Overview

overview

10

Static

static

10

9255031d4d...e0.exe

windows7-x64

9

9255031d4d...e0.exe

windows10-2004-x64

9

$0/Imagine.chm

windows7-x64

1

$0/Imagine.chm

windows10-2004-x64

1

$0/Imagine.dll

windows7-x64

1

$0/Imagine.dll

windows10-2004-x64

3

$0/Imagine.dll

windows7-x64

1

$0/Imagine.dll

windows10-2004-x64

3

$0/Imagine64.dll

windows7-x64

7

$0/Imagine64.dll

windows10-2004-x64

7

$0/Imagine64.exe

windows7-x64

3

$0/Imagine64.exe

windows10-2004-x64

3

Imagine.chm

windows7-x64

1

Imagine.chm

windows10-2004-x64

1

Imagine.dll

windows7-x64

1

Imagine.dll

windows10-2004-x64

3

Imagine.dll

windows7-x64

1

Imagine.dll

windows10-2004-x64

3

Imagine64.dll

windows7-x64

7

Imagine64.dll

windows10-2004-x64

7

Imagine64.exe

windows7-x64

3

Imagine64.exe

windows10-2004-x64

3

Uninstall.exe

windows7-x64

9

Uninstall.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    9255031d4deb9fd48e07231839e72ae5ce6120cd42270dd36cf2bb2a0c4316e0

  • Size

    1.3MB

  • MD5

    32ab6abe50b22a5b53d63890f2ae442d

  • SHA1

    9f96ce567c11439e82d3d646a21e969329141297

  • SHA256

    9255031d4deb9fd48e07231839e72ae5ce6120cd42270dd36cf2bb2a0c4316e0

  • SHA512

    0621be4af4644141c0a3f52c2c2e25649646c759a5101d917fe33d1e11462461634a327f1a8984fdfb520b715f6d8e32f089541c9452a115af8b2e0c4589b7f0

  • SSDEEP

    24576:wH40AALCADBZ8aB3OySTlaYTSjCL+zXEFNLD1P4AzmBPrEH7Q:opDB2G36xh2jCGXC1PFAl

Score
10/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • 9255031d4deb9fd48e07231839e72ae5ce6120cd42270dd36cf2bb2a0c4316e0
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $0/Imagine.chm
    .chm
  • $0/Imagine.wcx64
    .dll windows:4 windows x64 arch:x64

    5d63995d1bd61b212e35a61ebc32711a


    Headers

    Imports

    Exports

    Sections

  • $0/Imagine.wlx64
    .dll windows:4 windows x64 arch:x64

    a9ff84b50e81c54cd824f51e791b269f


    Headers

    Imports

    Exports

    Sections

  • $0/Imagine64.dll
    .dll regsvr32 windows:4 windows x64 arch:x64

    8517ddc005d3dafa049bc22910271f4b


    Headers

    Imports

    Exports

    Sections

  • $0/Imagine64.exe
    .exe windows:4 windows x64 arch:x64

    e29677b72fd207f54336f6b953c487d4


    Headers

    Imports

    Sections

  • $0/Language/Arabic.lng
  • $0/Language/Belarusian.lng
  • $0/Language/Bulgarian.lng
  • $0/Language/Croatian.lng
  • $0/Language/Czech.lng
  • $0/Language/Danish.lng
  • $0/Language/Estonian.lng
  • $0/Language/French.lng
  • $0/Language/German.lng
  • $0/Language/Hungarian.lng
  • $0/Language/Italiano.lng
  • $0/Language/Japanese.lng
  • $0/Language/Korean.lng
  • $0/Language/Nederlands.lng
  • $0/Language/Polish.lng
  • $0/Language/Portuguese (Brazil).lng
  • $0/Language/Portuguese (Portugal).lng
  • $0/Language/Romanian.lng
  • $0/Language/Russian.lng
  • $0/Language/SimplifiedChinese.lng
  • $0/Language/Slovenian.lng
  • $0/Language/Spanish.lng
  • $0/Language/Svenska.lng
  • $0/Language/TraditionalChinese.lng
  • $0/Language/Turkish.lng
  • $0/Language/Ukrainian.lng
  • $0/Language/Uzbek (O'zbekcha).lng
  • $0/PlugInst.inf
  • $0/Plugin/dir.txt
  • $0/Readme.txt
  • $0/Whatsnew.txt
  • Imagine.chm
    .chm
  • Imagine.wcx64
    .dll windows:4 windows x64 arch:x64

    5d63995d1bd61b212e35a61ebc32711a


    Headers

    Imports

    Exports

    Sections

  • Imagine.wlx64
    .dll windows:4 windows x64 arch:x64

    a9ff84b50e81c54cd824f51e791b269f


    Headers

    Imports

    Exports

    Sections

  • Imagine64.dll
    .dll regsvr32 windows:4 windows x64 arch:x64

    8517ddc005d3dafa049bc22910271f4b


    Headers

    Imports

    Exports

    Sections

  • Imagine64.exe
    .exe windows:4 windows x64 arch:x64

    e29677b72fd207f54336f6b953c487d4


    Headers

    Imports

    Sections

  • Language/Arabic.lng
  • Language/Belarusian.lng
  • Language/Bulgarian.lng
  • Language/Croatian.lng
  • Language/Czech.lng
  • Language/Danish.lng
  • Language/Estonian.lng
  • Language/French.lng
  • Language/German.lng
  • Language/Hungarian.lng
  • Language/Italiano.lng
  • Language/Japanese.lng
  • Language/Korean.lng
  • Language/Nederlands.lng
  • Language/Polish.lng
  • Language/Portuguese (Brazil).lng
  • Language/Portuguese (Portugal).lng
  • Language/Romanian.lng
  • Language/Russian.lng
  • Language/SimplifiedChinese.lng
  • Language/Slovenian.lng
  • Language/Spanish.lng
  • Language/Svenska.lng
  • Language/TraditionalChinese.lng
  • Language/Turkish.lng
  • Language/Ukrainian.lng
  • Language/Uzbek (O'zbekcha).lng
  • PlugInst.inf
  • Plugin/dir.txt
  • Readme.txt
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Whatsnew.txt