Static

static

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HDWSpoofKit.rar

  • Size

    11.6MB

  • MD5

    dd4a44f7059793accbbb3cba5b60cea7

  • SHA1

    7f5cfaf60ad804a51e379a7400a6ddf34c994bfc

  • SHA256

    68484425d0d5ca32c5196314614f2c84f6689630a957edaecb5cfea235814f98

  • SHA512

    ce1e727caac63d49999208bf561e7e207886308330dbd38a587402b626af58bd1a7a7835a571538d358e9052a88fbb4965062bf6f07116dabcf3b10ed1b61a51

  • SSDEEP

    196608:jvJwhtD/pwLYtbnWAxkIb1z8hdhHjt15i03uO7I8Jj2l2MeQc+78:rJy9pwLWbnWAj1zYZRu2nJjO2MS7

Score
4/10
pdflink

Malware Config

Signatures

  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • HDWSpoofKit.rar
    .rar
  • GRINX64v2/AMIDEWIN.EXE
    .exe windows:4 windows x86 arch:x86

    e4bef79f59242df9daf28c2c8193c40e


    Headers

    Imports

    Sections

  • GRINX64v2/AMIDEWINx64.EXE
    .exe windows:6 windows x64 arch:x64

    ed928bd060b03bab412d37a11b9d26a0


    Headers

    Imports

    Sections

  • GRINX64v2/DMI16.EXE
  • GRINX64v2/DMIEDIT.EXE
    .exe windows:6 windows x64 arch:x64

    9bbd972bee7030506f62236dff565e85


    Headers

    Imports

    Sections

  • GRINX64v2/README.txt
  • GRINX64v2/UCOREDLL.DLL
    .dll windows:4 windows x86 arch:x86

    6b893ca0388ae7a60f134fafc899b16d


    Headers

    Imports

    Exports

    Sections

  • GRINX64v2/UCORESYS.SYS
    .sys windows:4 windows x86 arch:x86

    072f277c4d89044b84c482307008a355


    Code Sign

    Headers

    Imports

    Sections

  • GRINX64v2/UCOREVXD.VXD
  • GRINX64v2/UCOREW64.SYS
    .sys windows:4 windows x64 arch:x64

    0dcd262801389f839ce909cb173448e2


    Code Sign

    Headers

    Imports

    Sections

  • GRINX64v2/amifldrv64.sys
    .sys windows:6 windows x64 arch:x64

    363922cc73591e60f2af113182414230


    Code Sign

    Headers

    Imports

    Sections

  • HardDiskSerialNumberChanger.exe
    .exe windows:5 windows x86 arch:x86

    6b71a51c953ff20af290e7286a7dad23


    Headers

    Imports

    Sections

  • Monitor Serial/CRU.exe
    .exe windows:4 windows x86 arch:x86

    cafc89e1b0a9b2c5b10389d6d19936ce


    Headers

    Imports

    Exports

    Sections

  • Monitor Serial/Info.txt
  • Monitor Serial/reset-all.exe
    .exe windows:5 windows x86 arch:x86

    32f33abb2edf5d9be4310f0050d459d0


    Headers

    Imports

    Sections

  • Monitor Serial/restart.exe
    .exe windows:5 windows x86 arch:x86

    cf4f510acda53bad738cb1d4e01b1c70


    Headers

    Imports

    Sections

  • Monitor Serial/restart64.exe
    .exe windows:5 windows x64 arch:x64

    2a69fe822ced9bf301916c1307e497a9


    Headers

    Imports

    Sections

  • README-INSTRUCTIONS.md
  • RevoUninstall/LicenseAgreement.txt
  • RevoUninstall/Revo Uninstaller Help.pdf
    .pdf

    • http://www.revouninstaller.com

    • http://www.revouninstaller.com/

  • RevoUninstall/RevoUPort.exe
    .exe windows:5 windows x86 arch:x86

    f1701f0b31fe827683fdfb65eb40b138


    Code Sign

    Headers

    Imports

    Sections

  • RevoUninstall/ctrlbars.dat
  • RevoUninstall/lang/Estonian.ini
  • RevoUninstall/lang/albanian.ini
  • RevoUninstall/lang/arabic.ini
  • RevoUninstall/lang/armenian.ini
  • RevoUninstall/lang/azerbaijani.ini
  • RevoUninstall/lang/bengali.ini
  • RevoUninstall/lang/bulgarian.ini
  • RevoUninstall/lang/czech.ini
  • RevoUninstall/lang/danish.ini
  • RevoUninstall/lang/dutch.ini
  • RevoUninstall/lang/english.ini
  • RevoUninstall/lang/finnish.ini
  • RevoUninstall/lang/french.ini
  • RevoUninstall/lang/german.ini
  • RevoUninstall/lang/gujarati.ini
  • RevoUninstall/lang/hebrew.ini
  • RevoUninstall/lang/hellenic.ini
  • RevoUninstall/lang/hindi.ini
  • RevoUninstall/lang/hrvatski.ini
  • RevoUninstall/lang/hungarian.ini
  • RevoUninstall/lang/indonesian.ini
  • RevoUninstall/lang/italiano.ini
  • RevoUninstall/lang/japanese.ini
  • RevoUninstall/lang/korean.ini
  • RevoUninstall/lang/kurdish.ini
  • RevoUninstall/lang/macedonian.ini
  • RevoUninstall/lang/norwegian.ini
  • RevoUninstall/lang/persian.ini
  • RevoUninstall/lang/polish.ini
  • RevoUninstall/lang/portuguese.ini
  • RevoUninstall/lang/portuguese_standard.ini
  • RevoUninstall/lang/portuguesebrazil.ini
  • RevoUninstall/lang/romanian.ini
  • RevoUninstall/lang/russian.ini
  • RevoUninstall/lang/serbian.ini
  • RevoUninstall/lang/serbianLatin.ini
  • RevoUninstall/lang/simplifiedchinese.ini
  • RevoUninstall/lang/slovak.ini
  • RevoUninstall/lang/slovenian.ini
  • RevoUninstall/lang/spanish.ini
  • RevoUninstall/lang/swedish.ini
  • RevoUninstall/lang/thai.ini
  • RevoUninstall/lang/traditionalchinese.ini
  • RevoUninstall/lang/turkish.ini
  • RevoUninstall/lang/ukrainian.ini
  • RevoUninstall/lang/vietnamese.ini
  • RevoUninstall/settings.ini
  • RevoUninstall/un_report.dat
  • RevoUninstall/x64/RevoUn.exe
    .exe windows:5 windows x64 arch:x64

    72613d58ff01c71481a9886b75af69e9


    Code Sign

    Headers

    Imports

    Sections

  • RevoUninstall/x64/button.bmp
  • RevoUninstall/x86/RevoUn.exe
    .exe windows:5 windows x86 arch:x86

    43ce8d0d2a52cb5b5ed6a38a9ddc4c6c


    Code Sign

    Headers

    Imports

    Sections

  • TMACv6.0.7_Setup.exe
    .exe windows:4 windows x86 arch:x86

    a8fd72e864d14b8484dd49e800fd3a36


    Headers

    Imports

    Sections