Overview

overview

7

Static

static

7

c11dc79f4d...b3.exe

windows7-x64

7

c11dc79f4d...b3.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/fct.dll

windows7-x64

3

$PLUGINSDIR/fct.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

bho_project.dll

windows7-x64

1

bho_project.dll

windows10-2004-x64

1

chromeaddo...ded.js

windows7-x64

1

chromeaddo...ded.js

windows10-2004-x64

1

chromeaddo...d.html

windows7-x64

1

chromeaddo...d.html

windows10-2004-x64

1

chromeaddo...ded.js

windows7-x64

1

chromeaddo...ded.js

windows10-2004-x64

1

facetheme/build.sh

ubuntu-18.04-amd64

3

facetheme/build.sh

debian-9-armhf

3

facetheme/build.sh

debian-9-mips

3

facetheme/build.sh

debian-9-mipsel

3

facetheme/...ild.sh

ubuntu-18.04-amd64

facetheme/...ild.sh

debian-9-armhf

facetheme/...ild.sh

debian-9-mips

facetheme/...ild.sh

debian-9-mipsel

facetheme/...lay.js

windows7-x64

1

facetheme/...lay.js

windows10-2004-x64

1

facetheme/...oku.js

windows7-x64

1

facetheme/...oku.js

windows10-2004-x64

1

facetheme/...oku.js

windows7-x64

1

facetheme/...oku.js

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    c11dc79f4d48b70027f581c507ed2db3

  • Size

    131KB

  • MD5

    c11dc79f4d48b70027f581c507ed2db3

  • SHA1

    ab65811c0049eee58e9ecc8c2f04bdad938f5681

  • SHA256

    3f8b462ec0cdfac772297b0ac91539c6319c6c68ae461f9bb9cb39b461fd1e07

  • SHA512

    6d4be2d830de6fd8331c7bbb9047ce62e3bcd5a433281651a1c4980666f9408615c884a92f2a404c7961202cf25e3f38cc797ff36409e9f039d6a42dc2224c76

  • SSDEEP

    3072:3Lk395hYXJFZfFsuGCXvknXinGQKshnJVKXHsMBmoSi:3QqzZuu//knXsG9shJpI3

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • c11dc79f4d48b70027f581c507ed2db3
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/fct.dll
    .dll windows:4 windows x86 arch:x86

    ea6c66dd8fdf3fe3fb04ddbc357acc4c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • ChromeAddon.pem
  • bho_project.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    470b42adb8619884c5594da47c09acc6


    Headers

    Imports

    Exports

    Sections

  • chromeaddon/._included.js
  • chromeaddon/background.html
    .html .js polyglot
  • chromeaddon/included.js
    .js
  • chromeaddon/manifest.json
  • facetheme/build.sh
    .sh linux
  • facetheme/chrome.manifest
  • facetheme/config_build.sh
    .sh linux
  • facetheme/content/.DS_Store
  • facetheme/content/firefoxOverlay.xul
    .xml .js polyglot
  • facetheme/content/overlay.js
    .js
  • facetheme/content/sudoku.js
    .js
  • facetheme/defaults/.DS_Store
  • facetheme/defaults/preferences/.DS_Store
  • facetheme/defaults/preferences/._sudoku.js
  • facetheme/defaults/preferences/sudoku.js
  • facetheme/files
  • facetheme/install.rdf
    .xml
  • facetheme/locale/.DS_Store
  • facetheme/locale/en-US/.DS_Store
  • facetheme/locale/en-US/sudoku.dtd
  • facetheme/locale/en-US/sudoku.properties
  • facetheme/readme.txt
  • facetheme/skin/overlay.css
  • facetheme_uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections