General

  • Target

    2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5

  • Size

    3.6MB

  • MD5

    7db8604c051e9c8fa15beff8a0f9227d

  • SHA1

    d0af81a71921d02efdbb1241e5998059a9b1bc5a

  • SHA256

    2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5

  • SHA512

    bb0c5e640f7c22ad991089decec0b606a2985285cf1a055538cafadd6dcd16d87b22cbf42630022926a79e704e59f78e29aeabe94ccecf382e5916fc22eb5ccc

  • SSDEEP

    98304:vHBzFW8nyA5gpxTDYzGIms9AdfrvDShPL88L7eUOmr:vu8nyA50U8dfrvMP/7eUF

Score
3/10

Malware Config

Signatures

  • Unsigned PE 33 IoCs

    Checks for missing Authenticode signature.

Files

  • 2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • $WINDIR/SysWOW64/XML/FileRecord_ProblemRequest.xml
  • $WINDIR/SysWOW64/XML/FileRecord_Summary.xml
  • $WINDIR/SysWOW64/XML/FileRecord_Summary_noBP.xml
  • $WINDIR/SysWOW64/XML/FileRecord_Summary_onlyBP.xml
  • $WINDIR/SysWOW64/XML/GetActiveUsers.xml
  • $WINDIR/SysWOW64/XML/GetCurrentPatientIdExample.xml
  • $WINDIR/SysWOW64/XML/GetDemographicsRequest.xml
  • $WINDIR/SysWOW64/XML/GetRecordRequest.xml
  • $PLUGINSDIR/EventLog.dll
    .dll windows:4 windows x86 arch:x86

    b641db062d69aad5b1d64f77fc160e2b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    4b45b7e00344a87332fbd12653854d1a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    5e62e8e248e7364886b604bd1fcf4c13


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c1c7505e1e6e929ebb6b9100e55b050a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsJSON.dll
    .dll windows:6 windows x86 arch:x86

    674631b5b86309caa1d0df66c91a50f2


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/OptBP/DotNET/$PROGRAMFILES/OptBP/uninstall.exe
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    5e62e8e248e7364886b604bd1fcf4c13


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/OptBP/DotNET/checkDotNET.deps.json
  • $PROGRAMFILES/OptBP/DotNET/checkDotNET.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/DotNET/checkDotNET.exe
    .exe windows:6 windows x86 arch:x86

    ffff45487d1e51fa972c8409931457df


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/DotNET/checkDotNET.pdb
  • $PROGRAMFILES/OptBP/DotNET/checkDotNET.runtimeconfig.json
  • $PROGRAMFILES/OptBP/DotNET/checkDotNET35.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Emis.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/EventLog/EventLog.deps.json
  • $PROGRAMFILES/OptBP/EventLog/EventLog.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/EventLog/EventLog.exe
    .exe windows:6 windows x86 arch:x86

    45a5f0973e31e011d7c0dc3f187bff9e


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/EventLog/EventLog.pdb
  • $PROGRAMFILES/OptBP/EventLog/EventLog.runtimeconfig.dev.json
  • $PROGRAMFILES/OptBP/EventLog/EventLog.runtimeconfig.json
  • $PROGRAMFILES/OptBP/EventLog/hostfxr.dll
    .dll windows:6 windows x86 arch:x86

    058c12677b7a477b55814409da043d33


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/OptBP/EventLog/hostpolicy.dll
    .dll windows:6 windows x86 arch:x86

    d5f5198dea3a102f2a09ab3999b5bf33


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/OptBP/IdentityModel.OidcClient.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/IdentityModel.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Interface.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Connections.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Hosting.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Hosting.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Http.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Http.Extensions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Http.Features.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Http.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Server.Kestrel.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Server.Kestrel.Https.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.Server.Kestrel.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.AspNetCore.WebUtilities.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Configuration.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Configuration.Binder.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Configuration.EnvironmentVariables.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Configuration.FileExtensions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Configuration.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.DependencyInjection.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.DependencyInjection.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.FileProviders.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.FileProviders.Physical.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.FileSystemGlobbing.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Hosting.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Logging.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Logging.EventLog.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Logging.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.ObjectPool.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Options.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Extensions.Primitives.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.IdentityModel.Logging.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.IdentityModel.Tokens.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Microsoft.Net.Http.Headers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/OptBP Desktop.deps.json
  • $PROGRAMFILES/OptBP/OptBP Desktop.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/OptBP Desktop.exe
    .exe windows:6 windows x86 arch:x86

    ffff45487d1e51fa972c8409931457df


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/OptBP Desktop.runtimeconfig.json
  • $PROGRAMFILES/OptBP/Resources/Favicon.ico
  • $PROGRAMFILES/OptBP/Serilog.Extensions.Logging.File.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Serilog.Extensions.Logging.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Serilog.Formatting.Compact.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Serilog.Sinks.Async.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Serilog.Sinks.File.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Serilog.Sinks.RollingFile.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Serilog.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.CodeDom.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.Formats.Asn1.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.IO.Pipelines.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.IdentityModel.Tokens.Jwt.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.Management.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.Security.Cryptography.Pkcs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/System.Security.Cryptography.Xml.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/TPP.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Test.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Utilities.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/Vision.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/XML/FileRecord_ProblemRequest.xml
  • $PROGRAMFILES/OptBP/XML/FileRecord_Summary.xml
  • $PROGRAMFILES/OptBP/XML/FileRecord_Summary_noBP.xml
  • $PROGRAMFILES/OptBP/XML/FileRecord_Summary_onlyBP.xml
  • $PROGRAMFILES/OptBP/XML/GetActiveUsers.xml
  • $PROGRAMFILES/OptBP/XML/GetCurrentPatientIdExample.xml
  • $PROGRAMFILES/OptBP/XML/GetDemographicsRequest.xml
  • $PROGRAMFILES/OptBP/XML/GetRecordRequest.xml
  • $PROGRAMFILES/OptBP/XML/XML/FileRecord_ProblemRequest.xml
  • $PROGRAMFILES/OptBP/XML/XML/FileRecord_Summary.xml
  • $PROGRAMFILES/OptBP/XML/XML/FileRecord_Summary_noBP.xml
  • $PROGRAMFILES/OptBP/XML/XML/FileRecord_Summary_onlyBP.xml
  • $PROGRAMFILES/OptBP/XML/XML/GetActiveUsers.xml
  • $PROGRAMFILES/OptBP/XML/XML/GetCurrentPatientIdExample.xml
  • $PROGRAMFILES/OptBP/XML/XML/GetDemographicsRequest.xml
  • $PROGRAMFILES/OptBP/XML/XML/GetRecordRequest.xml
  • $PROGRAMFILES/OptBP/appsettings.json
  • $PROGRAMFILES/OptBP/favicon.ico
  • $PROGRAMFILES/OptBP/ref/OptBP Desktop.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/runtimes/win/lib/net6.0/System.Management.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/OptBP/runtimes/win/lib/net6.0/System.Security.Cryptography.Pkcs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections