Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

General

  • Target
    Fake AV.zip
  • Size 38.6MB
  • Sample240302-2kwptaae37
  • SHA256 aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 42 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

File Explorer

  • Fake AV.zip
    .zip 38.6MB
  • Fake AV/AnViPC2009.exe
    .exe 1.2MB
  • Fake AV/Ana.exe
    .exe 2.1MB
  • Fake AV/Antivirus.exe
    .exe 2.0MB
  • Fake AV/Antivirus2010.exe
    .exe 775KB
  • Fake AV/AntivirusPlatinum.exe
    .exe 739KB
  • Fake AV/AntivirusPro2017.exe
    .exe 816KB
  • Fake AV/CleanThis.exe
    .exe 618KB
  • out.upx
    .exe 1.4MB
  • Fake AV/FakeAdwCleaner.exe
    .exe 190KB
  • 6AdwCleaner.exe
    .exe 168KB
  • Fake AV/FileFixPro/Activation.reg
    198B
  • Fake AV/FileFixPro/FFProInstall.exe
    .exe 455KB
  • Fake AV/HappyAntivirus.exe
    .exe 1.9MB
  • Fake AV/InternetSecurityGuard.exe
    .exe 6.1MB
  • Fake AV/LPS2019.exe
    .exe 1.1MB
  • Fake AV/Movie.mpeg.exe
    .exe 414KB
  • Fake AV/NavaShield.exe
    .exe 9.7MB
  • Fake AV/PCDefender.exe
    .exe 878KB
  • Fake AV/PCDefenderv2.msi
    .msi .vbs 860KB
  • Fake AV/RegistrySmart.exe
    .exe 1.0MB
  • Fake AV/SE2011.exe
    .exe 2.4MB
  • Fake AV/SecurityCentral.exe
    .exe 904KB
  • Fake AV/SecurityDefender.exe
    .exe 1.4MB
  • Fake AV/SecurityDefener2015.exe
    .exe 1.2MB
  • Fake AV/SecurityScanner.exe
    .exe 2.2MB
  • Fake AV/SmartDefragmenter.exe
    .exe 438KB
  • Fake AV/VAV2008.exe
    .exe 770KB
  • out.upx
    .exe 95KB
  • Fake AV/Win7Recovery.exe
    .exe 467KB
  • Fake AV/WindowsAcceleratorPro.exe
    .exe 1023KB
  • Fake AV/WolframAV.exe
    .exe 2.6MB
  • Fake AV/XFileCorrupter.exe
    .exe 136KB
  • Fake AV/XPAntivirus2008.exe
    .exe 1.3MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 12KB
  • $PLUGINSDIR/KillSelf.dll
    .dll 5KB
  • $PLUGINSDIR/MachineKey.dll
    .dll 52KB
  • $PLUGINSDIR/Mutex.dll
    .dll 3KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/lastpage.ini
    207B
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • $PLUGINSDIR/update.ini
    472B
  • $TEMP/pin.vbs
    .vbs 287B
  • $_7_.exe
    .exe 9.0MB
  • MFC71.dll
    .dll 1.0MB
  • MFC71ENU.DLL
    .dll 56KB
  • Uninstall.exe
    .exe 75KB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 12KB
  • $PLUGINSDIR/KillProcDLL.dll
    .dll 32KB
  • $PLUGINSDIR/MachineKey.dll
    .dll 52KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • database.dat
    .zip 1KB
  • license.txt
    18KB
  • msvcp71.dll
    .dll 488KB
  • msvcr71.dll
    .dll 340KB
  • Fake AV/XPAntivirus2008.ico
    9KB
  • Fake AV/fpfstb.dll
    .dll 88KB
  • Fake AV/readme.md
    179B

Fake AV.zip

  • SHA256 aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5
  • MD5 SHA1 SHA512 SSDEEP