General

  • Target
    bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
  • Size 5.2MB
  • Sample240606-ym9snscc32
  • SHA256 bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

File Explorer

  • bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
    .exe 5.2MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-wizard.bmp
    57KB
  • $PROGRAMFILES/RF_L/MFC90KOR.dll
    .dll 45KB
  • $PROGRAMFILES/RF_L/Microsoft.VC90.CRT.manifest
    .xml 524B
  • $PROGRAMFILES/RF_L/Microsoft.VC90.MFC.manifest
    .xml 548B
  • $PROGRAMFILES/RF_L/Microsoft.VC90.MFCLOC.manifest
    5KB
  • $PROGRAMFILES/RF_L/RF.exe
    .exe 1.5MB
  • $PROGRAMFILES/RF_L/TCCr.dll
    .dll 30KB
  • $PROGRAMFILES/RF_L/TC_AD.DLL
    .dll 592KB
  • $PROGRAMFILES/RF_L/TC_AU.exe
    .exe 393KB
  • $PROGRAMFILES/RF_L/TC_EZH32.dll
    .dll 262KB
  • $PROGRAMFILES/RF_L/TC_IO32.exe
    .exe 37KB
  • $PROGRAMFILES/RF_L/TC_KB32.exe
    .exe 28KB
  • $PROGRAMFILES/RF_L/TC_MH.dll
    .dll 405KB
  • $PROGRAMFILES/RF_L/TC_Menu.dll
    .dll 133KB
  • $PROGRAMFILES/RF_L/TC_OL.dll
    .dll 144KB
  • $PROGRAMFILES/RF_L/TC_Patch.exe
    .exe 94KB
  • $PROGRAMFILES/RF_L/TC_RA.exe
    .exe 28KB
  • $PROGRAMFILES/RF_L/TC_Sign.exe
    .exe 249KB
  • $PROGRAMFILES/RF_L/TCxEZH32.dll
    .dll 168KB
  • $PROGRAMFILES/RF_L/mfc90.dll
    .dll 1.1MB
  • $PROGRAMFILES/RF_L/mfcm90.dll
    .dll 58KB
  • $PROGRAMFILES/RF_L/msvcm90.dll
    .dll 219KB
  • $PROGRAMFILES/RF_L/msvcp90.dll
    .dll 555KB
  • $PROGRAMFILES/RF_L/msvcr90.dll
    .dll 640KB
  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES/RF_L/RF.exe.new
    .exe 1.5MB
  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES/RF_L/tc_ad.dll.new
    .dll 592KB
  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES/RF_L/tc_sign.exe.new
    .exe 249KB
  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/RF.exe.new
    .exe 2.1MB
  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/TC_AD.dll.new
    .dll 713KB
  • $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/tc_sign.exe.new
    .exe 287KB
  • $PROGRAMFILES/RF_L/skin/status_green.bmp
    20KB
  • $PROGRAMFILES/RF_L/skin/status_red.bmp
    20KB
  • $PROGRAMFILES/RF_L/tc1_form.sys
    17KB
  • $PROGRAMFILES/RF_L/tc_8SR.exe
    .exe 30KB
  • $PROGRAMFILES/RF_L/tc_Default.sys
    168B
  • $PROGRAMFILES/RF_L/tc_Prih.dll
    .dll 107KB
  • $PROGRAMFILES/RF_L/tc_svr.exe
    .exe 14KB
  • $PROGRAMFILES/RF_L/tc_un.exe
    .exe 380KB
  • $PROGRAMFILES/RF_L/vcomp90.dll
    .dll 53KB
  • $PROGRAMFILES64/RF_L/MFC90KOR.dll
    .dll 45KB
  • $PROGRAMFILES64/RF_L/Microsoft.VC90.CRT.manifest
    .xml 526B
  • $PROGRAMFILES64/RF_L/Microsoft.VC90.MFC.manifest
    .xml 550B
  • $PROGRAMFILES64/RF_L/Microsoft.VC90.MFCLOC.manifest
    5KB
  • $PROGRAMFILES64/RF_L/RF.exe
    .exe 2.1MB
  • $PROGRAMFILES64/RF_L/TCCr.dll
    .dll 36KB
  • $PROGRAMFILES64/RF_L/TC_AD.DLL
    .dll 713KB
  • $PROGRAMFILES64/RF_L/TC_AU.exe
    .exe 611KB
  • $PROGRAMFILES64/RF_L/TC_EZH64.dll
    .dll 303KB
  • $PROGRAMFILES64/RF_L/TC_MH.dll
    .dll 474KB
  • $PROGRAMFILES64/RF_L/TC_Menu.dll
    .dll 149KB
  • $PROGRAMFILES64/RF_L/TC_OL.dll
    .dll 172KB
  • $PROGRAMFILES64/RF_L/TC_Patch.exe
    .exe 100KB
  • $PROGRAMFILES64/RF_L/TC_RA.exe
    .exe 29KB
  • $PROGRAMFILES64/RF_L/TC_Sign.exe
    .exe 287KB
  • $PROGRAMFILES64/RF_L/TCxEZH64.dll
    .dll 197KB
  • $PROGRAMFILES64/RF_L/mfc90.dll
    .dll 1.6MB
  • $PROGRAMFILES64/RF_L/mfcm90.dll
    .dll 65KB
  • $PROGRAMFILES64/RF_L/msvcm90.dll
    .dll 239KB
  • $PROGRAMFILES64/RF_L/msvcp90.dll
    .dll 831KB
  • $PROGRAMFILES64/RF_L/msvcr90.dll
    .dll 612KB
  • $PROGRAMFILES64/RF_L/skin/status_green.bmp
    20KB
  • $PROGRAMFILES64/RF_L/skin/status_red.bmp
    20KB
  • $PROGRAMFILES64/RF_L/tc1_form.sys
    17KB
  • $PROGRAMFILES64/RF_L/tc_8SR.exe
    .exe 31KB
  • $PROGRAMFILES64/RF_L/tc_Default.sys
    168B
  • $PROGRAMFILES64/RF_L/tc_Prih.dll
    .dll 127KB
  • $PROGRAMFILES64/RF_L/tc_svr.exe
    .exe 14KB
  • $PROGRAMFILES64/RF_L/tc_un.exe
    .exe 476KB
  • $PROGRAMFILES64/RF_L/vcomp90.dll
    .dll 58KB

bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

  • IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
  • SHA256 bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
  • MD5 SHA1 SHA512 SSDEEP
Digest
74:8f:6c:0e:52:6b:b0:93:ba:54:b7:d9:25:53:c9:f2:57:e4:11:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=110111-3513200,CN=TrueCut Security\, Inc.,O=TrueCut Security\, Inc.,STREET=525\, Gangnam-daero,L=Seocho-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
4
Entry point
12731
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths