General

  • Target

    Linux_Reader [PeskTop.com].exe

  • Size

    45.4MB

  • MD5

    3aaaeb01a38da4cb83028ccf035a1d50

  • SHA1

    61fbbb573554e8f888d3e8e8c890df59cb03d446

  • SHA256

    912bb9be529e386605f5155ed2a00c6ac42bd06468f585fd4137e2d337e2ee2d

  • SHA512

    2773c498d456e945930786c157af791e6490e78e5937b04b92c71caf6dd7ffaacad9f7575aabdbb8f394ae83306ed8cff6918c825fb5e4fd5d53d619d2ca3e2a

  • SSDEEP

    786432:RI4AN5fpXc8sfC6Rd7XN0MdYbN910dW1zyA9SuxtxlP0Sl1x3eH:u4C5N2qqN0hZ0U1zyISuxtxVZ1ta

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • Linux_Reader [PeskTop.com].exe
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    ebc2d915841be8afc8fa1ee9f6850960


    Headers

    Imports

    Exports

    Sections

  • DiskInternals Research.ico
  • DiskInternals.Preview.dll
    .exe windows:5 windows x86 arch:x86

    4e65df08a08f1fb10440869399f9d808


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • License.txt
  • LinuxReader.exe
    .exe windows:5 windows x86 arch:x86

    176544273cbd96e8327d45e8556b46dc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LinuxReader64.exe
    .exe windows:5 windows x64 arch:x64

    09cddb0f5e559f4b718f3097f2b3c9c2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe.nsis
  • av/SDL2.dll
    .dll windows:4 windows x86 arch:x86

    907496b88ebc992364a5a4373ee3f21e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/SoundTouch.dll
    .dll windows:4 windows x86 arch:x86

    47c48064dbc000892407135387cfad7a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avcodec-58.dll
    .dll windows:4 windows x86 arch:x86

    cd0a5ed988fad37163c8ee72c4762a70


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avdevice-58.dll
    .dll windows:4 windows x86 arch:x86

    0f2ed6f29fbeb4e03beb0eeb2b3469b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avfilter-7.dll
    .dll windows:4 windows x86 arch:x86

    271f6870a95dccb0d06490dd0ffa6103


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avformat-58.dll
    .dll windows:4 windows x86 arch:x86

    89915f8168713efa6372bd1964165acb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avutil-56.dll
    .dll windows:4 windows x86 arch:x86

    483bbb94eef2f764360d3c98297ea267


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/swresample-3.dll
    .dll windows:4 windows x86 arch:x86

    9ad731d37d3ea2f838d63d288fa8c273


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/swscale-5.dll
    .dll windows:4 windows x86 arch:x86

    4545c0140d8a26dbcf1e58ac66be2d47


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • b64.dll
    .dll windows:6 windows x64 arch:x64

    bcf0c2f3d39c34f50899f10439f86703


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cbfs.cab
    .cab
  • cbfsconnectevtmsg.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • i386/SHA1/cbfsconnect2017.sys
    .sys windows:6 windows x86 arch:x86

    5d28e7aceab7e2ae7853d717a86cee9c


    Code Sign

    Headers

    Imports

    Sections

  • i386/SHA1/vpnpbus.cat
  • i386/SHA1/vpnpbus.inf
  • i386/SHA1/vpnpbus.sys
    .sys windows:6 windows x86 arch:x86

    b0da1bc6851e0bc1f3c297f207acc85b


    Code Sign

    Headers

    Imports

    Sections

  • i386/cbfsconnect2017.sys
    .sys windows:6 windows x86 arch:x86

    5d28e7aceab7e2ae7853d717a86cee9c


    Code Sign

    Headers

    Imports

    Sections

  • i386/cbfsconnectMntNtf2017.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    bacbf68d798faeba4ee2e76f30d65fdc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • i386/cbfsconnectNetRdr2017.dll
    .dll windows:5 windows x86 arch:x86

    2b81fb4b58098cec4efe46553a5da16e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • i386/vpnpbus.cat
  • i386/vpnpbus.inf
  • i386/vpnpbus.sys
    .sys windows:6 windows x86 arch:x86

    b0da1bc6851e0bc1f3c297f207acc85b


    Code Sign

    Headers

    Imports

    Sections

  • ia64/SHA1/cbfsconnect2017.sys
  • ia64/SHA1/vpnpbus.cat
  • ia64/SHA1/vpnpbus.inf
  • ia64/SHA1/vpnpbus.sys
  • ia64/cbfsconnectMntNtf2017.dll
  • ia64/cbfsconnectNetRdr2017.dll
  • wow64sup.exe
    .exe windows:5 windows x64 arch:x64

    2883b16fadf02f033c0bb617ed7b8030


    Code Sign

    Headers

    Imports

    Sections

  • x64/SHA1/cbfsconnect2017.sys
    .sys windows:6 windows x64 arch:x64

    02ede98ea4c0581568dcadee85bd5e94


    Code Sign

    Headers

    Imports

    Sections

  • x64/SHA1/vpnpbus.cat
  • x64/SHA1/vpnpbus.inf
  • x64/SHA1/vpnpbus.sys
    .sys windows:6 windows x64 arch:x64

    c6197237988fbc167f360d26ca736f7c


    Code Sign

    Headers

    Imports

    Sections

  • x64/cbfsconnect2017.sys
    .sys windows:6 windows x64 arch:x64

    02ede98ea4c0581568dcadee85bd5e94


    Code Sign

    Headers

    Imports

    Sections

  • x64/cbfsconnectMntNtf2017.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    320a9c93f519f83dd2b9d2c5f85044e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/cbfsconnectNetRdr2017.dll
    .dll windows:5 windows x64 arch:x64

    411249db573fa4cd403ea4fc200a9321


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/vpnpbus.cat
  • x64/vpnpbus.inf
  • x64/vpnpbus.sys
    .sys windows:6 windows x64 arch:x64

    c6197237988fbc167f360d26ca736f7c


    Code Sign

    Headers

    Imports

    Sections

  • cbfs64.dll
    .dll windows:5 windows x64 arch:x64

    5d74610b714e149e647f4740c17a33f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fat12.dll
    .dll windows:5 windows x86 arch:x86

    4d16433f8cba350153114f9a47c0f85f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fat16.dll
    .dll windows:5 windows x64 arch:x64

    6f82bfce659ea15e1597d479240032b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fsm.ini
  • help.chm
    .chm
  • ippcp.dll
    .dll windows:6 windows x64 arch:x64

    07b48281775ec08a0602a20a04cfc132


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • jt.dll
    .dll windows:5 windows x86 arch:x86

    fa19e76d26017b15d845e5fffdf92290


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libraw.dll
    .dll windows:5 windows x86 arch:x86

    9047f2776af334f6d428227d3eedc138


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nas32.dll
    .dll windows:6 windows x86 arch:x86

    c09772544c19d690442a3f7954078cd9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nas64.dll
    .dll windows:6 windows x64 arch:x64

    87b12ced34dd62d8eca9e2880b38b414


    Code Sign

    Headers

    Imports

    Exports

    Sections