General

  • Target

    59211b01a04e6f938b578888a4788dd022ac649e50987b10b3a5be0b61d7a63d.exe

  • Size

    25.1MB

  • MD5

    6e92fc42593e86a5447bccef5bfe909e

  • SHA1

    9b11cc3c147efeaa3c8f6de47d196d9b9aa6a811

  • SHA256

    59211b01a04e6f938b578888a4788dd022ac649e50987b10b3a5be0b61d7a63d

  • SHA512

    67e9992a85b68297d37d6ddcf4fdd3ecf96da52b87c545acbe973520245d867ab472b9695f6c625c7ad7074318b299927e6929497f00119a5ece172d0bf0c081

  • SSDEEP

    393216:s8WDZju+R2WEn/r0XTDel5VDtoJqkL8rq2owbEisz6kzNe+4aFKeA6oT:s8CZjj2Fn2JqP0TmMQrcKeA6C

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 59211b01a04e6f938b578888a4788dd022ac649e50987b10b3a5be0b61d7a63d.exe
    .exe windows:4 windows x86 arch:x86

    57e98d9a5a72c8d7ad8fb7a6a58b3daf


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/NsProcess.dll
    .dll windows:5 windows x86 arch:x86

    a49b0342971aa199fc6349725b90146d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    ddbd50fe6279559edf7d1f1d89b42c2c


    Headers

    Imports

    Exports

    Sections

  • budgetfive-zx.exe
    .exe windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • dbrtl150.bpl
    .dll windows:5 windows x86 arch:x86

    cd6e522550565b338b9a77891ccd318f


    Headers

    Imports

    Exports

    Sections

  • home.zip
    .zip
  • 618_login.jpg
    .jpg
  • 618_zx.jpg
    .jpg
  • Reg_BK.jpg
    .jpg
  • app-debug.js
    .js
  • app.js
    .js
  • ds_login.jpg
    .jpg
  • ds_zx.jpg
    .jpg
  • favicon.ico
  • img/bg_1.4b27fefb.png
    .png
  • img/bg_2.51d895d0.png
    .png
  • img/dwg.1dd40115.png
    .png
  • img/hzzbs.15db114a.png
    .png
  • img/json.e82d9f4e.png
    .png
  • img/lastopen1.6f093f08.png
    .png
  • img/lastopen2.87023585.png
    .png
  • img/lastopenmain.f12a1bef.jpg
    .jpg
  • img/signin3.9af0c758.png
    .png
  • img/sytaberr2.f765d9da.jpg
    .jpg
  • img/videobg.d2d337d4.jpg
    .jpg
  • img/zip.6efd3bee.png
    .png
  • img_imp_Excel.jpg
    .jpg
  • imgconfig.json
  • index.html
    .html .js polyglot
  • jd_login.jpg
    .jpg
  • jd_zx.jpg
    .jpg
  • jj_login.jpg
    .jpg
  • jj_zx.jpg
    .jpg
  • js/0.js
    .js
  • js/1.js
    .js
  • js/10.js
    .js
  • js/11.js
    .js
  • js/12.js
    .js
  • js/13.js
    .js
  • js/14.js
    .js
  • js/15.js
    .js
  • js/16.js
    .js
  • js/17.js
    .js
  • js/18.js
    .js
  • js/19.js
    .js
  • js/2.js
    .js
  • js/20.js
    .js
  • js/21.js
    .js
  • js/22.js
    .js
  • js/23.js
    .js
  • js/24.js
    .js
  • js/25.js
    .js
  • js/26.js
    .js
  • js/27.js
    .js
  • js/28.js
    .js
  • js/29.js
    .js
  • js/3.js
    .js
  • js/30.js
    .js
  • js/31.js
    .js
  • js/32.js
    .js
  • js/33.js
    .js
  • js/34.js
    .js
  • js/35.js
    .js
  • js/36.js
    .js
  • js/37.js
    .js
  • js/38.js
    .js
  • js/39.js
    .js
  • js/4.js
    .js
  • js/40.js
    .js
  • js/41.js
    .js
  • js/42.js
    .js
  • js/43.js
    .js
  • js/44.js
    .js
  • js/45.js
    .js
  • js/46.js
    .js
  • js/47.js
    .js
  • js/48.js
    .js
  • js/49.js
    .js
  • js/5.js
    .js
  • js/50.js
    .js
  • js/51.js
    .js
  • js/52.js
    .js
  • js/53.js
    .js
  • js/54.js
    .js
  • js/55.js
    .js
  • js/56.js
    .js
  • js/57.js
    .js
  • js/58.js
    .js
  • js/59.js
    .js
  • js/6.js
    .js
  • js/60.js
    .js
  • js/61.js
    .js
  • js/62.js
    .js
  • js/63.js
    .js
  • js/64.js
    .js
  • js/65.js
    .js
  • js/66.js
    .js
  • js/7.js
    .js
  • js/chunk-vendors.js
    .js
  • js/index.js
    .js
  • reportview.jpg
    .jpg
  • start_zx.jpg
    .jpg
  • xs_login.jpg
    .jpg
  • xs_zx.jpg
    .jpg
  • xz_login.jpg
    .jpg
  • xz_zx.jpg
    .jpg
  • lib/7z.dll
    .dll windows:4 windows x86 arch:x86

    622eae4411b119bf4ca7bee4fa1391c8


    Headers

    Imports

    Exports

    Sections

  • lib/WebView2Loader.dll
    .dll windows:5 windows x86 arch:x86

    608537c42a46a95b31cc1ef01ab6eeb0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/libxml2.dll
    .dll windows:4 windows x86 arch:x86

    6fbaf3e496f479d73b63af7ade6f69c8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/node.dll
    .dll windows:5 windows x86 arch:x86

    bfa73f80a5b384e64002d8bc6dbcc202


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libcurl.dll
    .dll windows:6 windows x86 arch:x86

    976f32c2edbd0120b006b79537d026ab


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • midas.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5ea7bed3c92a52ee0e1f60fde8004992


    Headers

    Imports

    Exports

    Sections

  • rtl150.bpl
    .dll windows:5 windows x86 arch:x86

    7bde8e07222afe845126d5ba4b98713c


    Headers

    Imports

    Exports

    Sections

  • sysconfig.json
  • vcl150.bpl
    .dll windows:5 windows x86 arch:x86

    75cb93a2bb591a64a7c4b82bc1c06e0d


    Headers

    Imports

    Exports

    Sections

  • vcldb150.bpl
    .dll windows:5 windows x86 arch:x86

    03e5a3eda0a168606a31c336d966b95e


    Headers

    Imports

    Exports

    Sections

  • vclx150.bpl
    .dll windows:5 windows x86 arch:x86

    3729308f861ee0ee133a510a03530d71


    Headers

    Imports

    Exports

    Sections

  • ver.json
  • ж.exe.nsis