General

  • Target
    FFSetup230.exe
  • Size 36.9MB
  • Sample240612-mn9zaavepr
  • SHA256 af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 158 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 5 IoCs

File Explorer

  • FFSetup230.exe
    .exe 36.9MB
  • $PLUGINSDIR/AdvSplash.dll
    .dll 6KB
  • $PLUGINSDIR/AskExample.bmp
    35KB
  • $PLUGINSDIR/BaiDu.bmp
    4KB
  • $PLUGINSDIR/Left.bmp
    67KB
  • $PLUGINSDIR/Logo.bmp
    4KB
  • $PLUGINSDIR/QuickStores.bmp
    4KB
  • $PLUGINSDIR/QuickStores.exe
    .exe 410KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/askChecker.exe
    .exe 196KB
  • $PLUGINSDIR/askToolbar.exe
    .exe 2.0MB
  • $PLUGINSDIR/modern-header.bmp
    33KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/sobar.exe
    .exe 1.1MB
  • $APPDATA/Baidu/Toolbar/Custom Buttons/custom.xml
    5KB
  • $PROFILE/AppData/LocalLow/Baidu/Toolbar/Custom Buttons/custom.xml
    5KB
  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
    .dll 2.6MB
  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduService.exe
    .exe 155KB
  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
    .exe 155KB
  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
    .dll 279KB
  • $PLUGINSDIR/splash.bmp
    351KB
  • BCGCBPRO1100u80.dll
    .dll 4.8MB
  • BCGPStyle2007Aqua110.dll
    .dll 472KB
  • BCGPStyle2007Luna110.dll
    .dll 400KB
  • BCGPStyle2007Obsidian110.dll
    .dll 408KB
  • BCGPStyle2007Silver110.dll
    .dll 412KB
  • FFInst.exe
    .exe 64KB
  • FFLang.lst
    2KB
  • FFModules/AviSynthPlugins/DirectShowSource.dll
    .dll 26KB
  • out.upx
    .dll 88KB
  • FFModules/AviSynthPlugins/vsfilter.dll
    .dll 980KB
  • FFModules/FFMpeg.dll
    .dll 136KB
  • FFModules/Filters/AviSplitter.ax
    .dll 362KB
  • FFModules/Filters/FLVSplitter.ax
    .dll 338KB
  • FFModules/Filters/Haali/Haali.reg
    2KB
  • FFModules/Filters/Haali/Install.bat
    193B
  • FFModules/Filters/Haali/Uninstall.bat
    195B
  • FFModules/Filters/Haali/avi.dll
    .dll 105KB
  • FFModules/Filters/Haali/avs.dll
    .dll 95KB
  • FFModules/Filters/Haali/avss.dll
    .dll 100KB
  • FFModules/Filters/Haali/cue2xml.js
    .js 4KB
  • FFModules/Filters/Haali/dxr.dll
    .dll 241KB
  • FFModules/Filters/Haali/mkunicode.dll
    .dll 23KB
  • FFModules/Filters/Haali/mkx.dll
    .dll 145KB
  • FFModules/Filters/Haali/mkzlib.dll
    .dll 77KB
  • FFModules/Filters/Haali/mp4.dll
    .dll 138KB
  • FFModules/Filters/Haali/ogm.dll
    .dll 118KB
  • FFModules/Filters/Haali/splitter.ax
    .dll 524KB
  • FFModules/Filters/Haali/ts.dll
    .dll 160KB
  • FFModules/Filters/MP4Splitter.ax
    .dll 502KB
  • FFModules/Filters/MPCVideoDec.ax
    .dll 2.3MB
  • FFModules/Filters/MatroskaSplitter.ax
    .dll 445KB
  • FFModules/Filters/MpegSplitter.ax
    .dll 384KB
  • FFModules/Filters/RealMediaSplitter.ax
    .dll 424KB
  • FFModules/Filters/ac3filter.ax
    .dll 778KB
  • FFModules/Filters/ffdshow/TomsMoComp_ff.dll
    .dll 231KB
  • FFModules/Filters/ffdshow/ff_kernelDeint.dll
    .dll 250KB
  • FFModules/Filters/ffdshow/ff_liba52.dll
    .dll 124KB
  • FFModules/Filters/ffdshow/ff_libdts.dll
    .dll 211KB
  • FFModules/Filters/ffdshow/ff_libfaad2.dll
    .dll 328KB
  • FFModules/Filters/ffdshow/ff_libmad.dll
    .dll 148KB
  • FFModules/Filters/ffdshow/ff_samplerate.dll
    .dll 172KB
  • FFModules/Filters/ffdshow/ff_tremor.dll
    .dll 115KB
  • FFModules/Filters/ffdshow/ff_unrar.dll
    .dll 93KB
  • FFModules/Filters/ffdshow/ff_wmv9.dll
    .dll 96KB
  • FFModules/Filters/ffdshow/ff_x264.dll
    .dll 813KB
  • FFModules/Filters/ffdshow/ffdshow.ax
    .dll 3.4MB
  • FFModules/Filters/ffdshow/ffdshow.ax.manifest
    .xml 547B
  • FFModules/Filters/ffdshow/ffdshow.reg
    6KB
  • FFModules/Filters/ffdshow/ffmpegmt.dll
    .dll 1.4MB
  • FFModules/Filters/ffdshow/libavcodec.dll
    .dll 4.3MB
  • FFModules/Filters/ffdshow/libmpeg2_ff.dll
    .dll 142KB
  • FFModules/Filters/ffdshow/libmplayer.dll
    .dll 544KB
  • FFModules/Filters/ffdshow/pthreadGC2.dll
    .dll 58KB
  • FFModules/Filters/ffdshow/xvidcore.dll
    .dll 810KB
  • FFModules/PicConvert.dll
    .dll 824KB
  • FFModules/RMCodecs/audiences/VBR.rpad
    .xml 1KB
  • FFModules/RMCodecs/codecs/colorcvt.dll
    .dll 492KB
  • FFModules/RMCodecs/codecs/cook.dll
    .dll 76KB
  • FFModules/RMCodecs/codecs/erv3.dll
    .dll 272KB
  • FFModules/RMCodecs/codecs/erv4.dll
    .dll 472KB
  • FFModules/RMCodecs/codecs/raac.dll
    .dll 536KB
  • FFModules/RMCodecs/codecs/ralf.dll
    .dll 152KB
  • FFModules/RMCodecs/codecs/sipr.dll
    .dll 132KB
  • FFModules/RMCodecs/common/rembrdcst.dll
    .dll 336KB
  • FFModules/RMCodecs/decodecs/14_43260.dll
    .dll 96KB
  • FFModules/RMCodecs/decodecs/28_83260.dll
    .dll 56KB
  • FFModules/RMCodecs/decodecs/atrc.dll
    .dll 76KB
  • FFModules/RMCodecs/decodecs/cook.dll
    .dll 64KB
  • FFModules/RMCodecs/decodecs/ddnt3260.dll
    .dll 36KB
  • FFModules/RMCodecs/decodecs/dnet3260.dll
    .dll 20KB
  • FFModules/RMCodecs/decodecs/drv1.dll
    .dll 100KB
  • FFModules/RMCodecs/decodecs/drv2.dll
    .dll 172KB
  • FFModules/RMCodecs/decodecs/drvc.dll
    .dll 260KB
  • FFModules/RMCodecs/decodecs/hxltcolor.dll
    .dll 236KB
  • FFModules/RMCodecs/decodecs/raac.dll
    .dll 540KB
  • FFModules/RMCodecs/decodecs/ralf.dll
    .dll 152KB
  • FFModules/RMCodecs/decodecs/rv10.dll
    .dll 48KB
  • FFModules/RMCodecs/decodecs/rv20.dll
    .dll 56KB
  • FFModules/RMCodecs/decodecs/rv30.dll
    .dll 48KB
  • FFModules/RMCodecs/decodecs/rv40.dll
    .dll 48KB
  • FFModules/RMCodecs/decodecs/sipr.dll
    .dll 104KB
  • FFModules/RMCodecs/helixprodctrl.dll
    .dll 708KB
  • FFModules/RMCodecs/msvcp71.dll
    .dll 488KB
  • FFModules/RMCodecs/msvcr71.dll
    .dll 340KB
  • FFModules/RMCodecs/plugins/hxsdp.dll
    .dll 30KB
  • FFModules/RMCodecs/plugins/rmwrtr.dll
    .dll 264KB
  • FFModules/RMCodecs/plugins/smplfsys.dll
    .dll 68KB
  • FFModules/RMCodecs/pncrt.dll
    .dll 266KB
  • FFModules/RMCodecs/tools/CodecMapping.txt
    389B
  • FFModules/RMCodecs/tools/audiodelaycomp.dll
    .dll 31KB
  • FFModules/RMCodecs/tools/audiofmtconverter.dll
    .dll 36KB
  • FFModules/RMCodecs/tools/audiolimiter.dll
