Overview

overview

7

Static

static

7

G/HPSafeBo....0.exe

windows7-x64

G/HPSafeBo....0.exe

windows10-2004-x64

G/HPSafeBo....0.exe

windows7-x64

G/HPSafeBo....0.exe

windows10-2004-x64

G/ProgramD...ok.dll

windows7-x64

1

G/ProgramD...ok.dll

windows10-2004-x64

1

G/ProgramD...64.dll

windows7-x64

1

G/ProgramD...64.dll

windows10-2004-x64

1

G/ProgramD...er.exe

windows7-x64

7

G/ProgramD...er.exe

windows10-2004-x64

7

G/ProgramD...64.exe

windows7-x64

1

G/ProgramD...64.exe

windows10-2004-x64

1

G/ProgramData/Key.dll

windows7-x64

1

G/ProgramData/Key.dll

windows10-2004-x64

1

G/TOOLS.exe

windows7-x64

7

G/TOOLS.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bb8615edefc92f9175e9de57cfe78c33744a2cff12ff325c0a3d79e0104e35c

  • Size

    5.5MB

  • MD5

    4af8ec07d4a948eeeba8f7d94988dcc1

  • SHA1

    e554da37a4f5b4df477d92da20972d3896eee0ce

  • SHA256

    6bb8615edefc92f9175e9de57cfe78c33744a2cff12ff325c0a3d79e0104e35c

  • SHA512

    ab3dac0eefe843c15515bc63c125c855d51fc57a045772f982120c8098dfed1319b8710e6c80b0f40c3774b421cce182e8ae04368837b67b624ef6be6dacb65b

  • SSDEEP

    98304:RVMDFKzoFRfHFgJLQGx8BzoB9mEAhzsVGiS6eHe0aKLssbQI2jAibEsFDr+2:R6Kw/FgJz8xOtAhgV+HTxLseQn0sFDF

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6bb8615edefc92f9175e9de57cfe78c33744a2cff12ff325c0a3d79e0104e35c
    .zip
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/Daily.db
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/Info.bd
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/System Volume Information/IndexerVolumeGuid
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/System Volume Information/WPSettings.dat
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/files/basic-V2.0.exe
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/files/depth-V2.0.exe
  • G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/files/使用说明V2.0.txt
  • G/HPSafeBox/desktop.ini
  • G/ProgramData/DHook.dll
    .dll windows:5 windows x86 arch:x86

    d4641036c7c20aa4665523f94781d214


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • G/ProgramData/DHook_64.dll
    .dll windows:5 windows x64 arch:x64

    4e81035736ff3b29e63c754d163c246f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • G/ProgramData/DllLoader.exe
    .exe windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • G/ProgramData/DllLoader_64.exe
    .exe windows:5 windows x64 arch:x64

    5fc8ad3773debdc334028449cde8fd3a


    Code Sign

    Headers

    Imports

    Sections

  • G/ProgramData/Key.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • G/ProgramData/MonP.dat
  • G/ProgramData/MonT.dat
  • G/ProgramData/WList.dat
  • G/System Volume Information/IndexerVolumeGuid
  • G/System Volume Information/WPSettings.dat
  • G/TOOLS.exe
    .exe windows:5 windows x86 arch:x86

    c812ebecea099a338c1dad9a4846ef2c


    Headers

    Imports

    Sections