General

  • Target

    _x64__x32__installer__.zip

  • Size

    37.2MB

  • MD5

    ad61a96cfc9c5e0ccd3d805f035c23f3

  • SHA1

    f3b673dd1dba42f6343a5daab2a5862da62cd1e6

  • SHA256

    f76f082a2a313edc8a3f6a9e3c1a0a99f6867751c2cfe75d5c5a3df08dc1d398

  • SHA512

    ae9bcd1aeda79ed8a48c60e8354fd4ac2ff99b6c02f65acd4701af88b43eae92d2739468b4611708bbe656a325b617b12bf7f113607924079f93440dcd550703

  • SSDEEP

    786432:d+yYLsCtji2s8P3tz7/N4EhnP25ugHOM4gi90roTTXqCwv0MVy/:dWLJjDDPsj4kronXNkbi

Score
3/10

Malware Config

Signatures

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • _x64__x32__installer__.zip
    .zip

    Password: 1234

  • fh/HalExtIntcLpioDMA.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234


    Code Sign

    Headers

    Sections

  • fh/fh.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    73ace4548338a30f949c79e3b8e65377


    Headers

    Imports

    Exports

    Sections

  • fh/gpsvc.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    7a4e440963c17523a1ce8885fb1bfd39


    Headers

    Imports

    Exports

    Sections

  • fh/msftedit.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    3ad9b43610cf02f830e2e8bacdc12b48


    Headers

    Imports

    Exports

    Sections

  • rmclient/SEMgrSvc.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    23c805044199acd9bb77a74ac08b9b40


    Headers

    Imports

    Exports

    Sections

  • rmclient/SRH.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    b0154256ad4fba632240b90e58acf6fc


    Headers

    Imports

    Exports

    Sections

  • rmclient/rilproxy.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    bddb3c0fdc4e1abaf87814053b2c07f8


    Headers

    Imports

    Exports

    Sections

  • rmclient/rmclient.dll
    .dll windows:10 windows x64 arch:x64

    Password: 1234

    a3d4661525d47c934f5b10e197a23fc4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vdsbas/TokenBroker.dll
    .dll windows:10 windows x64 arch:x64

    adab68b969f5804eb7e1d5618f23e58f


    Headers

    Imports

    Exports

    Sections

  • vdsbas/Vault.dll
    .dll windows:10 windows x64 arch:x64

    c6e9ce023610e36df2bcf9f84fbc95bd


    Headers

    Imports

    Exports

    Sections

  • vdsbas/tquery.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    d6529d4862689a5078952162a13ec6b3


    Headers

    Imports

    Exports

    Sections

  • vdsbas/vdsbas.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    29b2409308bba1b82591d9778c77ba9b


    Headers

    Imports

    Exports

    Sections

  • winspool/wdmaud.drv
    .dll windows:10 windows x64 arch:x64

    c90b841c218cfa9cf738e573fb44076a


    Headers

    Imports

    Exports

    Sections

  • winspool/winspool.drv
    .dll windows:10 windows x64 arch:x64

    09ef30731fdc97992b0f61e0f0555337


    Headers

    Imports

    Exports

    Sections

  • winspool/wvc.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    f4e975b694deecd2ac58af812988eb82


    Headers

    Imports

    Exports

    Sections

  • x64__installer__v2.0.6.msi
    .msi