General

  • Target

    Setup Korg M1.exe

  • Size

    114.8MB

  • MD5

    b2d042ded80b90b1f9724a9a6a1f362b

  • SHA1

    654eda380cd0e1874f67dbf634585761dd2f5740

  • SHA256

    3ddfec84a1abfc54d7cbfd63e23822cfbac1e5beae946418740621ccbeaea50b

  • SHA512

    f13bf5e061710a73117e5d96bbb557ff2b7af1789fc73b47d5fbecee0d3775e638f9e01a26045cf1e9ef5c016822b8300ddba91053cf285284c674ead17b4e1f

  • SSDEEP

    3145728:ER8dlUCfOAV9+Q6Eix+nh70ID+6DYHz6yuhR5gOdRR3j:ipyOGspEXhgIS0ByOdRBj

Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

  • Unsigned PE 33 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • Setup Korg M1.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $APPDATA/KORG/LegacyCell/LegacyCell.cmap
    .xml
  • $APPDATA/KORG/LegacyCell/LegacyCell.fxb
  • $APPDATA/KORG/LegacyCell/LegacyCell_B.fxb
  • $APPDATA/KORG/LegacyCell/LegacyCell_Init.fxb
  • $APPDATA/KORG/M1/M1.cmap
  • $APPDATA/KORG/M1/M1.fxb
  • $APPDATA/KORG/MDE-X/MDE-X.fxb
  • $APPDATA/KORG/MDE-X/MDE-X_Init.fxb
  • $APPDATA/KORG/MS-20/MS-20.cmap
  • $APPDATA/KORG/MS-20/MS-20.fxb
  • $APPDATA/KORG/MS-20/MS-20FX.fxb
  • $APPDATA/KORG/MS-20/MS-20_Init.fxb
  • $APPDATA/KORG/MS-20/MS-20_v100.fxb
  • $APPDATA/KORG/MonoPoly/MonoPoly.cmap
  • $APPDATA/KORG/MonoPoly/MonoPoly.fxb
  • $APPDATA/KORG/MonoPoly/MonoPoly_Init.fxb
  • $APPDATA/KORG/Polysix/Polysix.cmap
  • $APPDATA/KORG/Polysix/Polysix.fxb
  • $APPDATA/KORG/Polysix/Polysix_Init.fxb
  • $APPDATA/KORG/WAVESTATION/WAVESTATION.fxb
  • $APPDATA/KORG/WAVESTATION/WAVESTATION_Init.fxb
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/LegacyCell RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/LegacyCell RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/M1 RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/M1 RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MDE-X RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MDE-X RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MS-20 RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MS-20 RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MS-20FX RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MS-20FX RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MonoPoly RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/MonoPoly RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/Polysix RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/Polysix RTAS.dpm.rsr
  • $COMMONFILES/Digidesign/DAE/Plug-Ins/WAVESTATION RTAS.dpm
    .dll windows:4 windows x86 arch:x86

    b0482b59534b2eb8477ac076d7c782f0


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Digidesign/DAE/Plug-Ins/WAVESTATION RTAS.dpm.rsr
  • $COMMONFILES/KORG/LegacyCell/LegacyCell RTAS.nfo
  • $COMMONFILES/KORG/LegacyCell/LegacyCell VST.nfo
  • $COMMONFILES/KORG/LegacyCell/LegacyCell.nfo
  • $COMMONFILES/KORG/M1/M1 RTAS.nfo
  • $COMMONFILES/KORG/M1/M1 VST.nfo
  • $COMMONFILES/KORG/M1/M1.nfo
  • $COMMONFILES/KORG/M1/m1ex.dat
  • $COMMONFILES/KORG/MDE-X/MDE-X RTAS.nfo
  • $COMMONFILES/KORG/MDE-X/MDE-X VST.nfo
  • $COMMONFILES/KORG/MDE-X/MDE-X.nfo
  • $COMMONFILES/KORG/MS-20/MS-20 RTAS.nfo
  • $COMMONFILES/KORG/MS-20/MS-20 VST.nfo
  • $COMMONFILES/KORG/MS-20/MS-20.nfo
  • $COMMONFILES/KORG/MS-20FX/MS-20FX RTAS.nfo
  • $COMMONFILES/KORG/MS-20FX/MS-20FX VST.nfo
  • $COMMONFILES/KORG/MS-20FX/MS-20FX.nfo
  • $COMMONFILES/KORG/MonoPoly/MonoPoly RTAS.nfo
  • $COMMONFILES/KORG/MonoPoly/MonoPoly VST.nfo
  • $COMMONFILES/KORG/MonoPoly/MonoPoly.nfo
  • $COMMONFILES/KORG/Plug-Ins/VST/LegacyCell.dll
    .dll windows:4 windows x86 arch:x86

    b37a43b1d7a25de860f19f339513a88a


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/LegacyCell.dll.settings
    .xml
  • $COMMONFILES/KORG/Plug-Ins/VST/M1.dll
    .dll windows:4 windows x86 arch:x86

    21a15d33a989293a252ce782e5c4fde1


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/MDE-X.dll
    .dll windows:4 windows x86 arch:x86

    0f06ed9bb0a031153a008c62349c7ae3


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/MS-20.dll
    .dll windows:4 windows x86 arch:x86

    292d7fbb14e950b1afa047be33512323


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/MS-20FX.dll
    .dll windows:4 windows x86 arch:x86

    45b5f2fd3b891c1ffd36ced0a0aca3d2


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/MidiFilter.dll
    .dll windows:4 windows x86 arch:x86

    7f246dc61add8d0fc6a11fa00ed8976c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/MonoPoly.dll
    .dll windows:4 windows x86 arch:x86

    e8b75aa9336cce648bb980de0ff76bdc


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/Polysix.dll
    .dll windows:4 windows x86 arch:x86

    6c42c87a36dbac98864034f3cf05032a


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/WAVESTATION.dll
    .dll windows:4 windows x86 arch:x86

    3166572d6524cb3363f2a1541f08717f


    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/mixer1.dll
    .dll windows:4 windows x86 arch:x86

    f02edc25bd6e87ecaeb7266f15ce7271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/mixer2.dll
    .dll windows:4 windows x86 arch:x86

    f02edc25bd6e87ecaeb7266f15ce7271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Plug-Ins/VST/mixer3.dll
    .dll windows:4 windows x86 arch:x86

    f02edc25bd6e87ecaeb7266f15ce7271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/KORG/Polysix/Polysix RTAS.nfo
  • $COMMONFILES/KORG/Polysix/Polysix VST.nfo
  • $COMMONFILES/KORG/Polysix/Polysix.nfo
  • $COMMONFILES/KORG/WAVESTATION/WAVESTATION RTAS.nfo
  • $COMMONFILES/KORG/WAVESTATION/WAVESTATION VST.nfo
  • $COMMONFILES/KORG/WAVESTATION/WAVESTATION.nfo
  • $COMMONFILES/KORG/WAVESTATION/wsdatex
  • $PLUGINSDIR/AdvSplash.dll
    .dll windows:4 windows x86 arch:x86

    741b6bafe355b63a372d737b30543a95


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Bass.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/GetVersion.dll
    .dll windows:5 windows x86 arch:x86

    fb1aa2bbc159c94cb45792330366bd5f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll
    .dll windows:4 windows x86 arch:x86

    8a595235c826f2ae0f0362f688723bd0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bass.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/dat_bgm.ogg
  • $PLUGINSDIR/dat_skin.skf
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/splash.bmp
  • Documentation/KLC_AE07_OM_E1.pdf
    .pdf
  • Documentation/KLC_AE07_OM_J1.pdf
    .pdf
  • Documentation/KLC_M1_E1.pdf
    .pdf
  • Documentation/KLC_M1_J1.pdf
    .pdf
  • Documentation/KLC_M1_QuickGuide_E1.pdf
    .pdf
  • Documentation/KLC_M1_QuickGuide_J1.pdf
    .pdf
  • Documentation/KLC_MDE-X_E1.pdf
    .pdf
  • Documentation/KLC_MDE-X_J1.pdf
    .pdf
  • Documentation/KLC_MonoPoly_OM_E1.pdf
    .pdf
  • Documentation/KLC_MonoPoly_OM_J1.pdf
    .pdf
  • Documentation/ReadMe LegacyCell(E).rtf
    .rtf
  • Documentation/ReadMe LegacyCell(J).rtf
    .rtf
  • Documentation/ReadMe M1(E).rtf
    .rtf
  • Documentation/ReadMe M1(J).rtf
    .rtf
  • Documentation/ReadMe MDE-X(E).rtf
    .rtf
  • Documentation/ReadMe MDE-X(J).rtf
    .rtf
  • Documentation/ReadMe MS-20(E).rtf
    .rtf
  • Documentation/ReadMe MS-20(J).rtf
    .rtf
  • Documentation/ReadMe MonoPoly(E).rtf
    .rtf
  • Documentation/ReadMe MonoPoly(J).rtf
    .rtf
  • Documentation/ReadMe Polysix(E).rtf
    .rtf
  • Documentation/ReadMe Polysix(J).rtf
    .rtf
  • Documentation/ReadMe WAVESTATION(E).rtf
    .rtf
  • Documentation/ReadMe WAVESTATION(J).rtf
    .rtf
  • Documentation/WAVESTATION_E1.pdf
    .pdf
  • Documentation/WAVESTATION_J1.pdf
    .pdf
  • Documentation/WS_v110_E1.pdf
    .pdf
  • Documentation/WS_v110_J1.pdf
    .pdf
  • LegacyCell.dll
    .dll windows:4 windows x86 arch:x86

    b37a43b1d7a25de860f19f339513a88a


    Headers

    Imports

    Exports

    Sections

  • LegacyCell.dll.settings
    .xml
  • LegacyCell.exe
    .exe windows:4 windows x86 arch:x86

    a867b434e7a7e01871dabadf5a81194f


    Code Sign

    Headers

    Imports

    Sections

  • M1.dll
    .dll windows:4 windows x86 arch:x86

    21a15d33a989293a252ce782e5c4fde1


    Headers

    Imports

    Exports

    Sections

  • M1.exe
    .exe windows:4 windows x86 arch:x86

    d837a42e8295dd60bc22c9e883fffe0b


    Code Sign

    Headers

    Imports

    Sections

  • MDE-X.dll
    .dll windows:4 windows x86 arch:x86

    0f06ed9bb0a031153a008c62349c7ae3


    Headers

    Imports

    Exports

    Sections

  • MS-20.dll
    .dll windows:4 windows x86 arch:x86

    292d7fbb14e950b1afa047be33512323


    Headers

    Imports

    Exports

    Sections

  • MS-20.exe
    .exe windows:4 windows x86 arch:x86

    d837a42e8295dd60bc22c9e883fffe0b


    Code Sign

    Headers

    Imports

    Sections

  • MS-20FX.dll
    .dll windows:4 windows x86 arch:x86

    45b5f2fd3b891c1ffd36ced0a0aca3d2


    Headers

    Imports

    Exports

    Sections

  • MidiFilter.dll
    .dll windows:4 windows x86 arch:x86

    7f246dc61add8d0fc6a11fa00ed8976c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MonoPoly.dll
    .dll windows:4 windows x86 arch:x86

    e8b75aa9336cce648bb980de0ff76bdc


    Headers

    Imports

    Exports

    Sections

  • MonoPoly.exe
    .exe windows:4 windows x86 arch:x86

    d837a42e8295dd60bc22c9e883fffe0b


    Code Sign

    Headers

    Imports

    Sections

  • Polysix.dll
    .dll windows:4 windows x86 arch:x86

    6c42c87a36dbac98864034f3cf05032a


    Headers

    Imports

    Exports

    Sections

  • Polysix.exe
    .exe windows:4 windows x86 arch:x86

    d837a42e8295dd60bc22c9e883fffe0b


    Code Sign

    Headers

    Imports

    Sections

  • Presets/LegacyCell.cmap
    .xml
  • Presets/LegacyCell.fxb
  • Presets/LegacyCell_B.fxb
  • Presets/LegacyCell_Init.fxb
  • Presets/M1.cmap
  • Presets/M1.fxb
  • Presets/MDE-X.fxb
  • Presets/MDE-X_Init.fxb
  • Presets/MS-20.cmap
  • Presets/MS-20.fxb
  • Presets/MS-20FX.fxb
  • Presets/MS-20_Init.fxb
  • Presets/MS-20_v100.fxb
  • Presets/MonoPoly.cmap
  • Presets/MonoPoly.fxb
  • Presets/MonoPoly_Init.fxb
  • Presets/Polysix.cmap
  • Presets/Polysix.fxb
  • Presets/Polysix_Init.fxb
  • Presets/WAVESTATION.fxb
  • Presets/WAVESTATION_Init.fxb
  • WAVESTATION.dll
    .dll windows:4 windows x86 arch:x86

    3166572d6524cb3363f2a1541f08717f


    Headers

    Imports

    Exports

    Sections

  • WAVESTATION.exe
    .exe windows:4 windows x86 arch:x86

    d837a42e8295dd60bc22c9e883fffe0b


    Code Sign

    Headers

    Imports

    Sections

  • audioio/asio.dll
    .dll windows:4 windows x86 arch:x86

    ea16822f474d9614a64b8a685e3da5c7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • audioio/directsound.dll
    .dll windows:4 windows x86 arch:x86

    22e448dca3a568aea558f76215492c62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • audioio/mme.dll
    .dll windows:4 windows x86 arch:x86

    be3ed2ebd9b6dc2952b39e627a0365b1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • language/Legacy1041.dll
    .dll windows:4 windows x86 arch:x86

    b15f50e3f2711e0feb9b6d0b6f0258b5


    Code Sign

    Headers

    Imports

    Sections

  • language/default.dll
    .dll windows:4 windows x86 arch:x86

    b15f50e3f2711e0feb9b6d0b6f0258b5


    Code Sign

    Headers

    Imports

    Sections

  • mixer1.dll
    .dll windows:4 windows x86 arch:x86

    f02edc25bd6e87ecaeb7266f15ce7271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • mixer2.dll
    .dll windows:4 windows x86 arch:x86

    f02edc25bd6e87ecaeb7266f15ce7271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • mixer3.dll
    .dll windows:4 windows x86 arch:x86

    f02edc25bd6e87ecaeb7266f15ce7271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections