Overview

overview

7

Static

static

3

b956ed4c74...db.exe

windows7-x64

3

b956ed4c74...db.exe

windows10-2004-x64

3

$PLUGINSDI...07.dll

windows7-x64

1

$PLUGINSDI...07.dll

windows10-2004-x64

1

$PLUGINSDI...am.dll

windows7-x64

3

$PLUGINSDI...am.dll

windows10-2004-x64

3

$PLUGINSDI...07.dll

windows7-x64

3

$PLUGINSDI...07.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

1

$PLUGINSDI...ns.dll

windows10-2004-x64

1

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...07.dll

windows7-x64

3

$PLUGINSDI...07.dll

windows10-2004-x64

3

$PLUGINSDI...07.dll

windows7-x64

3

$PLUGINSDI...07.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

1

$PLUGINSDI...LL.dll

windows10-2004-x64

1

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDI...gr.dll

windows7-x64

3

$PLUGINSDI...gr.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...nd.dll

windows7-x64

3

$PLUGINSDI...nd.dll

windows10-2004-x64

3

$PLUGINSDIR/stack.dll

windows7-x64

3

$PLUGINSDIR/stack.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

Defenceprivacy.exe

windows7-x64

3

Defenceprivacy.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    b956ed4c7435c14c956f6fca22bd60db

  • Size

    1.9MB

  • MD5

    b956ed4c7435c14c956f6fca22bd60db

  • SHA1

    ce59168198e86f58e2a25216997f88e89d0f6868

  • SHA256

    3df62a6b1cdc08ed54ed65ea00cf7819afb964a913dea35b2ab777b635b21f98

  • SHA512

    4ae1d55668ff11ec85add2d7994bf8eb704917869cce21a2b004570be6add56907b3581c0881c8c3f962feb5962c1ec326bd5bd50c075aabd8c16b766897fc65

  • SSDEEP

    49152:r805Ve23poQrubdcItPXflcc80UOjeJmgnVVP8mU3H:rr5VXpu5/tPX9cc80UOomgVV03X

Score
3/10

Malware Config

Signatures

  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • b956ed4c7435c14c956f6fca22bd60db
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/ChkClient120207.dll
    .dll windows:4 windows x86 arch:x86

    b082642b614793cbc1a0dbaa32838f23


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/DLLWaitForKillProgram.dll
    .dll windows:4 windows x86 arch:x86

    2e92645153848ef99816d61ac6e2a921


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/DLLWebCount120207.dll
    .dll windows:4 windows x86 arch:x86

    20f16464083ccb9be4a9dc460a3ddbad


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IEFunctions.dll
    .dll windows:4 windows x86 arch:x86

    d3ade25d7710cc7b0801440c6df6098c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IsVista120207.dll
    .dll windows:4 windows x86 arch:x86

    0df31e5ec886d5b80aba3ef9f53bca30


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Ischeck120207.dll
    .dll windows:4 windows x86 arch:x86

    d993699ff42311c0188e01425a6cfbc7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    602d7a78172a6f5b4541df0fb5a6b875


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SelfDelete.dll
    .dll windows:4 windows x86 arch:x86

    3d91458bc90a151726bcfdaeff902d08


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserMgr.dll
    .dll windows:4 windows x86 arch:x86

    bac2b3d4a0df9a23aee940b8ecd0d168


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/processes_second.dll
    .dll windows:4 windows x86 arch:x86

    522ca24d77f428ea710f83ca6b5d4867


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stack.dll
    .dll windows:4 windows x86 arch:x86

    55ae76a2cfe164921f566c03cfbba5ec


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:4 windows x86 arch:x86

    b5ed5b3a951d4443ce56e5453702d536


    Headers

    Imports

    Exports

    Sections

  • $TEMP/test.xml
    .xml
  • Defenceprivacy.exe
    .exe windows:5 windows x86 arch:x86

    be55c837b746ca704d18c2fcc99e1db6


    Headers

    Imports

    Sections

  • DefenceprivacyMtr.exe
    .exe windows:5 windows x86 arch:x86

    ccbe0283edbb6749920af0e16efead9f


    Headers

    Imports

    Sections

  • Defenceprivacyuck.exe
    .exe windows:5 windows x86 arch:x86

    0ad9558cedb1d98fd1ba6ff14bf1b7d1


    Headers

    Imports

    Sections

  • RCEngine.dll
    .dll windows:4 windows x86 arch:x86

    d9420d893204a9b984bd13d129d688a5


    Headers

    Imports

    Exports

    Sections

  • RepairCode.exe
    .exe windows:4 windows x86 arch:x86

    b6d545e98873a3b8abfc6561b968b92a


    Headers

    Imports

    Sections

  • adsub.dat
  • filter.dll