Overview

overview

8

Static

static

7

workwinScr...��.doc

windows7-x64

4

workwinScr...��.doc

windows10-2004-x64

1

workwinScr...60.dll

windows7-x64

1

workwinScr...60.dll

windows10-2004-x64

1

workwinScr...up.exe

windows7-x64

4

workwinScr...up.exe

windows10-2004-x64

4

workwinScr...hs.dll

windows7-x64

1

workwinScr...hs.dll

windows10-2004-x64

1

workwinScr...tv.exe

windows7-x64

8

workwinScr...tv.exe

windows10-2004-x64

8

workwinScr...rk.dll

windows7-x64

1

workwinScr...rk.dll

windows10-2004-x64

1

workwinScr...up.exe

windows7-x64

1

workwinScr...up.exe

windows10-2004-x64

1

workwinScr...tv.exe

windows7-x64

8

workwinScr...tv.exe

windows10-2004-x64

8

workwinScr...rk.dll

windows7-x64

1

workwinScr...rk.dll

windows10-2004-x64

1

workwinScr...tv.exe

windows7-x64

8

workwinScr...tv.exe

windows10-2004-x64

8

workwinScr...rk.dll

windows7-x64

1

workwinScr...rk.dll

windows10-2004-x64

1

workwinScr...TL.dll

windows7-x64

1

workwinScr...TL.dll

windows10-2004-x64

1

workwinScr...CK.dll

windows7-x64

1

workwinScr...CK.dll

windows10-2004-x64

1

workwinScr...er.exe

windows7-x64

1

workwinScr...er.exe

windows10-2004-x64

8

workwinScr...le.dll

windows7-x64

1

workwinScr...le.dll

windows10-2004-x64

1

workwinScr...��.exe

windows7-x64

1

workwinScr...��.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf8985856466b55ca4a223d84fbaaee1

  • Size

    4.0MB

  • MD5

    bf8985856466b55ca4a223d84fbaaee1

  • SHA1

    1f8d5a842a3bb3b7797e04dfc29dba9dba7c8c19

  • SHA256

    4cdb5a1fbe2b961c6ee7aa63411a44eee1d86671053ba877c2a5d4e3fcb673eb

  • SHA512

    4bb0277a6cc1eb9825f82877862dcbf4ec6abe954190010e2f59391b7a927f8e07e1af71b2381b3383325fa62a7bab173fde0bec217fbaac4da7835aab34658d

  • SSDEEP

    98304:jmWUsvbxlmdA8gBrRdcPeVH53ddYYlApslb:jmWDXmdC9d8oHJ9lApI

Score
7/10
themida

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • bf8985856466b55ca4a223d84fbaaee1
    .zip
  • workwinScreen/WorkWinǽƤ.doc
    .doc windows office2003
  • workwinScreen/ӢĻ߷ϵͳ.txt
  • workwinScreen/Ӷ(Ա)/Ϊװ/Msvbvm60.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6a66fb523666c583cb87c4630ccedf7a


    Headers

    Imports

    Exports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/Setup.exe
    .exe windows:4 windows x86 arch:x86

    d92553a6b3460c75351d5686b38d4116


    Headers

    Imports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/Vb6chs.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/WorkWintv.dat
    .exe windows:4 windows x86 arch:x86

    8fbe2d5c567b45dc596a6c9f117b6557


    Headers

    Imports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/wintvwork.dll
    .dll windows:4 windows x86 arch:x86

    a51cffd9d6a99820710647e0ea25ada1


    Headers

    Imports

    Exports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/wsetdata.dat
  • workwinScreen/Ӷ(Ա)/Ϊװ/Setup.exe
    .exe windows:4 windows x86 arch:x86

    fef91499e93ff0e739aa952dac785130


    Headers

    Imports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/WorkWintv.dat
    .exe windows:4 windows x86 arch:x86

    8fbe2d5c567b45dc596a6c9f117b6557


    Headers

    Imports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/wintvwork.dll
    .dll windows:4 windows x86 arch:x86

    a51cffd9d6a99820710647e0ea25ada1


    Headers

    Imports

    Exports

    Sections

  • workwinScreen/Ӷ(Ա)/Ϊװ/wsetdata.dat
  • workwinScreen/Ӷ(Ա)/Ϊװ/Ϊװע.txt
  • workwinScreen/Ӷ(Ա)/ͻʾ.jpg
    .jpg
  • workwinScreen/Ӷ(Ա)/ⰲװɫ/WorkWintv.exe
    .exe windows:4 windows x86 arch:x86

    8fbe2d5c567b45dc596a6c9f117b6557


    Headers

    Imports

    Sections

  • workwinScreen/Ӷ(Ա)/ⰲװɫ/wintvwork.dll
    .dll windows:4 windows x86 arch:x86

    a51cffd9d6a99820710647e0ea25ada1


    Headers

    Imports

    Exports

    Sections

  • workwinScreen/Ӷ(Ա)/ⰲװɫ/wsetdata.dat
  • workwinScreen//MSCOMCTL.OCX
    .dll regsvr32 windows:4 windows x86 arch:x86

    ce21923007044b1701a0b2dc4ac9396b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • workwinScreen//MSWINSCK.OCX
    .dll regsvr32 windows:4 windows x86 arch:x86

    fcc40667ac22e0c598518006de958259


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • workwinScreen//WorkWinTvServer.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • workwinScreen//eaagle.dll
    .dll windows:4 windows x86 arch:x86

    dd363e6ea64fe9e11905347edca83433


    Headers

    Imports

    Exports

    Sections

  • workwinScreen//server.ini
  • workwinScreen//wsetdata.dat
  • workwinScreen//wwinlog.dat
  • workwinScreen//бʧܵ޸.exe
    .exe windows:4 windows x86 arch:x86

    a09af34eb358635694c1b6f0e30ef6f1


    Headers

    Imports

    Sections