General

  • Target

    MDE_File_Sample_7c22c2b417f8f11ad1c5da88ee2efcc2961b736d.zip

  • Size

    29.1MB

  • MD5

    1b978fd85ad6f819eb5555fffabf4534

  • SHA1

    bf317ab3cf21a1515d41a789c314c86344a67859

  • SHA256

    53a6d790e8a58f2a59160fa3b3c31c19453e7ceb5fc8464ac593d1317f46b18e

  • SHA512

    8e0e28add01540ff12030a940cfc980e166006ea0f440b28191cdc46b72cc7155b52ecf3ec9e35cd316876fb39db82213c1ce9db7e51f1312168fd5c82743b76

  • SSDEEP

    786432:ItzHXedBhhH2z1cmblic1If8fepdTb/ILTgbXAuITMu:ItzHO/M1cQlic1zfepVbILTPpTMu

Score
3/10

Malware Config

Signatures

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • MDE_File_Sample_7c22c2b417f8f11ad1c5da88ee2efcc2961b736d.zip
    .zip

    Password: infected

  • Setup_ePageSaferRT.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MaImgsfCheck.dll
    .dll windows:5 windows x86 arch:x86

    e6aba0589b3fc0814152fdc5f764763d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MaPlugins.dll
    .dll windows:4 windows x86 arch:x86

    ccb5551397ee1b5618670144128fb2dd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsJSON.dll
    .dll windows:6 windows x86 arch:x86

    67cfa491a15c2e6ae037612d4a7ef727


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/$R0
    .dll windows:5 windows x86 arch:x86

    21abfb077456312be06cf37a274cc881


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/Inst_MaEPSBroker.exe
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/MaPlugins.dll
    .dll windows:5 windows x86 arch:x86

    6e49e7de735ce0e12d20ca1bb0162ee0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $R0
    .exe windows:5 windows x86 arch:x86

    a997524d9ef4d7c2dd2c4e244d6458a2


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/markany_ImageSafer.exe
    .exe windows:4 windows x86 arch:x86

    6e7f9a29f2c85394521a08b9f31f6275


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/MaPlugins.dll
    .dll windows:5 windows x86 arch:x86

    9e313197693c09ccbc364fe3ad562a6d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/ImageSAFERSvc.exe
    .exe windows:5 windows x86 arch:x86

    b7595e2389d64616ef929b1110bf24a1


    Code Sign

    Headers

    Imports

    Sections

  • $WINDIR/system32/$R0
    .exe windows:5 windows x86 arch:x86

    b7595e2389d64616ef929b1110bf24a1


    Code Sign

    Headers

    Imports

    Sections

  • $WINDIR/system32/ImageSAFERFilter.dll
    .dll windows:5 windows x86 arch:x86

    0c22f1ef05bbf98cb2d1ad8bbbad4704


    Headers

    Imports

    Sections

  • $WINDIR/system32/ImageSAFERLang.xml
  • $WINDIR/system32/ImageSAFERMessage.exe
    .exe windows:5 windows x86 arch:x86

    aeb857bd71b46876b5223f42b3601fcf


    Headers

    Imports

    Sections

  • $WINDIR/system32/ImageSAFERProcMon.dll
    .dll windows:5 windows x86 arch:x86

    e052a5a1f98545f8ec5cb2f72074a304


    Headers

    Imports

    Sections

  • $WINDIR/system32/ImageSAFERRecovery.exe
    .exe windows:5 windows x86 arch:x86

    1a911ab7aa68b1ea68e5917a27d0e43f


    Headers

    Imports

    Sections

  • $WINDIR/system32/ImgsfProcPolicyForExe.xml
  • $WINDIR/system32/ImgsfprocPolicy.xml