Errors

Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported

General

  • Target

    2a37405789a5fa2f4c930d84cdfdbfa0e7cf1e62af539790e0284d1c343ddcfb

  • Size

    19.5MB

  • MD5

    9d65674687f19dba76b14dc31b9074e6

  • SHA1

    afa9037fe18cb9733e9a30af3b51258bbc9d0563

  • SHA256

    2a37405789a5fa2f4c930d84cdfdbfa0e7cf1e62af539790e0284d1c343ddcfb

  • SHA512

    d8f43781e557498fcbf57da8c090d7aea348bf8adc4e267bbb1265b366f6813ee6eeaf4f336fbad3313b522f258ccffb9095907b6d9c91ffdfad444ebbaffe40

  • SSDEEP

    393216:vMuueEY4Idb1Oik6pfpmnv0hIBu3Q9PCwrGb2exaCxWuCzaKmcjS1kyKypW4k:vB5xdbr3pfsnv0hvA9a6GbtubGKmeok7

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 2a37405789a5fa2f4c930d84cdfdbfa0e7cf1e62af539790e0284d1c343ddcfb
    .zip

    Password: infected

  • 0fc59a93076f3c96775b42c01a8433b94b3736957415bc3c236670f5f6d6c466.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 2ac116a3cbb025bea26eb7a87ac16e17f3f51587f6644538a0c1a163a8a39e6e.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • 2c12323597f6a02460508f622dd3a14f9962b1600e9d8bc8bc438ae39ad59e5b.zip
    .zip
  • paymentd.vbs
    .vbs
  • 30afcb4d640f9e65da53f556cce02c5adf233e719404e0fded38f62595110069.xls
    .xls .pdf windows office2003 polyglot
  • 32a40983b6c68d9da41a1c40c24295a6dae68d06e07adf9358c4021b7f4543d7.exe
    .exe windows:4 windows x86 arch:x86

    ea4e67a31ace1a72683a99b80cf37830


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    610235b90207a63ccf481f0d4375d329


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    d576645bcd8a66d2fe678a075f4cc6e0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/SWUKey_SKF.dll
    .dll windows:5 windows x86 arch:x86

    8a857c9821077511d01a2da4a9a79b9c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/mfc42.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    977736e2cac137c628527d8ac207e0c0


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp60.dll
    .dll windows:4 windows x86 arch:x86

    c85d8396f1ce855bc219450c4b2c265b


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcrt.dll
    .dll windows:5 windows x86 arch:x86

    1838f96daab97a33395f5dee7b6f4a3c


    Headers

    Imports

    Exports

    Sections

  • $_2_/windows/SysWOW64/SWUKey_SKF.dll
    .dll windows:5 windows x86 arch:x86

    8a857c9821077511d01a2da4a9a79b9c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_2_/windows/SysWOW64/mfc42.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    977736e2cac137c628527d8ac207e0c0


    Headers

    Imports

    Exports

    Sections

  • $_2_/windows/SysWOW64/msvcp60.dll
    .dll windows:4 windows x86 arch:x86

    c85d8396f1ce855bc219450c4b2c265b


    Headers

    Imports

    Exports

    Sections

  • $_2_/windows/SysWOW64/msvcrt.dll
    .dll windows:5 windows x86 arch:x86

    1838f96daab97a33395f5dee7b6f4a3c


    Headers

    Imports

    Exports

    Sections

  • Hyperlink.ico
  • SWUKey_Reg.exe
    .exe windows:4 windows x86 arch:x86

    742d5ab18a7d5c6f90be0113cbd1163e


    Headers

    Imports

    Sections

  • SWUKey_SafeHelper.dll
    .dll windows:5 windows x86 arch:x86

    c01ca834edae3ea5ba94c583d7092c5a


    Headers

    Imports

    Exports

    Sections

  • SWUKey_Srv.exe
    .exe windows:4 windows x86 arch:x86

    9a24862d8ea19ac260714bd09e907d55


    Headers

    Imports

    Sections

  • SWUKey_Tool.exe
    .exe windows:5 windows x86 arch:x86

    3543f29acf8f60fbab0693a9b13a19e7


    Headers

    Imports

    Sections

  • SWUKey_UI.dll
    .dll windows:4 windows x86 arch:x86

    968bd4cf9aee9a2c33e2884f4392210a


    Headers

    Imports

    Exports

    Sections

  • Uninstall.ico
  • Utility.dll
    .dll windows:5 windows x86 arch:x86

    f7b9fbc9c34eb21dbfcb38a8b17c06b4


    Headers

    Imports

    Exports

    Sections

  • VerifyPIN.ini
  • Version.ini
  • 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe
    .exe windows:5 windows x86 arch:x86

    c4540f421523fe2dc591e50be5ad7d0b


    Headers

    Imports

    Sections

  • 4d3a6e2f2413f569ce9971b049c0567c6ebe546670a615526b6c4eff7e26795f.xls
    .xls windows office2003
  • 50854970fd66243f52d703bb6901005be169ba588c2184c32bf915517e6e02ec.doc
    .docx .doc office2007
  • 5c5f2c7a3375b37ce92cc1e8d672598fdd20d3d011bacd33d41f05bf7cd51ef2.xls
    .xls windows office2003
  • 7315af76190d33a3f5a1b5466f8f0e840dea6846c56fa460c1ba014efdf20d81.xls
    .xls windows office2003
  • 8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • 88b71e8bc69a2ab2d26a242106b6f2964e3c17511eb62860190a77fac6c6083d.rar
    .rar
  • Purchase Orders.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8ec0e528de50cdd232294480999a9730944aa218fbc12ad24228e078b845cb5c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 988104352b6a7555e2012d2df1d6d2f4eebe29d897392f239e7cc96237772cf4.exe
    .exe windows:5 windows x86 arch:x86

    0ae9e38912ff6bd742a1b9e5c003576a


    Code Sign

    Headers

    Imports

    Sections

  • 99a1f4a9844766fd3863b4544fd5be5f4f6e5fb72c51535e80611b19db71e8a9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • af6346f5ed3f00e0b392155695526dc90e4fd3dde3c11b49ac34da28b23abce1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • bca6f9ea0755dfa7b91586bb33be2f03a6a5cd065512cca5ab60a8e577f1379c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • d220538747164b56b83a6f324adae9b05a1d64a861ddb512c6139a12ca6c31a8.exe
    .exe windows:4 windows x86 arch:x86

    7ed0d71376e55d58ab36dc7d3ffda898


    Code Sign

    Headers

    Imports

    Sections

  • Antiprelatism.Syn
  • Lacteous.tak
  • Maksimalprisers22.Inv
  • Raadvildestes.fla
  • Reclaimable.txt
  • vaniljeis.tra
  • dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed.exe
    .exe windows:6 windows x86 arch:x86

    fda332609aae506e39655ec159c5e3fe


    Headers

    Imports

    Sections

  • eeda8090c9caf61a33bcff8a10bafa5a46c9234a7fb82279f6022724c52c6281.xls
    .xls windows office2003