Overview

overview

10

Static

static

10

9a1735a16b...8d.exe

windows7-x64

7

9a1735a16b...8d.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

AM_Exit.exe

windows7-x64

1

AM_Exit.exe

windows10-2004-x64

1

AM_Restorer.exe

windows7-x64

1

AM_Restorer.exe

windows10-2004-x64

1

AmlMaple.dll

windows7-x64

1

AmlMaple.dll

windows10-2004-x64

1

AmlMaple.exe

windows7-x64

9

AmlMaple.exe

windows10-2004-x64

9

FlgCrt.dll

windows7-x64

1

FlgCrt.dll

windows10-2004-x64

1

GGSoundUtil.dll

windows7-x64

1

GGSoundUtil.dll

windows10-2004-x64

1

Help_By.chm

windows7-x64

1

Help_By.chm

windows10-2004-x64

1

Help_En.chm

windows7-x64

1

Help_En.chm

windows10-2004-x64

1

Help_Ru.chm

windows7-x64

1

Help_Ru.chm

windows10-2004-x64

1

Help_UK.chm

windows7-x64

1

Help_UK.chm

windows10-2004-x64

1

SHOW_COMMA...YS.bat

windows7-x64

9

SHOW_COMMA...YS.bat

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    9a1735a16b00094abd9a6eada4e097507ee1b0bf39f4d4f93147102eaa5cc78d

  • Size

    1.3MB

  • MD5

    2fe9dc9d743aa9b225aca40bebfb43c1

  • SHA1

    f8e2478977e1baba13f69102b6de6d049262a85f

  • SHA256

    9a1735a16b00094abd9a6eada4e097507ee1b0bf39f4d4f93147102eaa5cc78d

  • SHA512

    223ce726f0870410a1131420a7a1d6e36031d6a119924753faca9ecf60ae8f9f338416737bc4430e92b7ac8d5277e74bbc7fa1455d28d6de52017e7862a38a0d

  • SSDEEP

    24576:3sBDstT8fiSeRGjV3goiIQ21cuJ/0AjG8RSNQY42mbustRa/28vfA:eDsTMkRGZQot1cuJNG8RBDastoBvfA

Score
10/10
vmprotect

Malware Config

Signatures

  • Detects executables packed with VMProtect. 1 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 9a1735a16b00094abd9a6eada4e097507ee1b0bf39f4d4f93147102eaa5cc78d
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/OtherProducts.ini
  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • AM_Exit.exe
    .exe windows:4 windows x86 arch:x86

    8a567512bffdd114fff0e66f783ee625


    Headers

    Imports

    Sections

  • AM_Restorer.exe
    .exe windows:4 windows x86 arch:x86

    d3f9b5423c87da0a4dd66bc48bce344f


    Headers

    Imports

    Sections

  • AmlMaple.dll
    .dll windows:4 windows x86 arch:x86

    c9fcf4c7eef8679b74e7edd1e8a1e09a


    Headers

    Imports

    Exports

    Sections

  • AmlMaple.exe
    .exe windows:4 windows x86 arch:x86

    d84ae1673e3a04bf587551ee1e97d698


    Headers

    Imports

    Sections

  • Belorussian.lng
  • BrazilianPortuguese.lng
  • Bulgarian.lng
  • Chinese Simplified.lng
  • FlgCrt.dll
    .dll windows:4 windows x86 arch:x86

    4002a84c65eec45213b5a2668d8a3aaa


    Headers

    Imports

    Exports

    Sections

  • French.lng
  • GGSoundUtil.dll
    .dll windows:4 windows x86 arch:x86

    4b8c6e649fedd5aa2b147148cdaddca5


    Headers

    Imports

    Exports

    Sections

  • German.lng
  • Hebrew.lng
  • Hellenic.lng
  • Help_By.chm
    .chm
  • Help_En.chm
    .chm
  • Help_Ru.chm
    .chm
  • Help_UK.chm
    .chm
  • Italian.lng
  • Kazakh.lng
  • Korean.lng
  • Lithuanian.lng
  • LocalizationExample.lng
  • Magyar.lng
  • Norwegian.lng
  • Polish.lng
  • Russian.lng
  • SHOW_COMMAND_LINE_KEYS.Bat
  • SHOW_DETECT_langs.Bat
  • SHOW_MENU.Bat
  • SHOW_SETTINGS.Bat
  • Serbian.lng
  • Sinhala.lng
  • Spanish.lng
  • Turkish.lng
  • Ukrainian.lng
  • UpdateReport_Pl.htm
  • UpdateReport_Ru.htm
  • already_work.wav
  • arabic.lng
  • chpok.wav
  • chpok_rev.wav
  • encode.wav
  • has_newver.wav
  • lang_blinked.wav
  • no_newver.wav
  • start.wav
  • start_asadmin.wav
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp