General

  • Target

    dc22ca48da9bee7b1a2b865df4d9a9c5

  • Size

    3.3MB

  • MD5

    dc22ca48da9bee7b1a2b865df4d9a9c5

  • SHA1

    cc54494e28e0b43b37d883d2e6b29dc8fb78dee9

  • SHA256

    3a390671aa1b0bf9bb6fb90cf1243b250ea8f358c0bc556b8723379734e7918d

  • SHA512

    0ed538294c706fcd747e953bc150ce4dab975889defac1bd16cc7fd3d3f1d51fd0db1947da35638d7fed37e9138c96781568f7e8af6f3f2d7fe312df7f5d38a4

  • SSDEEP

    49152:z9Eqr58vFf+4jWMC50tCP36RktzuuTT+pwsdPd5XDv1TDIkXSWa6KPkwgmPm4GtR:mquvK1GtCPRhTT+xdPdlr1/nU9kwRLEj

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 12 IoCs

Files

  • dc22ca48da9bee7b1a2b865df4d9a9c5
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Banner.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Microsoft.VC90.CRT.manifest
  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bundle.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • MainInstaller.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • PingMe.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Setup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    a49b0342971aa199fc6349725b90146d


    Headers

    Imports

    Exports

    Sections

  • 2YourFace.crx
    .zip
  • 2YourFace_Util.dll
    .dll windows:5 windows x86 arch:x86

    c4e2a78dbc9a9da5259408e5bfa37d43


    Headers

    Imports

    Exports

    Sections

  • AddInstall.js
    .js
  • Chrome.pem
  • background.html
    .html .js polyglot
  • manifest.json
  • FF8Installer.exe
    .exe windows:5 windows x86 arch:x86

    21c9a9aca328f35740eb29d062cd9815


    Headers

    Imports

    Sections

  • bho.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    5a8ad9fb5a09fa00ef5edb0f90bc35af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffextension/chrome.manifest
  • ffextension/chrome/content/ff-overlay.js
    .js
  • ffextension/chrome/content/ff-overlay.xul
    .xml
  • ffextension/chrome/content/overlay.js
    .js
  • ffextension/chrome/locale/en-US/overlay.dtd
  • ffextension/chrome/locale/en-US/overlay.properties
  • ffextension/chrome/skin/overlay.css
  • ffextension/defaults/preferences/prefs.js
  • ffextension/install.rdf
    .xml
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • MyBabylonTB.exe
    .exe windows:5 windows x86 arch:x86

    31d1a26c07f1e9296c25e08a0a63385e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/layout.html
    .html .js polyglot
  • $PLUGINSDIR/msvcm90.dll
    .dll windows:5 windows x86 arch:x86

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/tools.dll
    .dll windows:5 windows x86 arch:x86

    1b63fbcb3a1760b366862b3a44b1895b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • FileHunter.exe
    .exe windows:5 windows x86 arch:x86

    d4fea7215cf0fa5c2fd2203c684bc755


    Headers

    Imports

    Sections

  • pumpa.exe
    .exe windows:5 windows x86 arch:x86

    ea31cbdb7a736b79763951a0a9de1201


    Headers

    Imports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections