General

  • Target

    abd4765ec07320fddf50919edfdc42e0

  • Size

    2.0MB

  • MD5

    abd4765ec07320fddf50919edfdc42e0

  • SHA1

    adb1e1265a967a5661b332d7589e13c067ee47c2

  • SHA256

    42c8e9d4655d2a7abc7b93502c57064dee3ab11e1852b4b549c72b54e76686f5

  • SHA512

    adc4138771837c020e0af8cee5c7c4cec48a6aee10c1d11256c25e1cbf74f56f2b10ab0d74063bf87b0bac4a8f50a77a64aa695b48dcbc281c5eb2e0502c77bd

  • SSDEEP

    49152:9FlpG/S505UeoXN5uD9VXfbK3xSkqV8t1nd5:TlpASPy1fu3x9qVond5

Score
6/10

Malware Config

Signatures

  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • abd4765ec07320fddf50919edfdc42e0
    .zip
  • SlimLogger v1.041 Setup.exe
    .exe windows:4 windows x86 arch:x86

    dae718ca7c0da2949ad685c2d593ec7a


    Headers

    Imports

    Sections

  • $HWNDPARENT/Administrator/Config/SLSiteSet_Config.xml
    .xml
  • $HWNDPARENT/SLReportAsHtml.xsl
    .xml .js polyglot
  • $HWNDPARENT/SLReportAsTxt.xsl
    .xml
  • $HWNDPARENT/SLSample00_cfg.xml
    .xml .js polyglot
  • $HWNDPARENT/SLSample01_cfg.xml
    .xml
  • $PLUGINSDIR/HREFSlimLoggerIO.ini
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    3764e6c387ce3c76b39936a24d523dce


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ZMOptionsIO.ini
  • $PLUGINSDIR/zmInstHelper.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $TEMP/WinPcap_3_1.exe
    .exe windows:4 windows x86 arch:x86

    381e79edf6f32b225643e232be0965fa


    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:4 windows x86 arch:x86

    1a5b47ca342113ac49d8568610b85a28


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    9d433976e02d79532f0d635ee81d0b20


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    d79c2fe1aafe446fbd9b984f61377e3e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nxs.dll
    .dll windows:4 windows x86 arch:x86

    e18347a0d90ed806e5568c00e96f58d5


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Packet.dll
    .dll windows:4 windows x86 arch:x86

    a8045d201fdcff39736c580dad656cef


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/WanPacket.dll
    .dll windows:4 windows x86 arch:x86

    d1365884b82c502a6b807942e541ebcd


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/drivers/npf.sys
    .sys windows:5 windows x86 arch:x86

    330366a156f1cd215a328f63c2b6208b


    Headers

    Imports

    Sections

  • $SYSDIR/pthreadVC.dll
    .dll windows:4 windows x86 arch:x86

    90ee61357770484e2d085958b94141a3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/wpcap.dll
    .dll windows:4 windows x86 arch:x86

    06f3d2c48036103c8a5f5cfdcf3daca1


    Headers

    Imports

    Exports

    Sections

  • $TEMP/WpBann.htm
    .html
  • NetMonInstaller.exe
    .exe windows:5 windows x86 arch:x86

    94502e058da0fe00a88ebbc87703a18c


    Headers

    Imports

    Sections

  • daemon_mgm.exe
    .exe windows:4 windows x86 arch:x86

    2826a777c5b099aee5bc5037f22b32db


    Headers

    Imports

    Sections

  • npf_mgm.exe
    .exe windows:4 windows x86 arch:x86

    cca90a57f8cbd4ba808e467ec181cfd5


    Headers

    Imports

    Sections

  • rpcapd.exe
    .exe windows:4 windows x86 arch:x86

    8e2727c84cf6ac7ed96f0b04b324d2d9


    Headers

    Imports

    Sections

  • SC2SLConfigConverter.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • SLConsole.url
  • SlimLoggerReference.pdf
    .pdf
    • http://www.mydomain.com/SlimLoggerReportscould

    • http://SlimLg01.zip

    • http://www.href.com/sl

    • http://www.zaphodsmap.com

    • http://.mydomain.info

    • http://www.href.com

    • http://www.realvnc.com

    • http://www.mydomain.com:8887/statusIf

    • http://www.bob.name/Traffic7075551212

    • Show all
  • High Quality.joboptions
  • chpasswd.xsl
    .xml
  • chpasswd2.xml
    .xml
  • chpasswd2.xsl
    .xml
  • counters.xml
    .xml
  • counters.xsl
    .xml
  • index.xml
    .xml
  • index.xsl
    .xml
  • log.xsl
    .xml
  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • ndisapi.dll
    .dll windows:4 windows x86 arch:x86

    6ff5081a91683ac259c896da75c9d4d5


    Headers

    Imports

    Exports

    Sections

  • newcfg.html
    .html
  • post_demos.html
    .html
  • post_local.html
    .html
  • posthttp.html
    .html
  • slimlogger-install.bat
  • slimlogger-restart.bat
  • slimlogger-start.bat
  • slimlogger-stop.bat
  • slimlogger-uninstall.bat
  • slimlogger.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • slimlogger.exe.config
    .xml
  • slimlogger.exe.key
  • status.xsl
    .xml
  • uninstall/SlimLogger-Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    dae718ca7c0da2949ad685c2d593ec7a


    Headers

    Imports

    Sections

  • $PLUGINSDIR/zmInstHelper.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • SlimLogger-readme.txt
  • slimlogger_pad_file.html
  • slimlogger_pad_file.xml
    .xml