Overview

overview

7

Static

static

7

vc2y.exe

windows7-x64

7

vc2y.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/ATL.dll

windows7-x64

1

$SYSDIR/ATL.dll

windows10-2004-x64

1

$SYSDIR/MFC42.dll

windows7-x64

1

$SYSDIR/MFC42.dll

windows10-2004-x64

1

$SYSDIR/ghe.dll

windows7-x64

1

$SYSDIR/ghe.dll

windows10-2004-x64

1

$SYSDIR/vc.dll

windows7-x64

$SYSDIR/vc.dll

windows10-2004-x64

1

$SYSDIR/vc.scr

windows7-x64

7

$SYSDIR/vc.scr

windows10-2004-x64

7

$SYSDIR/vcl.dll

windows7-x64

7

$SYSDIR/vcl.dll

windows10-2004-x64

7

$TEMP/CpyFile.dll

windows7-x64

7

$TEMP/CpyFile.dll

windows10-2004-x64

7

$TEMP/eng.dll

windows7-x64

3

$TEMP/eng.dll

windows10-2004-x64

3

MailMon.dll

windows7-x64

1

MailMon.dll

windows10-2004-x64

1

Smss.exe

windows7-x64

1

Smss.exe

windows10-2004-x64

1

eng.dll

windows7-x64

3

eng.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    9bfcd1a593f00d00a32980b74429cda7

  • Size

    16.2MB

  • MD5

    9bfcd1a593f00d00a32980b74429cda7

  • SHA1

    dc12f13ab00e4f7047d3a6dcc3e34ed547c87000

  • SHA256

    537527812e1284cb7ee24498e3ad1d38380ec298bd418bfbef950b9ff3960389

  • SHA512

    a8f14feb7ae8388f6d6aee53440e95397b1490954491ecd852df4f960ba2c6ecc796957a628f85dce542f0ff8d62926611a4130bf6944bb10f92c41c7d22cbc8

  • SSDEEP

    393216:vVjsgNM08cu0MYr5yxjcaKsY+qS/AN/rKmrhMMdjYTHBkUGUfJ:9wgNqz0vCj/meMRYTH+RAJ

Score
7/10
upxaspackv2

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 47 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs
    installer

Files

  • 9bfcd1a593f00d00a32980b74429cda7
    .rar
  • vc2y.exe
    .exe windows:4 windows x86 arch:x86

    9c523d8653da5455667e3f82274f2f88


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Splash.dll
    .dll windows:4 windows x86 arch:x86

    dfca8f6698c93c9475bec373d99a1efd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Splash_01.bmp
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bgm_tianehu.mid
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/ATL.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    0b41c476a736ec018e8366a835d84989


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/MFC42.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    0a09b381598dd6f9b88e9ef2d3c87974


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/ghe.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/vc.cpl
    .dll windows:4 windows x86 arch:x86

    7b0e6fc5d948fe68a99e5beb8d65a3c7


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/vc.scr
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/vcl.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/vcl.gif
    .gif
  • $TEMP/CpyFile.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $TEMP/eng.dll
    .dll windows:4 windows x86 arch:x86

    41507753530d76bf751bd1509806ec8e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/vcu.dat
  • $TEMP/vcw.dat
  • MailMon.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9f2dbe5b496cb8990ccc5304a833f6f3


    Headers

    Imports

    Exports

    Sections

  • Smss.exe
    .exe windows:4 windows x86 arch:x86

    09d0478591d4f788cb3e5ea416c25237


    Headers

    Imports

    Sections

  • eng.dll
    .dll windows:4 windows x86 arch:x86

    41507753530d76bf751bd1509806ec8e


    Headers

    Imports

    Exports

    Sections

  • msg.dll
    .dll windows:4 windows x86 arch:x86

    c8cb92eec3a6e9077513fb4a7a8da0d8


    Headers

    Imports

    Exports

    Sections

  • plugin/MailFilter.dll
    .dll windows:4 windows x86 arch:x86

    d356e202eff2e857cdbc2278cbfec777


    Headers

    Imports

    Exports

    Sections

  • plugin/ScanPort.dll
    .dll windows:4 windows x86 arch:x86

    16ddf9b1390c8bf7f7fde96c95b68f26


    Headers

    Imports

    Exports

    Sections

  • plugin/SearchT.dll
    .dll windows:4 windows x86 arch:x86

    669a98558b24db9ca676a0f17099e4aa


    Headers

    Imports

    Exports

    Sections

  • plugin/antiacx.dll
    .dll windows:4 windows x86 arch:x86

    f4089fe30323b0998ab170aa1ab245a6


    Headers

    Imports

    Exports

    Sections

  • plugin/bootview.dll
    .dll windows:4 windows x86 arch:x86

    f4089fe30323b0998ab170aa1ab245a6


    Headers

    Imports

    Exports

    Sections

  • plugin/extopt.dll
    .dll windows:4 windows x86 arch:x86

    f4089fe30323b0998ab170aa1ab245a6


    Headers

    Imports

    Exports

    Sections

  • plugin/regsafe.dll
    .dll windows:4 windows x86 arch:x86

    cb8779150388b4b8626d4ff363211b20


    Headers

    Imports

    Exports

    Sections

  • plugin/vcc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • plugin/vcrep.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • plugin/vcs.dll
    .dll windows:4 windows x86 arch:x86

    f4089fe30323b0998ab170aa1ab245a6


    Headers

    Imports

    Exports

    Sections

  • quaranti.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • quaranti.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • res/DOLPHIN.ACS
  • res/b1_01.gif
    .gif
  • res/b1_02.gif
    .gif
  • res/bg.gif
    .gif
  • res/blank.gif
    .gif
  • res/c1.bmp
  • res/c2.bmp
  • res/g1_01.gif
    .gif
  • res/g1_02.gif
    .gif
  • res/left.gif
    .gif
  • res/logo.ico
  • res/r1_01.gif
    .gif
  • res/r1_02.gif
    .gif
  • res/r2_01.gif
    .gif
  • res/r2_02.gif
    .gif
  • res/vcc.jpg
    .jpg
  • res/vcdriver.cat
  • res/vcdriver.inf
  • res/vcdriver.sys
    .sys windows:6 windows x64 arch:x64

    e0274d5c37a110761ba03ff0a2450d4c


    Headers

    Imports

    Sections

  • res/vce.jpg
    .jpg
  • res/vcj.jpg
    .jpg
  • res/vcscr1.swf
  • res/warn.wav
  • res/y1_01.gif
    .gif
  • res/y1_02.gif
    .gif
  • skins/mxp1.skn
  • skins/skin0000.skn
  • skins/skin0003.skn
  • skins/skin0028.skn
  • skins/skin0031.skn
  • skins/skin0103.skn
  • skins/skin0125.skn
  • skins/skin0188.skn
  • smss.exe
    .exe .ps1 windows:4 windows x86 arch:x86 polyglot

    d5469a133f9de6fc3fcdd5a66b1bc3e8


    Headers

    Imports

    Sections

  • vc2.dll
    .dll windows:4 windows x86 arch:x86

    19c0968ab309786bc667e7c2171d1b37


    Headers

    Imports

    Exports

    Sections

  • vch.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • vcinfo.exe
    .exe windows:4 windows x86 arch:x86

    68f6d45daadc1ad5ee3730cdbab011e4


    Headers

    Imports

    Sections

  • vcn.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • vco.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • vcrm.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • vcrm64.dll
    .dll regsvr32 windows:4 windows x64 arch:x64

    5e59d88360be5845cab82e8ce10c1200


    Headers

    Imports

    Exports

    Sections

  • vcsd.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • vcsd64.dll
    .dll regsvr32 windows:4 windows x64 arch:x64

    9626b49d8de7004c2e19c4b24bd4c8a7


    Headers

    Imports

    Exports

    Sections

  • vcu.dat
  • vcw.chm
    .chm
  • vcw.dat
  • vcw.exe
    .exe windows:4 windows x86 arch:x86

    b71da8a78fcff0a661405748ed84cebd


    Headers

    Imports

    Sections

  • vcw.lng
  • 安装说明.url
    .url