General

  • Target

    fde8fdbbb65f522fd1c9a0beee04e5bc8e4ae2bc920e0f11b232f3494558960f

  • Size

    8.4MB

  • MD5

    e4f428b1dbcf432e911ca9d2888b1361

  • SHA1

    cce7019ad7ea0bd49e216b56345ecdb21998fa74

  • SHA256

    fde8fdbbb65f522fd1c9a0beee04e5bc8e4ae2bc920e0f11b232f3494558960f

  • SHA512

    f08b08060cff70ae0655c1dd0fec2a5b7e5bc71aa9b6e70643995f52911651cdef2c2e7f790e254cdf3882fe36d0105133ba9ca0644bbc4773fbb2f9f8e301d4

  • SSDEEP

    196608:IclEAuL5S9rcTJ6mzLcoUTEWr/GYmVI2OBQIxhzfIGSQZbAp:IclEh9Shc3ZUyVIL9pCQZU

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 28 IoCs

    Checks for missing Authenticode signature.

Files

  • fde8fdbbb65f522fd1c9a0beee04e5bc8e4ae2bc920e0f11b232f3494558960f
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c1c7505e1e6e929ebb6b9100e55b050a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/CypCut/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/CypCutPro/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/CypOne/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/CypVision/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/CypWell/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/HypCut/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/Share/LogServer/LogPlugins/$_12_/fsdc/V2.6.7.5/uninstall.exe
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c1c7505e1e6e929ebb6b9100e55b050a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/Share/LogServer/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/Share/TaskClient/RunTaskClient.exe
    .exe windows:5 windows x86 arch:x86

    4bb2ab2f5d99d443ca676e02a3f7a8f2


    Headers

    Imports

    Sections

  • $PROGRAMFILES/Friendess/Share/TaskClient/V1.0.0.1/TaskClient.exe
    .exe windows:5 windows x86 arch:x86

    6deacdf04e806c5e628305bafea27dfe


    Headers

    Imports

    Sections

  • $PROGRAMFILES/Friendess/Share/cfgpkgtool/All.config
    .xml
  • $PROGRAMFILES/Friendess/Share/fsdc/FsdcSvc.exe
    .exe windows:5 windows x86 arch:x86

    5a60c1044de4b72a4387fddc0ae59760


    Headers

    Imports

    Sections

  • $PROGRAMFILES/Friendess/Share/fsdc/RunFSDC.exe
    .exe windows:5 windows x86 arch:x86

    4bb2ab2f5d99d443ca676e02a3f7a8f2


    Headers

    Imports

    Sections

  • $PROGRAMFILES/Friendess/TubeOne/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Friendess/TubePro/LogPlugins/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $TEMP/$_13_
    .dll windows:5 windows x86 arch:x86

    0b579ca8106c9105ae45fc6010f6d4ec


    Headers

    Imports

    Exports

    Sections

  • $_12_/TaskClient/RunTaskClient.exe
    .exe windows:5 windows x86 arch:x86

    4bb2ab2f5d99d443ca676e02a3f7a8f2


    Headers

    Imports

    Sections

  • $_12_/fsdc/FsdcSvc.exe
    .exe windows:5 windows x86 arch:x86

    5a60c1044de4b72a4387fddc0ae59760


    Headers

    Imports

    Sections

  • $_12_/fsdc/V2.6.7.5/7z.dll
    .dll windows:4 windows x86 arch:x86

    71fc45db7a81ce236f432a828a4e8fcd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_12_/fsdc/V2.6.7.5/Advertising.exe
    .exe windows:5 windows x86 arch:x86

    d669677d4cb89091079184c66648a874


    Headers

    Imports

    Sections

  • $_12_/fsdc/V2.6.7.5/Empty2.lxds
    .zip
  • Layers/content.xml
    .xml
  • TextStyles/content.xml
    .xml
  • Viewports/content.xml
    .xml
  • content.xml
    .xml
  • info.xml
    .xml
  • $_12_/fsdc/V2.6.7.5/RunFSDC.exe
    .exe windows:5 windows x86 arch:x86

    4bb2ab2f5d99d443ca676e02a3f7a8f2


    Headers

    Imports

    Sections

  • $_12_/fsdc/V2.6.7.5/ShareMemTool.exe
    .exe windows:5 windows x86 arch:x86

    b210342259d31959dce7169063d3539f


    Headers

    Imports

    Sections

  • $_12_/fsdc/V2.6.7.5/TaskClient.exe
    .exe windows:5 windows x86 arch:x86

    6deacdf04e806c5e628305bafea27dfe


    Headers

    Imports

    Sections

  • $_12_/fsdc/V2.6.7.5/ext/logfd.dll
    .dll windows:5 windows x86 arch:x86

    a6f91e799f31c25778b24d35b67e381a


    Headers

    Imports

    Exports

    Sections

  • $_12_/fsdc/V2.6.7.5/fsdc.exe
    .exe windows:5 windows x86 arch:x86

    e1d0ed2f96c28c9f0dd70e67f7b3090c


    Code Sign

    Headers

    Imports

    Sections

  • $_12_/fsdc/V2.6.7.5/paho-mqtt3a.dll
    .dll windows:6 windows x86 arch:x86

    60c9d5e7c569409007a59e713b9cf16f


    Headers

    Imports

    Exports

    Sections

  • $_12_/fsdc/V2.6.7.5/web/CloudStat/css/41.0a13463c.css
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/css/app.1cb0c513.css
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/css/board.b6ddd2e3.css
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/css/chunk-vendors.3817f8d0.css
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/favicon.ico
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/CypCutE.9f28a996.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/CypCutPro.f8c08bb3.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/FaCut.21832da2.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/HypCut.6dd1a186.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/clock.a2f40a7c.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/copy.c39f7912.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/length.5407266f.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/light.080b970e.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/link.09b06fd1.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/logo.c1b2f844.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/machineIcon.050c77a4.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/month.0bd6e23e.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/open.ccac4afa.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/search.35099a1e.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/show.45bdb278.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/textShadow.ff2fb1cc.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/tubeIcon.7d100203.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/week.bb21ab6a.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/img/weldIcon.7d532bda.svg
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/index.html
    .html
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/js/106.1704527396063.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/js/41.1704527396063.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/js/558.1704527396063.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/js/app.1704527396063.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/js/board.1704527396063.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/CloudStat/js/chunk-vendors.1704527396063.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/css/app.00021707.css
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/css/chunk-vendors.4745bced.css
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/favicon.ico
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/attention.4e631174.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/cloud_nest.de7ea50e.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/distance.4acfd88a.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/file_default.e32a309f.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/finish.cf96d247.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/import.72748a06.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/list_default.c0472165.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/local_file.8a09dcf7.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/new.a54dea68.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/raw_material.252ed87a.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/tasks.4363c594.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/time.eed444fc.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/img/working.82afff31.svg
    .xml
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/index.html
    .html
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/js/app.1696906798291.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/TaskClient/js/chunk-vendors.1696906798291.js
    .js
  • $_12_/fsdc/V2.6.7.5/web/html/getNest.html
    .html
  • $_12_/fsdc/V2.6.7.5/web/images/bg.png
    .png
    • https://mcenter.bcjgy.com/mymachine/#/action

  • $_12_/fsdc/V2.6.7.5/web/js/qrcode.js
    .js