General

  • Target

    itoolssetup_4.5.1.8.exe

  • Size

    73.8MB

  • MD5

    8d4fd5cb0d4478b3e3a3ea268cd8018e

  • SHA1

    1a7ce6f9a1c48b5f15f7b42f0bec114b9257d68e

  • SHA256

    d0d8c24ae4cd4111296888ef6070fba7f4af3e9a64e9848419cbc3e1a7b4d902

  • SHA512

    48e35c4688e31e6d692cc5e8b46b23ca8bdb907ced3371e1fb64ed14c42d18cc3e73b30488d960a9a7f18c9e8f3ff12b5cd703505ff0378c4169adc4078ca5f5

  • SSDEEP

    1572864:6dXnO5VwNNcXwTrNgY/R/P6FuTy90fTKo0AU6TEeHSXUN7N7NW6kMl/gzQAmHLDz:a3O5GLHNgY/R/GF9OTwINf7N7sCgzQAq

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • itoolssetup_4.5.1.8.exe
    .exe windows:4 windows x86 arch:x86

    1f23f452093b5c1ff091a2f9fb4fa3e9


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    4b45b7e00344a87332fbd12653854d1a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • CrashRpt1403.dll
    .dll windows:6 windows x86 arch:x86

    d5e92449199942a5bee794168e306fad


    Headers

    Imports

    Exports

    Sections

  • CrashSender1403.exe
    .exe windows:5 windows x86 arch:x86

    010dafe7794fed050a26ab096e1a8f8f


    Headers

    Imports

    Sections

  • IVChecker1.dll
    .dll windows:5 windows x86 arch:x86

    a6bc22e715ceae6a7d81bb5b0fca4ca4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SciLexer.dll
    .dll windows:5 windows x86 arch:x86

    5047867916a5ddbff61445bee0b5dddb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Sqlite.dll
    .dll windows:5 windows x86 arch:x86

    c2f8d7cc3b52f66e9033fad8dff30fad


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TSDiag.exe
    .exe windows:5 windows x86 arch:x86

    2b042070740ab2e5ccca29f9db84e777


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TSImgConverter.exe
    .exe windows:5 windows x86 arch:x86

    adb4053f9de5285ee6ec009bf02a9ca0


    Code Sign

    Headers

    Imports

    Sections

  • TSRes.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • WebProcess.exe
    .exe windows:5 windows x86 arch:x86

    25bd99804a3484ffc2ef0329e6a1b8ea


    Code Sign

    Headers

    Imports

    Sections

  • avcodec.dll
    .dll windows:6 windows x86 arch:x86

    91ab340b1fc318114634f9af3986b820


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avdevice.dll
    .dll windows:6 windows x86 arch:x86

    a2c510c9f02e6c754bc0c4e7773982d1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avfilter.dll
    .dll windows:6 windows x86 arch:x86

    bf975d1ef12b1a1233e3fcb214cc5758


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avformat.dll
    .dll windows:6 windows x86 arch:x86

    b81a6d154d7a7377f8086c3eb0530087


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avutil.dll
    .dll windows:6 windows x86 arch:x86

    dc301b7a993392a90f0aead05e09883b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cef.pak
    .js
  • cef_100_percent.pak
  • cef_200_percent.pak
  • cef_extensions.pak
    .js
  • changeLog.txt
  • config.dll
    .dll windows:5 windows x86 arch:x86

    bf8b83cbb5febff0aa4cb0cf70db6cea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • crashrpt_lang.ini
  • d3dcompiler_43.dll
    .dll windows:6 windows x86 arch:x86

    6ba7b0e4e74a8eea96dca4fffc88b859


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • d3dcompiler_47.dll
    .dll windows:6 windows x86 arch:x86

    f63cad154afed6da772d0ab361f448f6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • deviceContent.dll
    .dll windows:5 windows x86 arch:x86

    9fc7091f79218fef42c97a13b50ba7ba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • deviceRestore.dll
    .dll windows:6 windows x86 arch:x86

    c6c81c93a7830fd405fdf967ce5c646b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • downloader.dll
    .dll windows:5 windows x86 arch:x86

    13ba652712dceacda88d5754022fc52d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • globalinterface.dll
    .dll windows:5 windows x86 arch:x86

    1a4ecae14fb14429f13bb62d5cbcb754


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • iOSDevice.dll
    .dll windows:5 windows x86 arch:x86

    cd4f844a5b6c637b346f8295127618c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • iTools4.exe
    .exe windows:5 windows x86 arch:x86

    e97b417f866db052ac94340e6d34722a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • iToolsDataTransfer.exe
    .exe windows:5 windows x86 arch:x86

    7808a118ab4637830e0d181210d5fbd2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • iTunesAssist.dll
    .dll windows:5 windows x86 arch:x86

    db971bf97d7c19775fc4dcdc11355a48


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • imgdecoder-gdip.dll
    .dll windows:6 windows x86 arch:x86

    7360473f3a9a540b67f9e96033435233


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • leptonica-1.76.0.dll
    .dll windows:5 windows x86 arch:x86

    3453404ff9024a0322767b69bdae631b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libEGL.dll
    .dll windows:5 windows x86 arch:x86

    b4e96300df78e55f6b93e447dc209782


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x86 arch:x86

    d965d87567563d5be903d8a8b1ea467c


    Headers

    Imports

    Exports

    Sections

  • libcef.dll
    .dll windows:5 windows x86 arch:x86

    5def35a2962962542a955a2d5de8186c


    Headers

    Imports

    Exports

    Sections

  • libcrypto-1_1.dll
    .dll windows:6 windows x86 arch:x86

    8c0767be991db4f5e9bd67fff379c857


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libcurl.dll
    .dll windows:6 windows x86 arch:x86

    44144dff82b607bfc945507111e54bfd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libdownloadimpl.dll
    .dll windows:4 windows x86 arch:x86

    c755bd073f2a00b17eec53057e011d64


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libgcc_s_sjlj-1.dll
    .dll windows:4 windows x86 arch:x86

    67046ace007d27bb6b8f72db46c226fc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libssl-1_1.dll
    .dll windows:6 windows x86 arch:x86

    d56c05400c07a18e2a93ff1f9e040e81


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86

    29c560ed8b52308c683ea30ee7916b96


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • license.txt
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • modelCore.dll
    .dll windows:5 windows x86 arch:x86

    79d2241cee4c3f19865a9752fb2c9768


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp120.dll
    .dll windows:6 windows x86 arch:x86

    6ccda270a497a2c5a36a7f385cc9910d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • natives_blob.bin
    .js
  • postproc.dll
    .dll windows:6 windows x86 arch:x86

    a25b0750769ceaa5f460d6dca92b0b1f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • render-gdi.dll
    .dll windows:6 windows x86 arch:x86

    4f9a3c8eac7a7990ec78e1c06c0ea092


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • snapshot_blob.bin
  • soui-sys-resource.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • soui.dll
    .dll windows:5 windows x86 arch:x86

    c30a7119ed711491765bc7daaff3f3ff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • swresample.dll
    .dll windows:6 windows x86 arch:x86

    d8a9f4aed93b1153d6514703c312f961


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • swscale.dll
    .dll windows:6 windows x86 arch:x86

    828b4c3c7436ff4ea888716277add0d8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • tessdata/chi_tra.traineddata
  • tessdata/chi_tra.user-words
  • tessdata/configs/ambigs.train
  • tessdata/configs/api_config
  • tessdata/configs/bigram
  • tessdata/configs/box.train
  • tessdata/configs/box.train.stderr
  • tessdata/configs/cjk
  • tessdata/configs/digits
  • tessdata/configs/hocr
  • tessdata/configs/inter
  • tessdata/configs/kannada
  • tessdata/configs/linebox
  • tessdata/configs/logfile
  • tessdata/configs/lstm.train
  • tessdata/configs/makebox
  • tessdata/configs/pdf
  • tessdata/configs/quiet
  • tessdata/configs/rebox
  • tessdata/configs/strokewidth
  • tessdata/configs/tsv
  • tessdata/configs/txt
  • tessdata/configs/unlv
  • tessdata/deu.traineddata
  • tessdata/eng.traineddata
  • tessdata/eng.user-patterns
  • tessdata/eng.user-words
  • tessdata/fra.traineddata
  • tessdata/jpn.traineddata
  • tessdata/kor.traineddata
  • tessdata/kor.user-words
  • tessdata/pdf.ttf
  • tessdata/pgo.inttemp
  • tessdata/pgo.normproto
  • tessdata/pgo.pffmtable
  • tessdata/pgo.shapetable
  • tessdata/pgo.traineddata
  • tessdata/pgo.unicharset
  • tessdata/tessconfigs/batch
  • tessdata/tessconfigs/batch.nochop
  • tessdata/tessconfigs/matdemo
  • tessdata/tessconfigs/msdemo
  • tessdata/tessconfigs/nobatch
  • tessdata/tessconfigs/segdemo
  • tesseract40.dll
    .dll windows:5 windows x86 arch:x86

    8cee987c128276942bff4279d93cedce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • transCoder.dll
    .dll windows:5 windows x86 arch:x86

    76db222fc7514f7c8019fa5171e9ff3d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • translator.dll
    .dll windows:6 windows x86 arch:x86

    2536ba2ce2bc8d62484939781197706e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis
  • utilities.dll
    .dll windows:6 windows x86 arch:x86

    a747a49a6265da9671b28eee3b43058f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcomp120.dll
    .dll windows:6 windows x86 arch:x86

    ba61db1fb6534c776fac68630fc61afe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zlib1.dll
    .dll windows:5 windows x86 arch:x86

    eef8d41bf3054eed911375924cf725ea


    Code Sign

    Headers

    Imports

    Exports

    Sections