ca8c71b79bed0021183bda8a930c9e4b

Sharing

Copy URL

Twitter E-mail

General

Target

ca8c71b79bed0021183bda8a930c9e4b
Size

7.4MB
MD5

ca8c71b79bed0021183bda8a930c9e4b
SHA1

0c35dd530fb52133c1656820cbc004fb4fb064ec
SHA256

6e9b219964b506bbe0303dfec35424b1b82bca58881a56f66fd44278c7b5e475
SHA512

e5af3f2faed30115519b3313f924af4e1f1771277e3a38a3fa4b3aaf2a5f6c76b87c5d3708fffba9c3e74ad8e5c21c815eda3a25ca1eae3f17560b6aac14ef06
SSDEEP

196608:BPD4kL82C5agSKB1oF1hXV2rmQJcPM77E+GjV/uYb59:dDVLgagswrdJccoTjVPn

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Setup.exe
unpack003/run.exe
unpack004/Setup.exe

Files

ca8c71b79bed0021183bda8a930c9e4b
.zip
.version
GnuCache.net
WebCache.net
names/3316.zip.nms
names/3317.zip.nms
names/3318.rar.nms
names/3319.mov.nms
names/3320.mov.kws
names/3320.mov.nms
names/3321.mov.nms
names/3322.torrent.nms
names/3323.torrent.nms
templates/3316.zip
.zip
Checked by SiteAdvisor.com.txt
Downloaded from Torrentcafe.com.txt
FILE_ID.DIZ
Setup.exe
.exe windows:5 windows x86 arch:x86

b73b2a5742d430c0e9facd8ee6591646

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

DestroyEnvironmentBlock
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetAppliedGPOListW
CreateEnvironmentBlock
UnregisterGPNotification
RegisterGPNotification
LeaveCriticalPolicySection
GetProfilesDirectoryW

kernel32

_lclose
VirtualFree
VirtualAlloc
VerifyVersionInfoA
VerLanguageNameA
SetUnhandledExceptionFilter
SetLastError
SetFileAttributesW
CancelIo
CreateMutexA
EraseTape
ExitProcess
FileTimeToDosDateTime
FindFirstChangeNotificationW
GetACP
GetAtomNameA
GetCalendarInfoW
GetCommandLineA
GetComputerNameA
GetCurrentThreadId
GetMailslotInfo
GetPrivateProfileStringA
HeapAlloc
IsBadStringPtrA
IsDBCSLeadByte
OpenFileMappingW
OpenMutexA
Process32FirstW
ReadProcessMemory

crtdll

wcsxfrm
vfwprintf
strcmp
sqrt
isleadbyte
clock
atan
abs
_ultoa
_strnset
_ecvt
_execve
_exit
_filelength
_finite
_ftime
_mbctohira
_mbscmp
_mbscpy
_mbsnccnt
_rotr
_stat
wctomb

rpcrt4

MesIncrementalHandleReset
RpcBindingFromStringBindingA
RpcBindingServerFromClient
tree_peek_ndr

version

VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerInstallFileA

ntdll

ZwQueryDefaultUILanguage
ZwOpenThreadToken
RtlTryEnterCriticalSection
RtlOemToUnicodeN
RtlNtStatusToDosError
NtWriteFile
NtQueryInformationFile
NtNotifyChangeKey
NtGetPlugPlayEvent

Exports

Exports

VjxnE
atnzFXgelaqLsep
bqzvboMacmKj
cacjlWwaYFeqtazczcu
geeqOopCkZsynvjq
iYadwvvlXqgunxG
ltguyxsfvdmsyckggbk
ocRozsNDxrzh
tovpQursjdzyqctxms
trbdLxm
uirijfVGwvdlhqk
yiQhjkYbuknu

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 486KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ViKiNG.nfo
templates/3317.zip
.zip
Checked by SiteAdvisor.com.txt
Downloaded from Torrentcafe.com.txt
FILE_ID.DIZ
ViKiNG.nfo
run.exe
.exe windows:5 windows x86 arch:x86

b73b2a5742d430c0e9facd8ee6591646

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

DestroyEnvironmentBlock
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetAppliedGPOListW
CreateEnvironmentBlock
UnregisterGPNotification
RegisterGPNotification
LeaveCriticalPolicySection
GetProfilesDirectoryW

kernel32

_lclose
VirtualFree
VirtualAlloc
VerifyVersionInfoA
VerLanguageNameA
SetUnhandledExceptionFilter
SetLastError
SetFileAttributesW
CancelIo
CreateMutexA
EraseTape
ExitProcess
FileTimeToDosDateTime
FindFirstChangeNotificationW
GetACP
GetAtomNameA
GetCalendarInfoW
GetCommandLineA
GetComputerNameA
GetCurrentThreadId
GetMailslotInfo
GetPrivateProfileStringA
HeapAlloc
IsBadStringPtrA
IsDBCSLeadByte
OpenFileMappingW
OpenMutexA
Process32FirstW
ReadProcessMemory

crtdll

wcsxfrm
vfwprintf
strcmp
sqrt
isleadbyte
clock
atan
abs
_ultoa
_strnset
_ecvt
_execve
_exit
_filelength
_finite
_ftime
_mbctohira
_mbscmp
_mbscpy
_mbsnccnt
_rotr
_stat
wctomb

rpcrt4

MesIncrementalHandleReset
RpcBindingFromStringBindingA
RpcBindingServerFromClient
tree_peek_ndr

version

VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerInstallFileA

ntdll

ZwQueryDefaultUILanguage
ZwOpenThreadToken
RtlTryEnterCriticalSection
RtlOemToUnicodeN
RtlNtStatusToDosError
NtWriteFile
NtQueryInformationFile
NtNotifyChangeKey
NtGetPlugPlayEvent

