General

  • Target

    Install_Xfer_Serum_Update_121b4.exe

  • Size

    18.1MB

  • MD5

    bf780153220b5dab9447de1628993033

  • SHA1

    f20b68a1580828a6ec96382ea68d2d8f077bb8b3

  • SHA256

    f58a1afc1dc58f057f867bba61d28fb42496200665a0a60b9a0024a1834198a5

  • SHA512

    63a7b1dfb7aebaa9e484458e130c654be7e92949a4406dd54bf6eb3b26b565931039e201152fff0f67ba76d8e2405511de5270a0418d3049130978a2933a68f3

  • SSDEEP

    393216:SYz7lmQprVTplYrDRcFZmlnPCKmvmFe+cTsbWY/I3nEvn6r:S87MQdVj0qbGnPgvmBcTsSYQ3nOy

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • Install_Xfer_Serum_Update_121b4.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/AdvSplash.dll
    .dll windows:4 windows x86 arch:x86

    741b6bafe355b63a372d737b30543a95


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/splash.bmp
  • $_12_/Serum_x64.dll
    .dll windows:5 windows x64 arch:x64

    a6f30ce6a9e68cf04c37fc6de028da6f


    Headers

    Imports

    Exports

    Sections

  • $_13_/Skins/Default/1x/bmp00128.png
    .png
  • $_13_/Skins/Default/1x/bmp00129.png
    .png
  • $_13_/Skins/Default/1x/bmp00130.png
    .png
  • $_13_/Skins/Default/1x/bmp00131.png
    .png
  • $_13_/Skins/Default/1x/bmp00132.png
    .png
  • $_13_/Skins/Default/1x/bmp00133.png
    .png
  • $_13_/Skins/Default/1x/bmp00135.png
    .png
  • $_13_/Skins/Default/1x/bmp00136.png
    .png
  • $_13_/Skins/Default/1x/bmp00137.png
    .png
  • $_13_/Skins/Default/1x/bmp00138.png
    .png
  • $_13_/Skins/Default/1x/bmp00139.png
    .png
  • $_13_/Skins/Default/1x/bmp00140.png
    .png
  • $_13_/Skins/Default/1x/bmp00141.png
    .png
  • $_13_/Skins/Default/1x/bmp00142.png
    .png
  • $_13_/Skins/Default/1x/bmp00143.png
    .png
  • $_13_/Skins/Default/1x/bmp00144.png
    .png
  • $_13_/Skins/Default/1x/bmp00145.png
    .png
  • $_13_/Skins/Default/1x/bmp00146.png
    .png
  • $_13_/Skins/Default/1x/bmp00147.png
    .png
  • $_13_/Skins/Default/1x/bmp00148.png
    .png
  • $_13_/Skins/Default/1x/bmp00149.png
    .png
  • $_13_/Skins/Default/1x/bmp00150.png
    .png
  • $_13_/Skins/Default/1x/bmp00151.png
    .png
  • $_13_/Skins/Default/1x/bmp00152.png
    .png
  • $_13_/Skins/Default/1x/bmp00153.png
    .png
  • $_13_/Skins/Default/1x/bmp00154.png
    .png
  • $_13_/Skins/Default/1x/bmp00155.png
    .png
  • $_13_/Skins/Default/1x/bmp00156.png
    .png
  • $_13_/Skins/Default/1x/bmp00157.png
    .png
  • $_13_/Skins/Default/1x/bmp00158.png
    .png
  • $_13_/Skins/Default/1x/bmp00159.png
    .png
  • $_13_/Skins/Default/1x/bmp00160.png
    .png
  • $_13_/Skins/Default/1x/bmp00161.png
    .png
  • $_13_/Skins/Default/1x/bmp00162.png
    .png
  • $_13_/Skins/Default/1x/bmp00163.png
    .png
  • $_13_/Skins/Default/1x/bmp00164.png
    .png
  • $_13_/Skins/Default/1x/bmp00165.png
    .png
  • $_13_/Skins/Default/1x/bmp00166.png
    .png
  • $_13_/Skins/Default/1x/bmp00167.png
    .png
  • $_13_/Skins/Default/1x/bmp00168.png
    .png
  • $_13_/Skins/Default/1x/bmp00169.png
    .png
  • $_13_/Skins/Default/1x/bmp00170.png
    .png
  • $_13_/Skins/Default/1x/bmp00171.png
    .png
  • $_13_/Skins/Default/1x/bmp00172.png
    .png
  • $_13_/Skins/Default/1x/bmp00173.png
    .png
  • $_13_/Skins/Default/1x/bmp00174.png
    .png
  • $_13_/Skins/Default/1x/bmp00175.png
    .png
  • $_13_/Skins/Default/1x/bmp00176.png
    .png
  • $_13_/Skins/Default/1x/bmp00177.png
    .png
  • $_13_/Skins/Default/1x/bmp00178.png
    .png
  • $_13_/Skins/Default/1x/bmp00179.png
    .png
  • $_13_/Skins/Default/1x/bmp00180.png
    .png
  • $_13_/Skins/Default/1x/bmp00181.png
    .png
  • $_13_/Skins/Default/1x/bmp00182.png
    .png
  • $_13_/Skins/Default/1x/bmp00183.png
    .png
  • $_13_/Skins/Default/1x/bmp00184.png
    .png
  • $_13_/Skins/Default/1x/bmp00185.png
    .png
