General

  • Target

    mpv triage x64.zip

  • Size

    89.8MB

  • MD5

    06ff379b3f8d0aae9c10e2d675d5f72a

  • SHA1

    b86b4c8410e3963df7d976f81439ef8ff731a89e

  • SHA256

    fe67c0f3606b6da21c4a1df26314a6dc0d45da811449415704416520066cf139

  • SHA512

    ed0f264598b9eeb88ba48e15819f52515cb8956749c87d62649387f722eb45fcb205aed07d628f704737eccd47e81a5fe9f2e17a6fda7534baf211137399e1f1

  • SSDEEP

    1572864:UEb2LGbSOlkS/LxOt0OSsmwfbuKnlzLNpLhtqibbr2i4ikMAyl+LhQUn4QCw1ZYt:X7CM4GwTuElz71cDi7kMECwHa

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/64bit-v3

exe.dropper

https://api.github.com/repos/shinchiro/mpv-winbuild-cmake/releases/latest

exe.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/32bit

exe.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/64bit

exe.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/64bit-v3

exe.dropper

https://github.com/yt-dlp/yt-dlp/releases.atom

exe.dropper

https://yt-dl.org/downloads/latest/youtube-dl.exe

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • mpv triage x64.zip
    .zip
  • mpv triage x64/mpv-x64.zip
    .zip
  • d3dcompiler_43.dll
    .dll windows:10 windows x64 arch:x64

    824d17f150756620b70aa929623006bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • doc/manual.pdf
    .pdf
  • doc/mpbindings.png
    .png
  • ffmpeg.exe
    .exe windows:6 windows x64 arch:x64

    b94d2116a4f068de3d731d0142132a46


    Headers

    Imports

    Exports

    Sections

  • installer/mpv-icon.ico
  • installer/mpv-install.bat
    .bat .vbs
  • installer/mpv-uninstall.bat
  • installer/updater.ps1
    .ps1
  • mpv.com
    .exe windows:6 windows x64 arch:x64

    ff63c33956621b0a953ef1c7dc36616d


    Headers

    Imports

    Sections

  • mpv.exe
    .exe windows:6 windows x64 arch:x64

    23bd48fc28d6200a6f15a60f27d4afa5


    Headers

    Imports

    Exports

    Sections

  • mpv/fonts.conf
    .xml
  • settings.xml
  • updater.bat
  • yt-dlp.exe
    .exe windows:4 windows x64 arch:x64

    3281e2b0a8f23f346e1772f31393bc16


    Headers

    Imports

    Sections

  • __main__.pyc