js
  • selectorslib.js
  • Downloader2_1.dll
    .dll windows:4 windows x86 arch:x86

    3f5e49bc7efaa07529378dc95bc45328


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Downloader_7.dll
    .dll windows:4 windows x86 arch:x86

    b4132fabdf7b8f83815cc69e5cc9a080


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EULA.txt
  • Earthlink_17.CAB
    .cab
  • EarthlinkCommons.js
  • EarthlinkConstants.js
  • EarthlinkFolderIndex.js
  • EarthlinkPrgChangeLogo.js
  • EarthlinkPrgCommons.js
  • EarthlinkPrgProcessEmails.js
  • EarthlinkPrgRecordEvent.js
  • EarthlinkViewEmail.js
  • OSD9400.OSD
  • URLRegExp.rul
  • EmailIDBroker_1.exe
    .exe windows:4 windows x86 arch:x86

    f1735b6603f91649ace10fc01a46af72


    Code Sign

    Headers

    Imports

    Sections

  • FFAOLBasic_3.CAB
    .cab
  • AOLBasicCommons.js
  • AOLBasicConstants.js
  • AOLBasicPrgCommons.js
  • AOLBasicPrgProcessEmail.js
  • AOLBasicPrgProcessEmailBulk.js
  • AOLBasicStatic.js
  • AOLBasicUtils.js
  • OSD9638.OSD
  • URLRegExp.rul
  • extras.xml
  • FFAOL_3.CAB
    .cab
  • AOLCommons.js
  • AOLConstants.js
  • AOLInjectedEventSimulator.js
  • AOLPrgChangeLogo.js
  • AOLPrgCheckPreviewEvents.js
  • AOLPrgCommons.js
  • AOLPrgProcessEmail.js
  • AOLPrgProcessEmailBulk.js
  • AOLPrgRecordEvent.js
  • AOLStatic.js
  • AOLUtils.js
  • OSD962A.OSD
  • URLRegExp.rul
  • extras.xml
  • FFCommons_20.CAB
    .cab
  • Commons.js
  • Constants.js
  • ConstantsUI.js
  • InjectedUI.htm
  • InjectedUI.js
  • OSD9643.OSD
  • ProgramBillingCommit.js
  • arraylib.js
  • headers.js
  • injectorlib.js
  • json.js
  • selectorslib.js
  • FFEarthlink_13.CAB
    .cab
  • FFGmailBasic_22.CAB
    .cab
  • FFGmailStandard2_12.CAB
    .cab
  • FFGmailStandard_25.CAB
    .cab
  • FFPropPage_9.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    333a991493349fe50cd6235fd288d570


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FFProxy.dll
    .dll windows:4 windows x86 arch:x86

    c3477ce768438af0a36efe3e6a3217cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FFProxy2.dll
    .dll windows:4 windows x86 arch:x86

    3dc5ddc93e6faec93bfbf0091059169d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FFProxy3.dll
    .dll windows:4 windows x86 arch:x86

    9fc43f2780b81cb35be422e2676bc1ec


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FFWindowsLiveMail_13.CAB
    .cab
  • FFYahooBeta_16.CAB
    .cab
  • FFYahoo_22.CAB
    .cab
  • GmailBasic_27.CAB
    .cab
  • GmailStandard2_11.CAB
    .cab
  • GmailStandard_32.CAB
    .cab
  • ICommandProcessor.xpt
  • ICommandProcessor2.xpt
  • ICommandProcessor3.xpt
  • ITabComp.xpt
  • ITabComp2.xpt
  • ITabComp3.xpt
  • IWndComp.xpt
  • IWndComp2.xpt
  • IWndComp3.xpt
  • IconixBHO_31.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c0c4887b2df9f387b99626a264eda9aa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IconixFF2_12.dll
    .dll windows:4 windows x86 arch:x86

    d1b669c0721f2dd709d353f1d4a2dfb6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IconixFF3_1.dll
    .dll windows:4 windows x86 arch:x86

    baa8c0332c060d0fa38a8f3a5780420b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IconixFF_19.dll
    .dll windows:4 windows x86 arch:x86

    92401eb6a1bc07bbcb9e6bef29b93fbf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IconixMaxthonPlugin_4.exe
    .exe windows:4 windows x86 arch:x86

    35e53a868d5be2b383702aca253ccd6c


    Code Sign

    Headers

    Imports

    Sections

  • IconixOE_18.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0a1b1bce1bbcd915d8585cea703fb144


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IconixPlugin_2.dll
    .dll windows:4 windows x86 arch:x86

    08ef137cffe372f05bd998178162c5fb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Install.CAB
    .cab
  • Launcher.exe
    .exe windows:4 windows x86 arch:x86

    4b57a8c52a3e5c0654a09b1d374227b3


    Code Sign

    Headers

    Imports

    Sections

  • LibAuth_15.dll
    .dll windows:4 windows x86 arch:x86

    5a4058cc12816f564f1356bac234621f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LibComm_15.dll
    .dll windows:4 windows x86 arch:x86

    b095d221c0983d422f77e5e50d58512c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LibStorage_7.dll
    .dll windows:4 windows x86 arch:x86

    29059d76c909cf469166c8957b83f05e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LibUpdate.dll
    .dll windows:4 windows x86 arch:x86

    7bb49aff8325792419f71cc0c87f0f4c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • OEResources_5.CAB
    .cab
  • OEdmn_3.exe
    .exe windows:4 windows x86 arch:x86

    b9c91cfdfb89708223f89b1f6db71f80


    Code Sign

    Headers

    Imports

    Sections

  • OEldr_3.dll
    .dll windows:4 windows x86 arch:x86

    0ce757c9d1bf953eedbaeb8361910443


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Preferences_11.exe
    .exe windows:4 windows x86 arch:x86

    d5b1ebd473fb0ecb08e65fee4849cc0c


    Code Sign

    Headers

    Imports

    Sections

  • Settings_13.cab
    .cab
  • Uninstaller.exe.nsis
  • Updater_17.exe
    .exe windows:4 windows x86 arch:x86

    be1bb176fe2f029605ba279f02271525


    Code Sign

    Headers

    Imports

    Sections

  • Updater_9.dll
    .dll windows:4 windows x86 arch:x86

    d758fcee2536a45c986045dd4c72b84f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WindowsLiveMail_13.CAB
    .cab
  • YahooBeta_18.CAB
    .cab
  • Yahoo_37.CAB
    .cab
  • chrome.manifest
  • chrome2.manifest
  • chrome3.manifest
  • emailID.jar
    .zip .js polyglot
  • emailID2.jar
    .zip .js polyglot
  • emailID3.jar
    .zip .js polyglot
  • iconix_1.ico
  • install.rdf
    .xml
  • install2.rdf
    .xml
  • install3.rdf
    .xml
  • npIconixProxy.dll
    .dll windows:4 windows x86 arch:x86

    e39ef62d626319c825784daf02a03a80


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nsIIconixPlugin.xpt
  • resource_4.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • 新云软件.url
    .url