General

  • Target

    515.1639_byond.exe

  • Size

    7.3MB

  • MD5

    d8899f3264f1d86333d3a3be89864b7b

  • SHA1

    b73c1e08ecc5f6bcccf79ae2405fcd645143cd9e

  • SHA256

    ce089bb85341a95ad7ea8f28ea414c8e2121677d3e8fedc5bb0e45024d308005

  • SHA512

    bb901acd9d06627be58687b778f0d8615c96b4e558c9f745390a86dff66f79468c83a8905c708ad274e5bb787323bb41537bb0c656afc0a50bdfc0590d985097

  • SSDEEP

    196608:vV9nWpglphPjQ8a2JbYhnWVcZuRAwh+BdZtq3JQu:t9nWyphPEQ3OyAwA6ZZ

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 29 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 515.1639_byond.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $1/npbyond.dll
    .dll windows:4 windows x86 arch:x86

    7dca42e78d01f114ba1065967200cd5e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/INetC.dll
    .dll windows:4 windows x86 arch:x86

    8e4c63f70f7cc6490634d743e795c93e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    610235b90207a63ccf481f0d4375d329


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    5197e2b5d0b686a43ee5fcfc134f44d9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    cce05dea98cbac3a9d486b233588f528


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/advsplash.dll
    .dll windows:4 windows x86 arch:x86

    c0d4e5fadc92d88e6603d2d1c1d8421c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    46f8b6973f33717335c0f6d8087de67b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcessBYOND.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $TEMP/spltmp.bmp
  • bin/ByondStub.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5c32df2aad0af90a16b9362679d62071


    Headers

    Imports

    Exports

    Sections

  • bin/byond.exe
    .exe windows:6 windows x86 arch:x86

    eb52623d0192c4b538609806842dc6ca


    Headers

    Imports

    Sections

  • bin/byondcore.dll
    .dll windows:6 windows x86 arch:x86

    2acdd4d824879fe0af5de46d48734043


    Headers

    Imports

    Exports

    Sections

  • bin/byondext.dll
    .dll windows:6 windows x86 arch:x86

    250c8bfa5d0704d859098af74b0703a6


    Headers

    Imports

    Exports

    Sections

  • bin/byondwin.dll
    .dll windows:6 windows x86 arch:x86

    455587b536105bf0e36116fc05f8e1ec


    Headers

    Imports

    Exports

    Sections

  • bin/dd.exe
    .exe windows:6 windows x86 arch:x86

    4347e709dfde4064c25be7686455d49b


    Headers

    Imports

    Sections

  • bin/dm.exe
    .exe windows:6 windows x86 arch:x86

    38da881d603ef9b2fd64496ec8258a72


    Headers

    Imports

    Sections

  • bin/dreamdaemon.exe
    .exe windows:6 windows x86 arch:x86

    db6450a059920808ef8a9362eb5f82b5


    Headers

    Imports

    Sections

  • bin/dreamdeploy.exe
    .exe windows:6 windows x86 arch:x86

    bdcec9a543c7663c94f4a73ce3aba483


    Headers

    Imports

    Sections

  • bin/dreammaker.exe
    .exe windows:6 windows x86 arch:x86

    4d2e8a0420b1c7cf1e6d787b27a82f0c


    Headers

    Imports

    Sections

  • bin/dreamseeker.exe
    .exe windows:6 windows x86 arch:x86

    2f34d976eaf87a933d070acfe93d7b56


    Headers

    Imports

    Sections

  • bin/fmodex.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • bin/npbyond.dll
    .dll windows:4 windows x86 arch:x86

    7dca42e78d01f114ba1065967200cd5e


    Headers

    Imports

    Exports

    Sections

  • bin/trace.bat
  • byondapi/byondapi.h
  • byondapi/byondapi.lib
  • byondapi/byondapi_cpp_wrappers.cpp
  • byondapi/byondapi_cpp_wrappers.h
  • byondapi/sample/Makefile
  • byondapi/sample/byondapi_sample.vcxproj
    .xml
  • byondapi/sample/byondapi_sample.vcxproj.filters
    .xml
  • byondapi/sample/byondapi_sample.vcxproj.user
    .xml
  • byondapi/sample/main.cpp
  • cfg/byond.dmf
  • cfg/irc.dms
    .vbs
  • cfg/joysticks.txt
  • cfg/stub.dm
  • cfg/telnet.dms
  • directx/DSETUP.dll
    .dll windows:6 windows x86 arch:x86

    5ee93a27b334994f92812e79a2fb75bd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • directx/DXSETUP.exe
    .exe windows:6 windows x86 arch:x86

    9f601d1261adacd540476661fd007bc3


    Code Sign

    Headers

    Imports

    Sections

  • directx/Jun2010_D3DCompiler_43_x86.cab
    .cab
  • D3DCompiler_43.dll
    .dll windows:6 windows x86 arch:x86

    6ba7b0e4e74a8eea96dca4fffc88b859


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • D3DCompiler_43_x86.cat
  • D3DCompiler_43_x86.inf
  • D3DCompiler_43_x86_xp.inf
  • JUN2010_D3DCompiler_43_x86.inf
  • directx/Jun2010_d3dx9_43_x86.cab
    .cab
  • JUN2010_d3dx9_43_x86.inf
  • d3dx9_43.dll
    .dll windows:6 windows x86 arch:x86

    5fb75b2a87c1fa7cc3d7904a0b97084a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • d3dx9_43_x86.cat
  • d3dx9_43_x86.inf
  • d3dx9_43_x86_xp.inf
  • directx/dsetup32.dll
    .dll windows:6 windows x86 arch:x86

    d1671a2cd7c955bf9903489363b7585c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • directx/dxupdate.cab
    .cab
  • dxupdate.cif
  • dxupdate.dll
    .dll windows:6 windows x86 arch:x86

    35283944b3f16c78c7befbefbb177694


    Headers

    Imports

    Exports

    Sections

  • dxupdate.inf
  • help/byond.chm
    .chm
  • help/dreamdaemon.chm
    .chm
  • help/dreammaker.chm
    .chm
  • help/dreamseeker.chm
    .chm
  • help/legal.txt
  • help/license.txt
  • help/ref/IE9.js
    .js
  • help/ref/contents.html
    .html .js polyglot
  • help/ref/index.html
    .html .js polyglot
  • help/ref/info.html
    .html
  • help/ref/prettyref.js
    .js
  • help/ref/reference.png
    .png
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    5197e2b5d0b686a43ee5fcfc134f44d9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    cce05dea98cbac3a9d486b233588f528


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsProcessBYOND.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • web/alert.dms
    .js
  • web/any.dms
    .js
  • web/bar.dms
    .js
  • web/browser.dms
    .js
  • web/button.dms
    .js
  • web/child.dms
    .js
  • web/color.dms
    .js
  • web/defaultSkin.dms
    .html .js polyglot
  • web/dpad.dms
    .js
  • web/drag.png
    .png
  • web/drop.png
    .png
  • web/ext.js
    .js
  • web/file.dms
    .js
  • web/gamepad.dms
    .js
  • web/grid.dms
    .js
  • web/hotbar.dms
    .js
  • web/info.dms
    .js
  • web/input.dms
    .js
  • web/label.dms
    .js
  • web/map.dms
    .js
  • web/message.dms
    .js
  • web/output.dms
    .js
  • web/pane.dms
    .js
  • web/pop.dms
    .js
  • web/splashlogo.png
    .png
  • web/status.dms
    .js
  • web/tab.dms
    .js
  • web/text.dms
    .js
  • web/verbmenu.dms
    .js
  • web/webclient.dart.js
    .js