General

  • Target
    TotalAV.exe
  • Size 68.3MB
  • Sample240609-yhwp9aec51
  • SHA256 1d152cb544822ef4e0facc7622d8726c812cd27b05d2483aa009ce6410ec5a7f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Signatures

  • Blackguard family
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

File Explorer

  • TotalAV.exe
    .exe 68.3MB
  • $PLUGINSDIR/SysRestore.dll
    .dll 5KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/modern-header.bmp
    86KB
  • $PLUGINSDIR/modern-wizard.bmp
    150KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • API.dll
    .dll 110KB
  • Accessibility.dll
    .dll 20KB
  • AntivirusLibrary.dll
    .dll 143KB
  • Brand.dll
    .dll 25KB
  • CacApp.dll
    .exe 18KB
  • CacApp.exe
    .exe 227KB
  • CacApp.runtimeconfig.json
    1KB
  • D3DCompiler_47_cor3.dll
    .dll 3.9MB
  • DirectWriteForwarder.dll
    .dll 498KB
  • DotNetZip.dll
    .dll 247KB
  • EndpointProtectionClient.Net.dll
    .dll 85KB
  • EndpointProtectionInterfaces.dll
    .dll 99KB
  • EntityFramework.SqlServer.dll
    .dll 577KB
  • EntityFramework.dll
    .dll 4.7MB
  • GUI.dll
    .exe 1.6MB
  • Google.Protobuf.dll
    .dll 462KB
  • Grpc.AspNetCore.Server.dll
    .dll 144KB
  • Grpc.Core.Api.dll
    .dll 68KB
  • Grpc.Core.dll
    .dll 473KB
  • Grpc.Net.Client.dll
    .dll 290KB
  • Grpc.Net.Common.dll
    .dll 22KB
  • IPC.dll
    .dll 704KB
  • LICENSE.txt
    53KB
  • LiteDB.dll
    .dll 477KB
  • MessageRpc.Net.dll
    .dll 48KB
  • Microsoft.AppCenter.Analytics.dll
    .dll 26KB
  • Microsoft.AppCenter.Crashes.dll
    .dll 53KB
  • Microsoft.AppCenter.dll
    .dll 150KB
  • Microsoft.AspNetCore.Antiforgery.dll
    .dll 98KB
  • Microsoft.AspNetCore.Authentication.Abstractions.dll
    .dll 62KB
  • Microsoft.AspNetCore.Authentication.Cookies.dll
    .dll 102KB
  • Microsoft.AspNetCore.Authentication.Core.dll
    .dll 82KB
  • Microsoft.AspNetCore.Authentication.OAuth.dll
    .dll 94KB
  • Microsoft.AspNetCore.Authentication.dll
    .dll 142KB
  • Microsoft.AspNetCore.Authorization.Policy.dll
    .dll 70KB
  • Microsoft.AspNetCore.Authorization.dll
    .dll 94KB
  • Microsoft.AspNetCore.Components.Authorization.dll
    .dll 54KB
  • Microsoft.AspNetCore.Components.Forms.dll
    .dll 62KB
  • Microsoft.AspNetCore.Components.Server.dll
    .dll .js 698KB
  • Microsoft.AspNetCore.Components.Web.dll
    .dll 282KB
  • Microsoft.AspNetCore.Components.dll
    .dll 550KB
  • Microsoft.AspNetCore.Connections.Abstractions.dll
    .dll 62KB
  • Microsoft.AspNetCore.CookiePolicy.dll
    .dll 54KB
  • Microsoft.AspNetCore.Cors.dll
    .dll 82KB
  • Microsoft.AspNetCore.Cryptography.Internal.dll
    .dll 90KB
  • Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
    .dll 42KB
  • Microsoft.AspNetCore.DataProtection.Abstractions.dll
    .dll 46KB
  • Microsoft.AspNetCore.DataProtection.Extensions.dll
    .dll 46KB
  • Microsoft.AspNetCore.DataProtection.dll
    .dll 378KB
  • Microsoft.AspNetCore.Diagnostics.Abstractions.dll
    .dll 34KB
  • Microsoft.AspNetCore.Diagnostics.HealthChecks.dll