Exports

Exports

BdhoIbSqLpdf
PfgrvQwdvjqoxR
cIgykamESgxPrjxyw
dXqMambKZpufvCHxaf
eZnwozkyhksKvwlusn
lpdcWweRa
myttjfyGaljhK
ojfqdueryUL
qtwyorxLbeoce
rqyselaUzqzgts
vctCldjzoodmyusvz
wyfhwLMDaoeOuuuhmC

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 486KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
templates/3318.rar
.rar
Checked by SiteAdvisor.com.txt
Downloaded from Torrentcafe.com.txt
FILE_ID.DIZ
Setup.exe
.exe windows:5 windows x86 arch:x86

b73b2a5742d430c0e9facd8ee6591646

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

DestroyEnvironmentBlock
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetAppliedGPOListW
CreateEnvironmentBlock
UnregisterGPNotification
RegisterGPNotification
LeaveCriticalPolicySection
GetProfilesDirectoryW

kernel32

_lclose
VirtualFree
VirtualAlloc
VerifyVersionInfoA
VerLanguageNameA
SetUnhandledExceptionFilter
SetLastError
SetFileAttributesW
CancelIo
CreateMutexA
EraseTape
ExitProcess
FileTimeToDosDateTime
FindFirstChangeNotificationW
GetACP
GetAtomNameA
GetCalendarInfoW
GetCommandLineA
GetComputerNameA
GetCurrentThreadId
GetMailslotInfo
GetPrivateProfileStringA
HeapAlloc
IsBadStringPtrA
IsDBCSLeadByte
OpenFileMappingW
OpenMutexA
Process32FirstW
ReadProcessMemory

crtdll

wcsxfrm
vfwprintf
strcmp
sqrt
isleadbyte
clock
atan
abs
_ultoa
_strnset
_ecvt
_execve
_exit
_filelength
_finite
_ftime
_mbctohira
_mbscmp
_mbscpy
_mbsnccnt
_rotr
_stat
wctomb

rpcrt4

MesIncrementalHandleReset
RpcBindingFromStringBindingA
RpcBindingServerFromClient
tree_peek_ndr

version

VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerInstallFileA

ntdll

ZwQueryDefaultUILanguage
ZwOpenThreadToken
RtlTryEnterCriticalSection
RtlOemToUnicodeN
RtlNtStatusToDosError
NtWriteFile
NtQueryInformationFile
NtNotifyChangeKey
NtGetPlugPlayEvent

Exports

Exports

BdhoIbSqLpdf
PfgrvQwdvjqoxR
cIgykamESgxPrjxyw
dXqMambKZpufvCHxaf
eZnwozkyhksKvwlusn
lpdcWweRa
myttjfyGaljhK
ojfqdueryUL
qtwyorxLbeoce
rqyselaUzqzgts
vctCldjzoodmyusvz
wyfhwLMDaoeOuuuhmC

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 486KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ViKiNG.nfo
templates/3319.mov
templates/3320.mov
templates/3321.mov
templates/3322.torrent
templates/3323.torrent

Sharing

General

Malware Config

Signatures

Files

b73b2a5742d430c0e9facd8ee6591646

Headers

File Characteristics

Imports

userenv

kernel32

crtdll

rpcrt4

version

ntdll

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.data Size: 486KB - Virtual size: 1.1MB

.rsrc Size: 26KB - Virtual size: 26KB

b73b2a5742d430c0e9facd8ee6591646

Headers

File Characteristics

Imports

userenv

kernel32

crtdll

rpcrt4

version

ntdll

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 36KB

.data Size: 486KB - Virtual size: 1.1MB

.rsrc Size: 26KB - Virtual size: 26KB

b73b2a5742d430c0e9facd8ee6591646

Headers

File Characteristics

Imports

userenv

kernel32

crtdll

rpcrt4

version

ntdll

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 37KB

.data Size: 486KB - Virtual size: 1.1MB

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 36KB - Virtual size: 35KB

.data
Size: 486KB - Virtual size: 1.1MB

.rsrc
Size: 26KB - Virtual size: 26KB

.text
Size: 36KB - Virtual size: 36KB

.data
Size: 486KB - Virtual size: 1.1MB

.rsrc
Size: 26KB - Virtual size: 26KB

.text
Size: 38KB - Virtual size: 37KB

.data
Size: 486KB - Virtual size: 1.1MB

.rsrc
Size: 26KB - Virtual size: 26KB