General

  • Target

    01d984edc91e8abab7be1189b1d53a24d8d148c7fc7d7a6fa14f89daed6ff346

  • Size

    18.5MB

  • MD5

    f5b33937ee887965df8cbafd6e5ed2ce

  • SHA1

    beb6b73088224d95d966fa2d2a64a144c346eef4

  • SHA256

    01d984edc91e8abab7be1189b1d53a24d8d148c7fc7d7a6fa14f89daed6ff346

  • SHA512

    bbc1fb4fddb243873ce9f4949d8855b37363ac425746be890a7a4b280b0eee5de0103b4d1b316151bc90f0133be29263ba0c78374c1f9d6036aa431bc9e89c8a

  • SSDEEP

    393216:Vm5uzZ3YL20PxyfPXhHcJk1fnbhi1v0LH6:M0365PxHk9bU1v0La

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

Files

  • 01d984edc91e8abab7be1189b1d53a24d8d148c7fc7d7a6fa14f89daed6ff346
    .zip

    Password: infected

  • 0fd8da5d6fb04b52cfbc2074c9d5382a7b10ab501913b61e31408a2aa16a02e0.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • 5105787d78690ef15723ed3ae5bb83f56d95a9285f7cc0208fd56a23bfa4c05d.dll
    .dll windows:6 windows x86 arch:x86

    f56764b7e48271042db4d089cde5460a


    Headers

    Imports

    Exports

    Sections

  • 72fd51a857e810cf54291ab1aceab06565cc4a4da8af3eaff1efe634d153db00.zip
    .zip
  • ForceCPU.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • HTCTL32.DLL
    .dll windows:5 windows x86 arch:x86

    6ba08298dd09ea8e41ab7285d3183bba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NSM.LIC
  • NSM.ini
  • PCICHEK.DLL
    .dll windows:5 windows x86 arch:x86

    1233e02b30a7c416ba5aa017ff2ba312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PCICL32.DLL
    .dll windows:5 windows x86 arch:x86

    3e09384870fa6c1a29cc37553985fcc6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QWhale.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • QWhale.Editor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • QWhale.Syntax.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Qt5QmlModels.dll
    .dll windows:6 windows x86 arch:x86

    bdcc9abef23a6cf5114ffaefd67b610c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5QuickWidgets.dll
    .dll windows:6 windows x86 arch:x86

    43287f32e985e3ffba23e9da46811e56


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5SerialPort.dll
    .dll windows:6 windows x86 arch:x86

    635ebba852f1fb67c8936f7a58771514


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SimpleFilter.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • SimpleFilter.pdb
  • TCCTL32.DLL
    .dll windows:5 windows x86 arch:x86

    2c4d798bb87ec57193b7625c4259da43


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Timeline.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Timeline.pdb
  • __/24.4.3.1012.manifest
  • __/assistant.runtimeconfig.json
  • __/brand_config
  • __/browser.dll.sig
  • __/cs.pak
  • __/ctlrvers.dat
  • __/external_extensions.json
  • __/ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
  • __/manifest.json
  • __/prefs.json
  • __/preloaded_data.pb
  • api-ms-win-crt-runtime-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • avcodec-58.dll
    .dll windows:6 windows x86 arch:x86

    062610e90cc21780323058d0204a8c01


    Headers

    Imports

    Exports

    Sections

  • avformat-58.dll
    .dll windows:6 windows x86 arch:x86

    6a47294b984ad05daad884204137d949


    Headers

    Imports

    Exports

    Sections

  • avutil-56.dll
    .dll windows:6 windows x86 arch:x86

    4a019ee6068566a1179af566e961a41c


    Headers

    Imports

    Exports

    Sections

  • client32.exe
    .exe windows:5 windows x86 arch:x86

    78ed70ebeb178ed1bae5921d2ed514bc


    Code Sign

    Headers

    Imports

    Sections

  • client32.ini
  • concrt140.dll
    .dll windows:6 windows x86 arch:x86

    a7f0e297dae66d5b73188a236ad0ae0f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libEGL.dll
    .dll windows:6 windows x86 arch:x86

    9c98d3b5bee3ee0c5c0fdfcb4d295c31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libpkcs11-helper-1.dll
    .dll windows:6 windows x64 arch:x64

    bfdbd4e55892516f0902c34a2b4edfdf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libssl-1_1.dll
    .dll windows:6 windows x86 arch:x86

    7fdfcbcdba6c59923de1b019ce9d3741


    Headers

    Imports

    Exports

    Sections

  • libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    2b512dd3642ba3619025f2fc713dea1c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libvlc.dll
    .dll windows:4 windows x86 arch:x86

    5c455bebc40d8ab001d42875154b8ef8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nskbfltr.inf
  • nsm_vpro.ini
  • pcicapi.dll
    .dll windows:5 windows x86 arch:x86

    d78463f91aa83e9c39d2e594035ae4bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • remcmdstub.exe
    .exe windows:5 windows x86 arch:x86

    99c0cd957fc7334714fefa3daa61a6ea


    Code Sign

    Headers

    Imports

    Sections

  • swresample-3.dll
    .dll windows:6 windows x86 arch:x86

    bb062d542faa45cba359586a408a1381


    Headers

    Imports

    Exports

    Sections

  • 88e27fee94abdaebc1015987da224950c36417cf7bb5e2e511451b2a75ce2883.zip
    .zip
  • drivespan/DAQDeviceControl.exe
    .exe windows:6 windows x86 arch:x86

    7dc2d630179462e2c40299b1aed7c454


    Headers

    Imports

    Sections

  • drivespan/Permissions.exe
    .exe windows:5 windows x86 arch:x86

    c0abd2a9ced2aff011b95e548be54599


    Code Sign

    Headers

    Imports

    Sections

  • drivespan/RBGUIFramework.dll
    .dll windows:6 windows x86 arch:x86

    c22b1c307f95f79659a12d3bc86c093d


    Headers

    Imports

    Exports

    Sections

  • drivespan/Transfer.exe
    .exe windows:6 windows x86 arch:x86

    862cdd542b2c508d29e672ca6eb2f235


    Code Sign

    Headers

    Imports

    Sections

  • drivespan/drivespan.dll
    .dll windows:6 windows x86 arch:x86

    3d7d3d2ee6dfbadb775ad3fb4af9c531


    Headers

    Imports

    Exports

    Sections

  • drivespan/wweb32.dll
    .dll windows:6 windows x86 arch:x86

    f56764b7e48271042db4d089cde5460a


    Headers

    Imports

    Exports

    Sections

  • drivespan/wwnotray.exe
    .exe windows:5 windows x86 arch:x86

    d30ea7988abeaf6b17489cf0a141fafd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • b58ad6188718013683db6ac3b7c3bd55044ccba4957df38d13c5736d519eaa45.exe
    .exe windows:6 windows x86 arch:x86

    7dc2d630179462e2c40299b1aed7c454


    Headers

    Imports

    Sections

  • bfcf185481f64806d5e4eed08f12c39ffe498f66259d7f146b633eb07ca40777.zip
    .zip
  • Setup.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • install.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe
    .exe windows:4 windows x64 arch:x64

    e4a8172b80d7ea86eeba3123e2be5bfe


    Headers

    Imports

    Sections

  • df1de76f61b86cf8ce64723b3a0b1656de115890e5080acd113d8a0a3e177c57.zip
    .zip
  • Revised invoice.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections