Overview

overview

7

Static

static

3

PremiumBoo...ll.exe

windows7-x64

7

PremiumBoo...ll.exe

windows10-2004-x64

7

$(LSTR_82).exe

windows7-x64

7

$(LSTR_82).exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

Elcor Soft...ge.url

windows7-x64

1

Elcor Soft...ge.url

windows10-2004-x64

1

GPremiumBooster.pdf

windows7-x64

1

GPremiumBooster.pdf

windows10-2004-x64

1

Premium Bo...ge.url

windows7-x64

1

Premium Bo...ge.url

windows10-2004-x64

1

PremiumBooster.chm

windows7-x64

1

PremiumBooster.chm

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a30087ac0a2a4142b996ee41e15a4b15

  • Size

    4.5MB

  • MD5

    a30087ac0a2a4142b996ee41e15a4b15

  • SHA1

    3605187df6b07a7cc32eb4612c784c5bd5b93012

  • SHA256

    6102f816e8e40f281f8665155d06cd9b9d4ca0216eba627b6a31bad76db8a62d

  • SHA512

    913b4335d75b8a50a68ab9c46d6ad7e4fa122cfc127b9ce5899d45cab1b0cfb452e88ed96f1c3a2db3e51b9a24479e26ae640caae3432b7ec2c7b9a8da950421

  • SSDEEP

    49152:dRW92eFDfOqk6PN3S22UP/nCv9x/CIaFjVScAu3LONOTdUI420FJSZOfrA:dUAvP6l3SA3ny/CfxVlAeLONOhb42IJ0

Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • a30087ac0a2a4142b996ee41e15a4b15
    .rar
  • PremiumBoosterInstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $(LSTR_82).exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    d23fbd09100caad5e10f17163f511668


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    d23fbd09100caad5e10f17163f511668


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioA.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/makerd.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • Data/data001.reg
  • Data/data003.reg
  • Data/data006.reg
  • Data/data007.reg
  • Data/data009.reg
  • Data/data011.reg
  • Data/data013.reg
  • Data/data016.reg
  • Data/data017.reg
  • Data/data020.reg
  • Data/data023.reg
  • Data/data027.reg
  • Data/data030.reg
  • Data/data031.reg
  • Data/data033.reg
  • Data/data040.reg
  • Data/data042.reg
  • Elcor Software Home Page.url
  • GPremiumBooster.pdf
    .pdf

    • http://www.premiumbooster.com/

    • http://www.PremiumBooster.com/buy.php

    • http://www.PremiumBooster.com

  • Languages/Dutch.lng
  • Languages/English.lng
  • Languages/French.lng
  • Languages/German.lng
  • Languages/Hungarian.lng
  • Languages/Russian.lng
  • Languages/Simplified Chinese.lng
  • Languages/Slovenian.lng
  • Languages/Spanish.lng
  • Languages/Traditional Chinese.lng
  • PDB/StartupList.pdb
  • PDB/user_sl.pdb
  • Premium Booster Home Page.url
  • PremiumBooster.chm
    .chm
  • PremiumBooster.config
  • PremiumBooster.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • PremiumBooster.exe.manifest
    .xml
  • ReadMe.Spanish.txt
  • ReadMe.txt
  • premiumbooster_vista.sdb
  • scheduler.exe
    .exe windows:4 windows x86 arch:x86

    d64c624da2e76680872c4ee1bf18b85a


    Headers

    Imports

    Sections

  • scheduler.exe.manifest
    .xml
  • scheduler_vista.sdb
  • whitelist.dat
  • 新云软件.url
    .url