General

  • Target

    21f73f50fda8fb7a60f8bd78145c9211ed69a4fa4db02c295d43d5c61abf7dad

  • Size

    8.3MB

  • MD5

    950570c46a9a9abd94b8c96213d70b39

  • SHA1

    cbf12ed0320e3b5e7570000b9992bad3965733ae

  • SHA256

    21f73f50fda8fb7a60f8bd78145c9211ed69a4fa4db02c295d43d5c61abf7dad

  • SHA512

    25d1e26ec0e974f597d4f4c987db7c5ac7db9f6e84b8a4c8f5e2287d9c25856e3ec5fb49376cbe81e03f00d03f07922e257731ae265c474412586308deae6abe

  • SSDEEP

    196608:4vvxKrr12jN7mULFAV0Svcf69m0oncKdGjQ66:4sr6s0kcf6UncKU6

Score
3/10

Malware Config

Signatures

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 21f73f50fda8fb7a60f8bd78145c9211ed69a4fa4db02c295d43d5c61abf7dad
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Code Sign

    Headers

    Imports

    Sections

  • $SYSDIR/ClPolicy.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4a94fd602a0ca3e379cb0b768b7e0690


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/DESKSIGN.DLL
    .dll regsvr32 windows:5 windows x86 arch:x86

    2c342274855a39a76cb393d2797de7c6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/DSTSCl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4e377e5170703319424052c8c850b335


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/DeskDecr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3db5760f87e4837b1e9233af6f16270d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/DeskEncr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    96e84d7759d47fdd34997ed5e3e6fef2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/DeskLicense.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1608927bd5feb23c88224a88a80d482b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/DeskVerf.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a967bc7c5648c9eb0161ad3f387547c2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtCertVal.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    9acecfe7554414a4dce268f5e17b5fa3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtDecr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4b95f5d1774ed51750f95f56482fc9db


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtEncr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8f16718e16a5b5e0fc69f069ffc476c2


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtSign.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    1015350ad5dab65e049e886a05313cd6


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtTransportClient.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    ea540372d80125a8ede5a41c088396f6


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtValVSP.dll
    .dll windows:4 windows x86 arch:x86

    fc04953baa7336a1b1460e70a6c19ef9


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtValutil.dll
    .dll windows:4 windows x86 arch:x86

    09ee4a83b96f504aee22eda8427216cc


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/EtWBUtil.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2ffb630963eacd796dd19e1fd8dcfbe9


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/HTransport.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    013a096e2949d72bb3c91051ea4b39cd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/PDFEncr.dll
    .dll windows:4 windows x86 arch:x86

    0c1cdf6e04f24bd7aed9cfa9e3318221


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/PDFSignVerify.dll
    .dll windows:4 windows x86 arch:x86

    8c11860e4bd2fabd32d4a7b8c4aa3c17


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/TSTOKEN.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cacae478817cc7b552028ac4f0ca1096


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/asnutil.dll
    .dll windows:4 windows x86 arch:x86

    aef4ecf4c2ed7a76dc50d615e0309bc8


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/atl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8ef95172470b9f552734e3fd0e068e7e


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/etidef.dll
    .dll windows:4 windows x86 arch:x86

    202cce0cc1674910bf8d21af2c503aaf


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/etlicense.dll
    .dll windows:4 windows x86 arch:x86

    413c6e64b6a8ee7ef40a0b2a51923c95


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/etnetsign.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9a1f6d91215b39f1e1fe4cbed2b283b6


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp60.dll
    .dll windows:4 windows x86 arch:x86

    1b1839992700df52b049b87961a724e3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcrt.dll
    .dll windows:4 windows x86 arch:x86

    8d26773106ed39fbb89a157d19d8aa89


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/npFBDeskSign.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    9cbfa79a354b112d3700807d8529142d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/uninstall.exe.nsis
  • $SYSDIR/vctoolkit.dll
    .dll windows:4 windows x86 arch:x86

    43698e660b5af692cd0adb7effedafcb


    Headers

    Imports

    Exports

    Sections

  • PDFEnhancerPatch.exe
    .exe windows:4 windows x86 arch:x86

    5a9b89741dd0eb9be8754b41c4d30c55


    Code Sign

    Headers

    Imports

    Sections

  • RegDrv.EXE
    .exe windows:4 windows x86 arch:x86

    79bf9fbce3475beb9a05d2c8db83905e


    Code Sign

    Headers

    Imports

    Sections

  • SignApp.exe
    .exe windows:5 windows x86 arch:x86

    0215275abe0162be88bcc1269e720adb


    Code Sign

    Headers

    Imports

    Sections

  • c.bin
  • enableroots.js
  • install.bat
    .bat .vbs
  • k.bin
  • reg.txt
  • root.bin
  • validate.exe
    .exe windows:4 windows x86 arch:x86

    2224e43fe7816ee17ed85489cd21afd7


    Code Sign

    Headers

    Imports

    Sections

  • vcredist_x86.exe
    .exe windows:5 windows x86 arch:x86

    092eb6daba2f17cbda102fd1a32acd00


    Code Sign

    Headers

    Imports

    Sections