General

  • Target

    tmp

  • Size

    3.9MB

  • MD5

    085e55466181467daaf47d9590fe5910

  • SHA1

    342e3369fc69b199587776ec814d6d860051f490

  • SHA256

    0f3dc20450f2d631abb30a0ab30cd4c499fa2822b7248074b860a7b79b3f8510

  • SHA512

    e6edbf35e22889df5c9e15c9cd161c648f42307bf4b8bf85947d8994ba9c5b57266417d670443e1dc96f742581545770b2925f21e10aee14ffa1bf18658091ba

  • SSDEEP

    98304:x8Yax8AGalZzRRZKM5H0ZoD0L3DSWT05+ZmIVUkVgJN+a:2YaxlGalZzDZRh8FT05+ZBUkza

Score
3/10

Malware Config

Signatures

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • tmp
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LockedList.dll
    .dll windows:4 windows x86 arch:x86

    7815a73383d3384be894923a078a0932


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $_3_/$_3_/IpcSearchSdk_temp.dll
    .dll windows:4 windows x86 arch:x86

    d18a3933c7b9f8407d2110ca69de1542


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/SearchSDK_temp.dll
    .dll windows:5 windows x86 arch:x86

    faa5339a28722294911b58851b5fc19c


    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/batchwritetopu_temp.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    26890079d76269ed7ab101b5592f2ac0


    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/cms_errorstr_temp.txt
  • $_3_/$_3_/cuocx_temp.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    5300e948e5c183b29578dee522b5981d


    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/ipcsearchocx_temp.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    b6b213ce6cc3a272954d20cb814cc6ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/kdaudproc_temp.dll
    .dll windows:4 windows x86 arch:x86

    8044acd7d61bc074e38c05c64be0d249


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/kdmnogen_temp.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    292e8001198653273031c88e577ee90f


    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/mfc100u_temp.dll
    .dll windows:5 windows x86 arch:x86

    6ecbd31f78660e8af99e665d8a5ae336


    Code Sign

    Headers

    Imports

    Sections

  • $_3_/$_3_/msvcp100_temp.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/msvcr100_temp.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/puocx_temp.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    c5304cf6583423ab83eb8115f806c522


    Headers

    Imports

    Exports

    Sections

  • $_3_/$_3_/pusdkmtc_temp.dll
    .dll windows:4 windows x86 arch:x86

    4a41cb8d3f58ad8b076747004b7e80fd


    Headers

    Imports

    Exports

    Sections

  • $_3_/IpcSearchSdk.dll
    .dll windows:4 windows x86 arch:x86

    d18a3933c7b9f8407d2110ca69de1542


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/SearchSDK.dll
    .dll windows:5 windows x86 arch:x86

    faa5339a28722294911b58851b5fc19c


    Headers

    Imports

    Exports

    Sections

  • $_3_/batchwritetopu.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    26890079d76269ed7ab101b5592f2ac0


    Headers

    Imports

    Exports

    Sections

  • $_3_/cms_errorstr.txt
  • $_3_/cuocx.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    5300e948e5c183b29578dee522b5981d


    Headers

    Imports

    Exports

    Sections

  • $_3_/ipcsearchocx.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    b6b213ce6cc3a272954d20cb814cc6ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/kdaudproc.dll
    .dll windows:4 windows x86 arch:x86

    8044acd7d61bc074e38c05c64be0d249


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/kdmnogen.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    292e8001198653273031c88e577ee90f


    Headers

    Imports

    Exports

    Sections

  • $_3_/mfc100u.dll
    .dll windows:5 windows x86 arch:x86

    6ecbd31f78660e8af99e665d8a5ae336


    Code Sign

    Headers

    Imports

    Sections

  • $_3_/msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_3_/puocx.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    c5304cf6583423ab83eb8115f806c522


    Headers

    Imports

    Exports

    Sections

  • $_3_/pusdkmtc.dll
    .dll windows:4 windows x86 arch:x86

    4a41cb8d3f58ad8b076747004b7e80fd


    Headers

    Imports

    Exports

    Sections