    .dll 33KB
  • FFModules/RMCodecs/tools/audiolosslesscodec.dll
    .dll 64KB
  • FFModules/RMCodecs/tools/audiometer.dll
    .dll 42KB
  • FFModules/RMCodecs/tools/audioresampler.dll
    .dll 320KB
  • FFModules/RMCodecs/tools/avireader.dll
    .dll 64KB
  • FFModules/RMCodecs/tools/capture.dll
    .dll 248KB
  • FFModules/RMCodecs/tools/dsreader.dll
    .dll 152KB
  • FFModules/RMCodecs/tools/encsession.dll
    .dll 836KB
  • FFModules/RMCodecs/tools/eventpack.dll
    .dll 56KB
  • FFModules/RMCodecs/tools/log.dll
    .dll 160KB
  • FFModules/RMCodecs/tools/logmessages.xml
    .xml 60KB
  • FFModules/RMCodecs/tools/logobserverfile.dll
    .dll 25KB
  • FFModules/RMCodecs/tools/mediasink.dll
    .dll 56KB
  • FFModules/RMCodecs/tools/movreader.dll
    .dll 76KB
  • FFModules/RMCodecs/tools/mpeg4audiopacketizer.dll
    .dll 60KB
  • FFModules/RMCodecs/tools/packetsource.dll
    .dll 56KB
  • FFModules/RMCodecs/tools/qtreader.dll
    .dll 76KB
  • FFModules/RMCodecs/tools/rbsbroadcast.dll
    .dll 88KB
  • FFModules/RMCodecs/tools/rmmerge.dll
    .dll 380KB
  • FFModules/RMCodecs/tools/rmsessionformat.dll
    .dll 76KB
  • FFModules/RMCodecs/tools/rmtools.dll
    .dll 332KB
  • FFModules/RMCodecs/tools/rmwriter.dll
    .dll 248KB
  • FFModules/RMCodecs/tools/rnaudiocodec.dll
    .dll 72KB
  • FFModules/RMCodecs/tools/rnaudiopacketizer.dll
    .dll 84KB
  • FFModules/RMCodecs/tools/rnvideocodec.dll
    .dll 104KB
  • FFModules/RMCodecs/tools/rnvideopacketizer.dll
    .dll 29KB
  • FFModules/RMCodecs/tools/videocolorconverter.dll
    .dll 48KB
  • FFModules/RMCodecs/tools/videodupframedropper.dll
    .dll 31KB
  • FFModules/RMCodecs/tools/videolumaadj.dll
    .dll 30KB
  • FFModules/RMCodecs/tools/videonoisefilter.dll
    .dll 40KB
  • FFModules/RMCodecs/tools/videoprogressive.dll
    .dll 60KB
  • FFModules/RMCodecs/tools/videoresizer.dll
    .dll 40KB
  • FFModules/RMCodecs/tools/wavreader.dll
    .dll 20KB
  • FFModules/RMEncoder.exe
    .exe 84KB
  • FFModules/TimGM6mb.sf2
    5.7MB
  • FFModules/avcodec-52.dll
    .dll 7.3MB
  • FFModules/avdevice-52.dll
    .dll 10KB
  • FFModules/avfilter-1.dll
    .dll 22KB
  • FFModules/avformat-52.dll
    .dll 569KB
  • FFModules/avisynth.dll
    .dll 343KB
  • out.upx
    .dll 1.3MB
  • FFModules/avutil-50.dll
    .dll 55KB
  • FFModules/codecs/wms10dmod.dll
    .dll 753KB
  • FFModules/codecs/wmspdmod.dll
    .dll 475KB
  • FFModules/codecs/wmv10dmod.dll
    .dll 807KB
  • FFModules/cygz.dll
    .dll 51KB
  • FFModules/devil.dll
    .dll 703KB
  • FFModules/drv1.dll
    .dll 100KB
  • FFModules/drv2.dll
    .dll 172KB
  • FFModules/drvc.dll
    .dll 260KB
  • FFModules/ffmpeg.exe
    .exe 99KB
  • FFModules/libcharset.dll
    .dll 4KB
  • FFModules/libdvdcss.dll
    .dll 99KB
  • FFModules/libebml.dll
    .dll 343KB
  • FFModules/libiconv.dll
    .dll 856KB
  • FFModules/libmatroska.dll
    .dll 661KB
  • FFModules/mencoder.exe
    .exe 13.5MB
  • FFModules/mkvmerge.exe
    .exe 3.9MB
  • FFModules/mp4creator.exe
    .exe 477KB
  • FFModules/mplayer.exe
    .exe 13.6MB
  • FFModules/mplayer/config
    53B
  • FFModules/mplayer/input.conf
    4KB
  • FFModules/mplayer/subfont.ttf
    297KB
  • FFModules/msvcp60.dll
    .dll 392KB
  • FFModules/msvcr71.dll
    .dll 340KB
  • FFModules/pncrt.dll
    .dll 266KB
  • FFModules/postproc-51.dll
    .dll 82KB
  • FFModules/pthreadGC2.dll
    .dll 58KB
  • FFModules/swscale-0.dll
    .dll 264KB
  • FFModules/timidity.cfg
    40B
  • FFModules/timidity.exe
    .exe 871KB
  • FFModules/wavpack.exe
    .exe 208KB
  • FormatFactory.exe
    .exe 2.3MB
  • Help/FFHelp.chm
    .chm 1.1MB
  • Help/FFHelpCN.chm
    .chm 1.1MB
  • Help/FFHelpDE.chm
    .chm 1.2MB
  • Help/FFHelpES.chm
    .chm 1.2MB
  • Help/FFHelpFR.chm
    .chm 1.2MB
  • Help/FFHelpPT.chm
    .chm 1.2MB
  • Lang/Albanian.txt
    16KB
  • Lang/Arabic.txt
    13KB
  • Lang/Armenian.txt
    16KB
  • Lang/Azerbaijani.txt
    14KB
  • Lang/Basque.txt
    15KB
  • Lang/Bengali.txt
    14KB
  • Lang/Bosnian.txt
    14KB
  • Lang/Bulgarian.txt
    17KB
  • Lang/Catalan.txt
    16KB
  • Lang/Chinese-Kazakh.txt
    11KB
  • Lang/Chinese-Simplified.txt
    15KB
  • Lang/Chinese-Traditional.txt
    15KB
  • Lang/Chinese-Uyghurche.txt
    17KB
  • Lang/Croatian.txt
    14KB
  • Lang/Czech.txt
    16KB
  • Lang/Danish.txt
    14KB
  • Lang/Dutch.txt
    21KB
  • Lang/Estonian.txt
    14KB
  • Lang/Farsi.txt
    14KB
  • Lang/Finnish.txt
    16KB
  • Lang/French.txt
    17KB
  • Lang/Galician.txt
    16KB
  • Lang/Georgian.txt
    14KB
  • Lang/German.txt
    17KB
  • Lang/Greek.txt
    15KB
  • Lang/Hebrew.txt
    14KB
  • Lang/Hindi-India.txt
    13KB
  • Lang/Hungarian.txt
    16KB
  • Lang/Indonesian.txt
    16KB
  • Lang/Italian.txt
    17KB
  • Lang/Japanese.txt
    16KB
  • Lang/Khmer.txt
    12KB
  • Lang/Korean.txt
    10KB
  • Lang/Kurdish.txt
    14KB
  • Lang/Kyrgyz.txt
    14KB
  • Lang/Lithuanian.txt
    14KB
  • Lang/Macedonian.txt
    13KB
  • Lang/Norwegian.txt
    14KB
  • Lang/Persian.txt
    13KB
  • Lang/Philippines.txt
    17KB
  • Lang/Polish.txt
    14KB
  • Lang/Portuguese.txt
    17KB
  • Lang/Romanian.txt
    16KB
  • Lang/Russian.txt
    15KB
  • Lang/Serbian-Cyrillic.txt
    14KB
  • Lang/Serbian-Latin.txt
    14KB
  • Lang/Sinhala-SriLanka.txt
    15KB
  • Lang/Slovak.txt
    14KB
  • Lang/Slovenian.txt
    21KB
  • Lang/Spanish-Traditional.txt
    21KB
  • Lang/Spanish.txt
    17KB
  • Lang/Swedish.txt
    16KB
  • Lang/Thai.txt
    20KB
  • Lang/Turkish.txt
    16KB
  • Lang/Ukrainian.txt
    14KB
  • Lang/Vietnamese.txt
    17KB
  • License.txt
    531B
  • MediaInfo.dll
    .dll 1.9MB
  • Microsoft.VC80.CRT.manifest
    .xml 522B
  • Microsoft.VC80.MFC.manifest
    .xml 550B
  • mfc80u.dll
    .dll 1.0MB
  • msvcp80.dll
    .dll 536KB
  • msvcr80.dll
    .dll 612KB
  • uninst.exe
    .exe 68KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/modern-header.bmp
    33KB
  • updatelog.txt
    6KB

FFSetup230.exe

  • IMPHASH 099c0646ea7282d232219f8807883be0
  • SHA256 af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

  • NSIS installer

Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths