Resubmissions

05/05/2024, 11:09

240505-m9cwnsgb7v 8

General

  • Target

    $RYYZLFA.exe

  • Size

    16.2MB

  • MD5

    2200a17ff232c6487ff86c2a4f1b1008

  • SHA1

    7e9b3b790717af8a2a168e278d3d6d7a25769495

  • SHA256

    83de3d35f8e1d37a48c48051027f791adf1627a6e9c356c926cc6a17b8a9e1b7

  • SHA512

    4f01267d6f57b7635054de5ffd5d5c49ae9cd0625f43315e20956babdb142587d9161044cab38f389c5cd623114fcfd7c70206ed9878a4a3abb4a2bf51ab5150

  • SSDEEP

    393216:62Ukj/b+TxPQpiQH3l9/pFnk482YmYC+SsSkJ8:ee/b+RhMIIYmYpSo8

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • $RYYZLFA.exe
    .exe windows:5 windows x86 arch:x86

    bd0641e21b10edfc0a54866bde1ee66c


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $TEMP/Setup.exe
    .exe windows:5 windows x86 arch:x86

    bd0641e21b10edfc0a54866bde1ee66c


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/winhttp.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    86660019029121b29ff1b3398c0c83d4


    Headers

    Imports

    Exports

    Sections

  • $TEMP/Origin.exe
    .exe windows:5 windows x86 arch:x86

    ea492bfca8d10d16b4aa9b84e17b834d


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/OriginUninstall.exe
    .exe windows:5 windows x86 arch:x86

    bd0641e21b10edfc0a54866bde1ee66c


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $TEMP/installerdll$_16_.dll
    .dll windows:5 windows x86 arch:x86

    fe88e6ef81ce0daaa7072aee91a875a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/WindowsInstaller-KB893803-v2-x86.exe
    .exe windows:6 windows x86 arch:x86

    f676e16c67a815430fbcd6d520ece6e4


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/installerdll$_16_.dll
    .dll windows:5 windows x86 arch:x86

    fe88e6ef81ce0daaa7072aee91a875a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/rootsupd.exe
    .exe windows:5 windows x86 arch:x86

    1494de9b53e05fc1f40cb92afbdd6ce4


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/vcredist_x64.exe
    .exe windows:5 windows x86 arch:x86

    a1f6f100bff4507a3332f3f0cdfc24f5


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/vcredist_x86.exe
    .exe windows:5 windows x86 arch:x86

    a1f6f100bff4507a3332f3f0cdfc24f5


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/installerdll$_16_.dll
    .dll windows:5 windows x86 arch:x86

    fe88e6ef81ce0daaa7072aee91a875a7


    Code Sign

    Headers

    Imports

    Exports

    Sections