General

  • Target

    betterRUN.zip

  • Size

    5.1MB

  • MD5

    8034b99a65ba3d25b7606a6a783581de

  • SHA1

    a377f2df08e1ceef8c290f96f46324c40c727cef

  • SHA256

    0b97e1c437ea6b07f2f67c803fc84b449a33270fb5cc2e4a5d72e2813b2ddc00

  • SHA512

    cddaee441683ef57d89ee4751810daf8edaee919ab66d49fc52850f62b28310154d19abf3814c57192940f0561bf9eda376022c1e48c9bc2bc3f0b405d0ed8e7

  • SSDEEP

    98304:LETE+czq+F+k0xzEYTlxNpE8ztMV+f0tW38+YVPt+8+Zn64+fO5:IL+F+k0xzhlx7Eg8t08P/a9685

Score
3/10

Malware Config

Signatures

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • betterRUN.zip
    .zip

    Password: flash123

  • inst fold/AltarScript.pex
  • inst fold/BIN/050000003f.idx
  • inst fold/BIN/060000003f.idx
  • inst fold/BIN/62/33/6233afb8e08943b8f9a0d7d1d17ee8e5
  • inst fold/BIN/CHANGES.txt
  • inst fold/BIN/ExtraActionBar.lua
  • inst fold/BIN/MicroMenu.lua
  • inst fold/BIN/PetBar.lua
  • inst fold/BIN/PetButton.lua
  • inst fold/BIN/RepXPBar.lua
  • inst fold/BIN/StanceBar.lua
  • inst fold/BIN/breakpad.dll
    .dll windows:5 windows x86 arch:x86

    Password: flash123

    8988046344f7ab2c3f0ec76ea4dcf911


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • inst fold/BIN/qtANGLE.dll
    .dll windows:6 windows x64 arch:x64

    Password: flash123

    b665fdeb7f064fcf50f92683c0dec3da


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • inst fold/JigLibX.dll
    .dll windows:4 windows x86 arch:x86

    Password: flash123

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • inst fold/exe_runner.exe
    .exe windows:4 windows x86 arch:x86

    Password: flash123

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • inst fold/inst_v2.exe
    .exe windows:4 windows x86 arch:x86

    Password: flash123

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • inst fold/pops_api.lib
  • inst fold/qwindows.dll
    .dll windows:6 windows x64 arch:x64

    Password: flash123

    5d628e86fd261109ecf91fbade3d7cb8


    Headers

    Imports

    Exports

    Sections

  • inst fold/source/AltarScript.psc
  • inst fold/source/msvcr100.dll
    .dll windows:5 windows x64 arch:x64

    Password: flash123

    1208bcdc77cffee6a6813646321cfc79


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • inst fold/source/perkdistribute.psc
  • inst fold/source/qwindowsvistastyle.dll
    .dll windows:6 windows x64 arch:x64

    Password: flash123

    3d3040efa646d84bc8bc2fb2d65abf99


    Headers

    Imports

    Exports

    Sections

  • inst fold/source/staminaonhit.psc