Overview

overview

7

Static

static

5

b8091cfc45...e7.exe

windows7-x64

3

b8091cfc45...e7.exe

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

1

Default.exe

windows7-x64

7

Default.exe

windows10-2004-x64

7

Go32.exe

windows7-x64

Go32.exe

windows10-2004-x64

PI.exe

windows7-x64

PI.exe

windows10-2004-x64

allmap.exe

windows7-x64

6

allmap.exe

windows10-2004-x64

6

frane.exe

windows7-x64

6

frane.exe

windows10-2004-x64

6

ʼϷ.exe

windows7-x64

1

ʼϷ.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    b8091cfc45833a46d4047da77a2922e7

  • Size

    6.9MB

  • MD5

    b8091cfc45833a46d4047da77a2922e7

  • SHA1

    2ba3e0f47cfb1136b28992cf6b01e5b039591ae4

  • SHA256

    39c812cfc89938952cc49ed501309e576936f51c7a885b35de8daa0e6be6c59d

  • SHA512

    ba75a243d6dc729fb2eb575726b6d41023403d4175ae63e93476e08c4743d4d0d5d7593828064d06f7245590f3bef715eff3b97294adf1e2d2639065008b7f7c

  • SSDEEP

    98304:0UH8XgOTMV6L8a+CC4f6YFu5x72vuWXVKtb6CyjBP0fDe3yjev/3wzeYyu1Mu:TKVYQ4a+C9ruWXV9BcfDea8wKjXu

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • b8091cfc45833a46d4047da77a2922e7
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • Default.sth
    .exe windows:5 windows x86 arch:x86

    854ffef40e32ad6ecafbd54c7e54441e


    Headers

    Imports

    Sections

  • ExeConfig.ini
  • F_icon.ico
  • Go32.exe
  • PI.exe
  • Register.inf
  • allmap.mpg
    .exe windows:4 windows x86 arch:x86

    8d2f519dde1a6a698ee46d63ff568e4d


    Headers

    Imports

    Sections

  • bmp/baku01.pic
  • bmp/cockpit.pic
  • bmp/end00.pic
  • bmp/end01.pic
  • bmp/end02.pic
  • bmp/end03.pic
  • bmp/end04.pic
  • bmp/end05.pic
  • bmp/end06.pic
  • bmp/end07.pic
  • bmp/end08.pic
  • bmp/end09.pic
  • bmp/end10.pic
  • bmp/end11.pic
  • bmp/end12.pic
  • bmp/f_bos00a.pic
  • bmp/f_bos00b.pic
  • bmp/f_bos00c.pic
  • bmp/f_bos01a.pic
  • bmp/f_bos01b.pic
  • bmp/f_bos01c.pic
  • bmp/f_bos01d.pic
  • bmp/f_bos02.pic
  • bmp/f_bos02a.pic
  • bmp/f_bos02b.pic
  • bmp/f_bos02c.pic
  • bmp/f_bos02d.pic
  • bmp/f_bos02e.pic
  • bmp/f_bos02f.pic
  • bmp/f_bos03.pic
  • bmp/f_bos04.pic
  • bmp/f_bos05.pic
  • bmp/f_cha00a.pic
  • bmp/f_cha00b.pic
  • bmp/f_cha00c.pic
  • bmp/f_cha00d.pic
  • bmp/f_cha00e.pic
  • bmp/f_cha01.pic
  • bmp/f_cha02.pic
  • bmp/f_cha03.pic
  • bmp/f_cha04.pic
  • bmp/f_cha05.pic
  • bmp/f_cha06.pic
  • bmp/f_cha07.pic
  • bmp/f_cha08.pic
  • bmp/f_cha09.pic
  • bmp/f_cha10.pic
  • bmp/f_cha11.pic
  • bmp/f_cha12.pic
  • bmp/f_cha13.pic
  • bmp/f_cha14.pic
  • bmp/f_cha15.pic
  • bmp/f_cha16.pic
  • bmp/f_cha17.pic
  • bmp/f_cha18.pic
  • bmp/f_cha19.pic
  • bmp/f_cha20.pic
  • bmp/f_cha35.pic
  • bmp/f_cha36.pic
  • bmp/f_cha38.pic
  • bmp/f_map25op.pic
  • bmp/f_mon00.pic
  • bmp/f_mon01.pic
  • bmp/f_mon010.pic
  • bmp/f_mon02.pic
  • bmp/f_mon03.pic
  • bmp/f_mon04.pic
  • bmp/f_mon05.pic
  • bmp/f_mon06.pic
  • bmp/f_mon07.pic
  • bmp/f_mon08.pic
  • bmp/f_mon09.pic
  • bmp/f_mon10.pic
  • bmp/f_mon11.pic
  • bmp/f_mon12.pic
  • bmp/f_mon13.pic
  • bmp/f_mon14.pic
  • bmp/f_mon15.pic
  • bmp/f_mon16.pic
  • bmp/f_mon17.pic
  • bmp/f_mon18.pic
  • bmp/f_mon19.pic
  • bmp/f_mon20.pic
  • bmp/f_mon21.pic
  • bmp/f_mon22.pic
  • bmp/f_mon23.pic
  • bmp/f_mon24.pic
  • bmp/f_mon25.pic
  • bmp/f_mon26.pic
  • bmp/f_mon27.pic
  • bmp/f_mon28.pic
  • bmp/f_mon29.pic
  • bmp/f_mon30.pic
  • bmp/f_mon31.pic
  • bmp/f_op00.pic
  • bmp/f_op01.pic
  • bmp/f_op02.pic
  • bmp/f_op03.pic
  • bmp/f_op04.pic
  • bmp/f_op05.pic
  • bmp/f_op06.pic
  • bmp/f_op07.pic
  • bmp/f_op08.pic
  • bmp/f_op09.pic
  • bmp/f_op10.pic
  • bmp/f_op11.pic
  • bmp/gfade.pic
  • bmp/gflsh.pic
  • bmp/hane.pic
  • bmp/iwa00.pic
  • bmp/iwa01.pic
  • bmp/iwa02.pic
  • bmp/magicdr00.pic
  • bmp/magicdr01.pic
  • bmp/magicdr02.pic
  • bmp/magicdr03.pic
  • bmp/magiclp00.pic
  • bmp/magiclp01.pic
  • bmp/magiclp01a.pic
  • bmp/magiclp02.pic
  • bmp/magiclp03.pic
  • bmp/magiclpya.pic
  • bmp/msg_cursor.pic
  • chr/frane00.pic
  • chr/frane01.pic
  • chr/frane02.pic
  • chr/frane03.pic
  • chr/frane04.pic
  • chr/frane05.pic
  • chr/frane06.pic
  • chr/frane07.pic
  • chr/frane08.pic
  • chr/frane09.pic
  • chr/frane10.pic
  • chr/frane11.pic
  • chr/title.pic
  • frane.exe
    .exe windows:4 windows x86 arch:x86

    8d2f519dde1a6a698ee46d63ff568e4d


    Headers

    Imports

    Sections

  • gogo.mpg
  • open.mpg
  • title.mpg
  • track_00.mp3
  • track_01.mp3
  • track_02.mp3
  • track_03.mp3
  • track_04.mp3
  • track_05.mp3
  • track_06.mp3
  • track_07.mp3
  • track_07.mpg
  • track_08.mp3
  • track_09.mp3
  • track_10.mp3
  • track_12.mp3
  • track_13.mp3
  • track_14.mp3
  • track_15.mp3
  • track_16.mp3
  • track_17.mp3
  • track_18.mp3
  • track_19.mp3
  • track_20.mp3
  • ʼϷ.exe
    .exe windows:4 windows x86 arch:x86

    54b7e280e64332f33cec3722eafa5f74


    Headers

    Imports

    Sections

  • Ϸгԭ򼰽.txt