Overview

overview

7

Static

static

7

GoogleClou...er.exe

windows7-x64

7

GoogleClou...er.exe

windows10-2004-x64

7

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ze.dll

windows7-x64

7

$PLUGINSDI...ze.dll

windows10-2004-x64

7

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...nz.dll

windows7-x64

3

$PLUGINSDI...nz.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GoogleCloudSDKInstaller.exe

  • Size

    148KB

  • MD5

    ea36404ca2394e5d93d1d11e34ae3327

  • SHA1

    5313a0c1b3ceab74b5fb15bb2ddbeff7ca2518c4

  • SHA256

    0055ab2c26082ca69dbf1ca8e92ce03869d9992b7a44db9ff201f96d1999f8f4

  • SHA512

    f1622431cf1a1d80f2fb4f0381dedc13f8f0a0181b17729ae76bbca0a01fb108b3c916d930b423808f00490176c334b9704c43448bd41e54445868ac0b8904a6

  • SSDEEP

    3072:t8cFgUdOpDyTdcl4vN0HjHsGu03JXi+7YMa6oTWqE9G21BwIa1:tlTe4vS57zomZ+

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • GoogleCloudSDKInstaller.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    b78ecf47c0a3e24a6f4af114e2d1f5de


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    2dfc6a992d004b736e85c64219a88b4a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    5197e2b5d0b686a43ee5fcfc134f44d9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    ddbd50fe6279559edf7d1f1d89b42c2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsResize.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsisdl.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    7b073fcfd30c1bb3798d1cf8b20454b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisunz.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    0f92772da9c737d2bac38919e9863980


    Headers

    Imports

    Exports

    Sections

  • supercloud-16x16.ico