General

  • Target

    bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

  • Size

    5.2MB

  • MD5

    8934b92a1d075aae29e2ab5ea5189c49

  • SHA1

    8129c3d444561ec6864d7583131f443d6fdf69cc

  • SHA256

    bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

  • SHA512

    5523c60979b88938910d46c871ba2103f8f46d06a1017d01bb34a83fd46b105fc7a9f5c9a8879d0be54215bec943d71579dc57ba2a0c879b13e1b772a44c9c95

  • SSDEEP

    98304:/+pmqu8JVd/7u7kxm+YcTjlKOxbqZcZkHOus1DgAtZRixAHAILz1IimEMh:+g7kKcToOYIku1DtbbgIHDmEMh

Score
3/10

Malware Config

Signatures

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    610235b90207a63ccf481f0d4375d329


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    cce05dea98cbac3a9d486b233588f528


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PROGRAMFILES/RF_L/MFC90KOR.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PROGRAMFILES/RF_L/Microsoft.VC90.CRT.manifest
    .xml
  • $PROGRAMFILES/RF_L/Microsoft.VC90.MFC.manifest
    .xml
  • $PROGRAMFILES/RF_L/Microsoft.VC90.MFCLOC.manifest
  • $PROGRAMFILES/RF_L/RF.exe
    .exe windows:5 windows x86 arch:x86

    421fe8a8767ea6f1ecc1c8add180520d


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TCCr.dll
    .dll windows:5 windows x86 arch:x86

    452c52a42f390241f459669ed5a93a50


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/TC_AD.DLL
    .dll windows:5 windows x86 arch:x86

    8c4d43ed2a17925dc31304477e385ef0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/TC_AU.exe
    .exe windows:5 windows x86 arch:x86

    dc59b4e471aa9f6e0db95e96c0868ba4


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TC_EZH32.dll
    .dll windows:6 windows x86 arch:x86

    4557d7530177a52b9338ffbd3c0273e5


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/TC_IO32.exe
    .exe windows:5 windows x86 arch:x86

    3bba7818ca3c662b5b45b72bd3662769


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TC_KB32.exe
    .exe windows:5 windows x86 arch:x86

    ff3afc2b16bdbe435eec5c8b80935cd1


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TC_MH.dll
    .dll windows:5 windows x86 arch:x86

    be56c3e138cad5e20c21b4785f1ed7e2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/TC_Menu.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    8a6fdf37d2551065c2732febe6433be9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/TC_OL.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    4cf84636b2c8e1f031f3d8287b6b5462


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/TC_Patch.exe
    .exe windows:5 windows x86 arch:x86

    91020d7f17e5bdec8bf49837213fed19


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TC_RA.exe
    .exe windows:5 windows x86 arch:x86

    10c68f0523f328f92ea9d1345d7faee1


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TC_Sign.exe
    .exe windows:5 windows x86 arch:x86

    7c7bd93d8153958f4b679a5c3a66d17f


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/TCxEZH32.dll
    .dll windows:5 windows x86 arch:x86

    c04d0fab0a113f80a62a54271beec8b7


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/mfc90.dll
    .dll windows:5 windows x86 arch:x86

    f2d8030f2fb5ae92ea26c320740a673b


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/mfcm90.dll
    .dll windows:5 windows x86 arch:x86

    7dabdb1d81bc318202cca27aed9c03e6


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/msvcm90.dll
    .dll windows:5 windows x86 arch:x86

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES/RF_L/RF.exe.new
    .exe windows:5 windows x86 arch:x86

    421fe8a8767ea6f1ecc1c8add180520d


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES/RF_L/tc_ad.dll.new
    .dll windows:5 windows x86 arch:x86

    8c4d43ed2a17925dc31304477e385ef0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES/RF_L/tc_sign.exe.new
    .exe windows:5 windows x86 arch:x86

    7c7bd93d8153958f4b679a5c3a66d17f


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/RF.exe.new
    .exe windows:5 windows x64 arch:x64

    a3b19ddc20838d387fb492354a9899e3


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/TC_AD.dll.new
    .dll windows:5 windows x64 arch:x64

    2f1896d46f95d14d9a6c18c45b52a07f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/tc_sign.exe.new
    .exe windows:5 windows x64 arch:x64

    a8b50d6e1d07dc01c07f159c55ab4200


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/skin/status_green.bmp
  • $PROGRAMFILES/RF_L/skin/status_red.bmp
  • $PROGRAMFILES/RF_L/tc1_form.sys
  • $PROGRAMFILES/RF_L/tc_8SR.exe
    .exe windows:5 windows x86 arch:x86

    f3da62b5dd366b894d4e8a05f18196f1


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/tc_Default.sys
  • $PROGRAMFILES/RF_L/tc_Prih.dll
    .dll windows:5 windows x86 arch:x86

    51d108bf9267ad0f7ca42cd91fe275b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/RF_L/tc_svr.exe
    .exe windows:5 windows x86 arch:x86

    42cccb59fb52078015be74288575c424


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/tc_un.exe
    .exe windows:5 windows x86 arch:x86

    08c0077874ae93219c1a93284cd374d6


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/RF_L/vcomp90.dll
    .dll windows:5 windows x86 arch:x86

    718f76580a1c6ed142d2ebb3755ae79c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/MFC90KOR.dll
    .dll windows:5 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • $PROGRAMFILES64/RF_L/Microsoft.VC90.CRT.manifest
    .xml
  • $PROGRAMFILES64/RF_L/Microsoft.VC90.MFC.manifest
    .xml
  • $PROGRAMFILES64/RF_L/Microsoft.VC90.MFCLOC.manifest
  • $PROGRAMFILES64/RF_L/RF.exe
    .exe windows:5 windows x64 arch:x64

    a3b19ddc20838d387fb492354a9899e3


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/TCCr.dll
    .dll windows:5 windows x64 arch:x64

    b24cf8ea2e3d35033861e3df73bec6af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/TC_AD.DLL
    .dll windows:5 windows x64 arch:x64

    2f1896d46f95d14d9a6c18c45b52a07f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/TC_AU.exe
    .exe windows:5 windows x64 arch:x64

    e50b2f0cbd567d5faef34fd41de172b6


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/TC_EZH64.dll
    .dll windows:6 windows x64 arch:x64

    7c733a77800d92600b3d036b64da29bb


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/TC_MH.dll
    .dll windows:5 windows x64 arch:x64

    150cac589af04cad086469f1d61a1e5e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/TC_Menu.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    ea4802dc18b6db8901d240a1948d9b28


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/TC_OL.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    5c8c7671e14175da9fbe5f6eb9b78b90


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/TC_Patch.exe
    .exe windows:5 windows x64 arch:x64

    dc7b3c356562dd1411e0f67bd03bccfc


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/TC_RA.exe
    .exe windows:5 windows x64 arch:x64

    6dcf82277c09197e434b84094643c7d7


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/TC_Sign.exe
    .exe windows:5 windows x64 arch:x64

    a8b50d6e1d07dc01c07f159c55ab4200


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/TCxEZH64.dll
    .dll windows:5 windows x64 arch:x64

    6a79dd269a02f2b5ad1bf65203190de2


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/mfc90.dll
    .dll windows:5 windows x64 arch:x64

    895ac7d0656b32c43268aca09a55c876


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/mfcm90.dll
    .dll windows:5 windows x64 arch:x64

    b31cdce4e2ca62ad92f16401d90c7808


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/msvcm90.dll
    .dll windows:5 windows x64 arch:x64

    009188bdfd096960bdccff3d7f8e9ca1


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/msvcp90.dll
    .dll windows:5 windows x64 arch:x64

    0710c2edb6d550175f0ccfb9bf56834a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/msvcr90.dll
    .dll windows:5 windows x64 arch:x64

    78d931040351d53199b8eea44e33c764


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/skin/status_green.bmp
  • $PROGRAMFILES64/RF_L/skin/status_red.bmp
  • $PROGRAMFILES64/RF_L/tc1_form.sys
  • $PROGRAMFILES64/RF_L/tc_8SR.exe
    .exe windows:5 windows x64 arch:x64

    c92efab4aaaa003749eca63054659c37


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/tc_Default.sys
  • $PROGRAMFILES64/RF_L/tc_Prih.dll
    .dll windows:5 windows x64 arch:x64

    a359327112ab193c82d75c0273bb14d9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES64/RF_L/tc_svr.exe
    .exe windows:5 windows x86 arch:x86

    42cccb59fb52078015be74288575c424


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/tc_un.exe
    .exe windows:5 windows x64 arch:x64

    8aef33b19ab2eb85e31b1907dd5589ba


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES64/RF_L/vcomp90.dll
    .dll windows:5 windows x64 arch:x64

    67edffeed65f875a3c6ad8202aac4805


    Code Sign

    Headers

    Imports

    Exports

    Sections