General

  • Target

    Synthesia.exe

  • Size

    12.6MB

  • MD5

    a367aa2fbce65bd03509076fa4656dd4

  • SHA1

    db07c17b5736472d2061096cefda9a86c0e6c1b6

  • SHA256

    9b9016b5402fd2bba74ca80fbd4c1fd33424276a5d909bfd6d3e88246276bc9f

  • SHA512

    2d60368ec1452eb74f35d4167b21bc2ae4cd230a86a3bf7f62ca0b57ab8fb8b78a5b6dacc6d90deee2f65184aa4c83cdbd60dbd19fdb0ad5f12ec4ae3cc49500

  • SSDEEP

    393216:jQDiKZYqASUg/nHArZfCWbUFuF9NB7I3M07FRQ:jgiKZDX/grZfCWzF9vIcE7

Score
3/10

Malware Config

Signatures

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Synthesia.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    24f4223e271413c25abad52fd456a9bc


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    4b45b7e00344a87332fbd12653854d1a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Synthesia.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    d576d2fece10ed274645b211cf327da2


    Code Sign

    Headers

    Imports

    Sections

  • bass.dll
    .dll windows:5 windows x64 arch:x64

    Password: infected

    9567a8cea5b29b54380ef5e01f780c0e


    Headers

    Imports

    Exports

    Sections

  • bassmidi.dll
    .dll windows:5 windows x64 arch:x64

    Password: infected


    Code Sign

    Headers

    Exports

    Sections

  • msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    047aec27169fe21274a3b2f2f30606c0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • readme.html
    .html .js polyglot
  • vccorlib140.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    d5ec94ca50152cc1e7188b825074fef2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    7f07fd94e5bb907093556781cc464017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    bf380ca954cbf10d1a4cef9ec18e46fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • win10-midi.dll
    .dll windows:6 windows x64 arch:x64

    5c07d57d34406b9cb13b5fdc21f81d2e


    Code Sign

    Headers

    Imports

    Exports

    Sections