General

  • Target

    Linux_Reader.exe

  • Size

    45.6MB

  • MD5

    031ce2c768df85d9fc82827f0b9c3508

  • SHA1

    f3e6a87036f09a2177998bb6c46ae055dffa643c

  • SHA256

    993747df365a3202a2ed38ffe2117919ef31134f2b7e94b43fc6ccfe22cc5972

  • SHA512

    404a8484eb89c4af786c0bfd16f2bcb0a91aa48f0ada2f6db50922a8c2cdf03167857c5c01de4fc4f4f289fb154e1575d864064a03d5354eaffba6cc462a2c02

  • SSDEEP

    786432:gxHLXJ0Jv4YnX7uzPvBIWZnZMhI0Au1kp5tbuIH05iO8ta1zyA9SuxtxlP0Sl1xP:gNXqJv1X7cxI+ZXEWFuk05D8ta1zyISI

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Linux_Reader.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • DiskInternals Research.ico
  • DiskInternals.Preview.dll
    .exe windows:5 windows x86 arch:x86

    4e65df08a08f1fb10440869399f9d808


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • License.txt
  • LinuxReader.exe
    .exe windows:5 windows x86 arch:x86

    176544273cbd96e8327d45e8556b46dc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LinuxReader64.exe
    .exe windows:5 windows x64 arch:x64

    09cddb0f5e559f4b718f3097f2b3c9c2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe.nsis
  • av/SDL2.dll
    .dll windows:4 windows x86 arch:x86

    907496b88ebc992364a5a4373ee3f21e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/SoundTouch.dll
    .dll windows:4 windows x86 arch:x86

    47c48064dbc000892407135387cfad7a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avcodec-58.dll
    .dll windows:4 windows x86 arch:x86

    cd0a5ed988fad37163c8ee72c4762a70


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avdevice-58.dll
    .dll windows:4 windows x86 arch:x86

    0f2ed6f29fbeb4e03beb0eeb2b3469b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avfilter-7.dll
    .dll windows:4 windows x86 arch:x86

    271f6870a95dccb0d06490dd0ffa6103


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avformat-58.dll
    .dll windows:4 windows x86 arch:x86

    89915f8168713efa6372bd1964165acb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avutil-56.dll
    .dll windows:4 windows x86 arch:x86

    483bbb94eef2f764360d3c98297ea267


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/swresample-3.dll
    .dll windows:4 windows x86 arch:x86

    9ad731d37d3ea2f838d63d288fa8c273


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/swscale-5.dll
    .dll windows:4 windows x86 arch:x86

    4545c0140d8a26dbcf1e58ac66be2d47


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • b64.dll
    .dll windows:6 windows x64 arch:x64

    bcf0c2f3d39c34f50899f10439f86703


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cbfs.cab
    .cab
  • cbfsconnectevtmsg.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • i386/SHA1/cbfsconnect2017.sys
    .sys windows:6 windows x86 arch:x86

    5d28e7aceab7e2ae7853d717a86cee9c


    Code Sign

    Headers

    Imports

    Sections

  • i386/SHA1/vpnpbus.cat
  • i386/SHA1/vpnpbus.inf
  • i386/SHA1/vpnpbus.sys
    .sys windows:6 windows x86 arch:x86

    b0da1bc6851e0bc1f3c297f207acc85b


    Code Sign

    Headers

    Imports

    Sections

  • i386/cbfsconnect2017.sys
    .sys windows:6 windows x86 arch:x86

    5d28e7aceab7e2ae7853d717a86cee9c


    Code Sign

    Headers

    Imports

    Sections

  • i386/cbfsconnectMntNtf2017.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    bacbf68d798faeba4ee2e76f30d65fdc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • i386/cbfsconnectNetRdr2017.dll
    .dll windows:5 windows x86 arch:x86

    2b81fb4b58098cec4efe46553a5da16e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • i386/vpnpbus.cat
  • i386/vpnpbus.inf
  • i386/vpnpbus.sys
    .sys windows:6 windows x86 arch:x86

    b0da1bc6851e0bc1f3c297f207acc85b


    Code Sign

    Headers

    Imports

    Sections

  • ia64/SHA1/cbfsconnect2017.sys
  • ia64/SHA1/vpnpbus.cat
  • ia64/SHA1/vpnpbus.inf
  • ia64/SHA1/vpnpbus.sys
  • ia64/cbfsconnectMntNtf2017.dll
  • ia64/cbfsconnectNetRdr2017.dll
  • wow64sup.exe
    .exe windows:5 windows x64 arch:x64

    2883b16fadf02f033c0bb617ed7b8030


    Code Sign

    Headers

    Imports

    Sections

  • x64/SHA1/cbfsconnect2017.sys
    .sys windows:6 windows x64 arch:x64

    02ede98ea4c0581568dcadee85bd5e94


    Code Sign

    Headers

    Imports

    Sections

  • x64/SHA1/vpnpbus.cat
  • x64/SHA1/vpnpbus.inf
  • x64/SHA1/vpnpbus.sys
    .sys windows:6 windows x64 arch:x64

    c6197237988fbc167f360d26ca736f7c


    Code Sign

    Headers

    Imports

    Sections

  • x64/cbfsconnect2017.sys
    .sys windows:6 windows x64 arch:x64

    02ede98ea4c0581568dcadee85bd5e94


    Code Sign

    Headers

    Imports

    Sections

  • x64/cbfsconnectMntNtf2017.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    320a9c93f519f83dd2b9d2c5f85044e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/cbfsconnectNetRdr2017.dll
    .dll windows:5 windows x64 arch:x64

    411249db573fa4cd403ea4fc200a9321


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/vpnpbus.cat
  • x64/vpnpbus.inf
  • x64/vpnpbus.sys
    .sys windows:6 windows x64 arch:x64

    c6197237988fbc167f360d26ca736f7c


    Code Sign

    Headers

    Imports

    Sections

  • cbfs64.dll
    .dll windows:5 windows x64 arch:x64

    5d74610b714e149e647f4740c17a33f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fat12.dll
    .dll windows:5 windows x86 arch:x86

    4d16433f8cba350153114f9a47c0f85f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fat16.dll
    .dll windows:5 windows x64 arch:x64

    6f82bfce659ea15e1597d479240032b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fsm.ini
  • help.chm
    .chm
  • ippcp.dll
    .dll windows:6 windows x64 arch:x64

    07b48281775ec08a0602a20a04cfc132


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • jt.dll
    .dll windows:5 windows x86 arch:x86

    fa19e76d26017b15d845e5fffdf92290


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libraw.dll
    .dll windows:5 windows x86 arch:x86

    9047f2776af334f6d428227d3eedc138


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nas32.dll
    .dll windows:6 windows x86 arch:x86

    c09772544c19d690442a3f7954078cd9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nas64.dll
    .dll windows:6 windows x64 arch:x64

    87b12ced34dd62d8eca9e2880b38b414


    Code Sign

    Headers

    Imports

    Exports

    Sections