    .dll 50KB
  • Microsoft.AspNetCore.Diagnostics.dll
    .dll 386KB
  • Microsoft.AspNetCore.HostFiltering.dll
    .dll 46KB
  • Microsoft.AspNetCore.Hosting.Abstractions.dll
    .dll 42KB
  • Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
    .dll 30KB
  • Microsoft.AspNetCore.Hosting.dll
    .dll 390KB
  • Microsoft.AspNetCore.Html.Abstractions.dll
    .dll 42KB
  • Microsoft.AspNetCore.Http.Abstractions.dll
    .dll 282KB
  • Microsoft.AspNetCore.Http.Connections.Common.dll
    .dll 50KB
  • Microsoft.AspNetCore.Http.Connections.dll
    .dll 270KB
  • Microsoft.AspNetCore.Http.Extensions.dll
    .dll 386KB
  • Microsoft.AspNetCore.Http.Features.dll
    .dll 66KB
  • Microsoft.AspNetCore.Http.Results.dll
    .dll 210KB
  • Microsoft.AspNetCore.Http.dll
    .dll 238KB
  • Microsoft.AspNetCore.HttpLogging.dll
    .dll 166KB
  • Microsoft.AspNetCore.HttpOverrides.dll
    .dll 66KB
  • Microsoft.AspNetCore.HttpsPolicy.dll
    .dll 46KB
  • Microsoft.AspNetCore.Identity.dll
    .dll 190KB
  • Microsoft.AspNetCore.Localization.Routing.dll
    .dll 34KB
  • Microsoft.AspNetCore.Localization.dll
    .dll 62KB
  • Microsoft.AspNetCore.Metadata.dll
    .dll 30KB
  • Microsoft.AspNetCore.Mvc.Abstractions.dll
    .dll 246KB
  • Microsoft.AspNetCore.Mvc.ApiExplorer.dll
    .dll 118KB
  • Microsoft.AspNetCore.Mvc.Core.dll
    .dll 1.7MB
  • Microsoft.AspNetCore.Mvc.Cors.dll
    .dll 50KB
  • Microsoft.AspNetCore.Mvc.DataAnnotations.dll
    .dll 94KB
  • Microsoft.AspNetCore.Mvc.Formatters.Json.dll
    .dll 30KB
  • Microsoft.AspNetCore.Mvc.Formatters.Xml.dll
    .dll 106KB
  • Microsoft.AspNetCore.Mvc.Localization.dll
    .dll 50KB
  • Microsoft.AspNetCore.Mvc.Razor.dll
    .dll 218KB
  • Microsoft.AspNetCore.Mvc.RazorPages.dll
    .dll 414KB
  • Microsoft.AspNetCore.Mvc.TagHelpers.dll
    .dll .js 258KB
  • Microsoft.AspNetCore.Mvc.ViewFeatures.dll
    .dll 702KB
  • Microsoft.AspNetCore.Mvc.dll
    .dll 42KB
  • Microsoft.AspNetCore.OutputCaching.dll
    .dll 202KB
  • Microsoft.AspNetCore.RateLimiting.dll
    .dll 74KB
  • Microsoft.AspNetCore.Razor.Runtime.dll
    .dll 70KB
  • Microsoft.AspNetCore.Razor.dll
    .dll 66KB
  • Microsoft.AspNetCore.RequestDecompression.dll
    .dll 54KB
  • Microsoft.AspNetCore.ResponseCaching.Abstractions.dll
    .dll 30KB
  • Microsoft.AspNetCore.ResponseCaching.dll
    .dll 142KB
  • Microsoft.AspNetCore.ResponseCompression.dll
    .dll 78KB

TotalAV.exe

  • IMPHASH ea4e67a31ace1a72683a99b80cf37830
  • SHA256 1d152cb544822ef4e0facc7622d8726c812cd27b05d2483aa009ce6410ec5a7f
  • MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest
3c:fe:d9:f7:e8:c3:1f:2e:0d:45:38:17:49:ed:40:63:65:75:df:db:22:0d:d4:a5:bb:69:84:f8:dc:91:d9:68
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=10161957,CN=Total Security Limited,O=Total Security Limited,STREET=16-18 Barnes Wallis Road,L=Fareham,ST=Hampshire,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains

May 24, 2024

Minor OS version
0
Major OS version
4
Entry point
13409
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths