General

  • Target

    www.exe

  • Size

    7.3MB

  • MD5

    d67d29dfc872a069a1f6fe7eec57becb

  • SHA1

    e47cf8238cfb8aa1012e5de1e44d46b23d867f97

  • SHA256

    72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5

  • SHA512

    8302ebb02d97800dc6495101129930606a65096556b1d004b94d757a31d0c8935edca87d072d8c0059c055203bead0a2d59a0cf7150f6f954b0be0bfc9849dc7

  • SSDEEP

    196608:ip8HWcQHIEwwLeowyyYqjNct2TW/rQk6CN1VayQUoD:xHWcKI3f8gN7TW/0k6CN1VWtD

Malware Config

Signatures

  • AmmyyAdmin payload 1 IoCs
  • Ammyyadmin family
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • www.exe
    .zip
  • __MACOSX/._test
  • __MACOSX/test/._.DS_Store
  • __MACOSX/test/._0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
  • __MACOSX/test/._0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
  • __MACOSX/test/._91B5DB3C0CCBD68BD04C24571E27F99D.msi
  • __MACOSX/test/._ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
  • __MACOSX/test/._fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
  • test/.DS_Store
  • test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
    .doc windows office2003

    ThisDocument

    ulwMK8UL

    hCxOn1

    ZP5AW

    f

  • test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
    .doc windows office2003

    pXirGKdhzK

    jwCWVLSqL

  • test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
    .msi .vbs polyglot
  • test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
    .exe windows:4 windows x86 arch:x86

    68f013d7437aa653a8a98a05807afeb1


    Headers

    Imports

    Sections

  • test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
    .exe windows:4 windows x86 arch:x86

    b78ecf47c0a3e24a6f4af114e2d1f5de


    Headers

    Imports

    Sections

  • $APPDATA/Wlanspeed/outst.exe
    .exe windows:4 windows x86 arch:x86

    4ce37a90a9a2fd90fcd2a0db88d60601


    Headers

    Imports

    Sections

  • $APPDATA/Wlanspeed/wlanspeed.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/INetC.dll
    .dll windows:4 windows x86 arch:x86

    8ef3613e48db9e7b48e33704238cd659


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    46f8b6973f33717335c0f6d8087de67b


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/SinTech/TextEdit.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PROGRAMFILES/SinTech/TextEdit.exe.config