  • $_13_/Skins/Default/1x/bmp00186.png
    .png
  • $_13_/Skins/Default/1x/bmp00187.png
    .png
  • $_13_/Skins/Default/1x/bmp00188.png
    .png
  • $_13_/Skins/Default/1x/bmp00189.png
    .png
  • $_13_/Skins/Default/1x/bmp00190.png
    .png
  • $_13_/Skins/Default/1x/bmp00191.png
    .png
  • $_13_/Skins/Default/1x/bmp00192.png
    .png
  • $_13_/Skins/Default/1x/bmp00193.png
    .png
  • $_13_/Skins/Default/1x/bmp00194.png
    .png
  • $_13_/Skins/Default/1x/bmp00195.png
    .png
  • $_13_/Skins/Default/1x/bmp00196.png
    .png
  • $_13_/Skins/Default/1x/bmp00197.png
    .png
  • $_13_/Skins/Default/1x/bmp00198.png
    .png
  • $_13_/Skins/Default/1x/bmp00199.png
    .png
  • $_13_/Skins/Default/1x/bmp00200.png
    .png
  • $_13_/Skins/Default/1x/bmp00201.png
    .png
  • $_13_/Skins/Default/1x/bmp00202.png
    .png
  • $_13_/Skins/Default/1x/bmp00203.png
    .png
  • $_13_/Skins/Default/1x/bmp00204.png
    .png
  • $_13_/Skins/Default/1x/bmp00205.png
    .png
  • $_13_/Skins/Default/1x/bmp00206.png
    .png
  • $_13_/Skins/Default/1x/bmp00207.png
    .png
  • $_13_/Skins/Default/1x/bmp00208.png
    .png
  • $_13_/Skins/Default/1x/bmp00209.png
    .png
  • $_13_/Skins/Default/1x/bmp00210.png
    .png
  • $_13_/Skins/Default/1x/bmp00211.png
    .png
  • $_13_/Skins/Default/1x/bmp00212.png
    .png
  • $_13_/Skins/Default/1x/bmp00213.png
    .png
  • $_13_/Skins/Default/1x/bmp00214.png
    .png
  • $_13_/Skins/Default/1x/bmp00215.png
    .png
  • $_13_/Skins/Default/1x/bmp00216.png
    .png
  • $_13_/Skins/Default/1x/bmp00217.png
    .png
  • $_13_/Skins/Default/1x/bmp00219.png
    .png
  • $_13_/Skins/Default/1x/bmp00220.png
    .png
  • $_13_/Skins/Default/1x/bmp00221.png
    .png
  • $_13_/Skins/Default/1x/bmp00222.png
    .png
  • $_13_/Skins/Default/1x/bmp00223.png
    .png
  • $_13_/Skins/Default/1x/bmp00224.png
    .png
  • $_13_/Skins/Default/1x/bmp00225.png
    .png
  • $_13_/Skins/Default/1x/bmp00226.png
    .png
  • $_13_/Skins/Default/1x/bmp00227.png
    .png
  • $_13_/Skins/Default/1x/bmp00228.png
    .png
  • $_13_/Skins/Default/1x/bmp00229.png
    .png
  • $_13_/Skins/Default/1x/bmp00230.png
    .png
  • $_13_/Skins/Default/1x/bmp00231.png
    .png
  • $_13_/Skins/Default/1x/bmp00232.png
    .png
  • $_13_/Skins/Default/1x/bmp00233.png
    .png
  • $_13_/Skins/Default/1x/bmp00234.png
    .png
  • $_13_/Skins/Default/1x/bmp00235.png
    .png
  • $_13_/Skins/Default/1x/bmp00236.png
    .png
  • $_13_/Skins/Default/1x/bmp00237.png
    .png
  • $_13_/Skins/Default/1x/bmp00238.png
    .png
  • $_13_/Skins/Default/1x/bmp00239.png
    .png
  • $_13_/Skins/Default/1x/bmp00240.png
    .png
  • $_13_/Skins/Default/1x/bmp00241.png
    .png
  • $_13_/Skins/Default/1x/bmp00242.png
    .png
  • $_13_/Skins/Default/1x/bmp00243.png
    .png
  • $_13_/Skins/Default/1x/bmp00244.png
    .png
  • $_13_/Skins/Default/1x/bmp00245.png
    .png
  • $_13_/Skins/Default/1x/bmp00246.png
    .png
  • $_13_/Skins/Default/1x/bmp00247.png
    .png
  • $_13_/Skins/Default/1x/bmp00248.png
    .png
  • $_13_/Skins/Default/1x/bmp00249.png
    .png
  • $_13_/Skins/Default/1x/bmp00250.png
    .png
  • $_13_/Skins/Default/1x/bmp00251.png
    .png
  • $_13_/Skins/Default/1x/bmp00252.png
    .png
  • $_13_/Skins/Default/1x/bmp00253.png
    .png
  • $_13_/Skins/Default/1x/bmp00254.png
    .png
  • $_13_/Skins/Default/1x/bmp00255.png
    .png
  • $_13_/Skins/Default/1x/bmp00256.png
    .png
  • $_13_/Skins/Default/1x/bmp00257.png
    .png
  • $_13_/Skins/Default/1x/bmp00258.png
    .png
  • $_13_/Skins/Default/1x/bmp00259.png
    .png
  • $_13_/Skins/Default/1x/bmp00260.png
    .png
  • $_13_/Skins/Default/1x/bmp00262.png
    .png
  • $_13_/Skins/Default/1x/bmp00265.png
    .png
  • $_13_/Skins/Default/1x/bmp00266.png
    .png
  • $_13_/Skins/Default/1x/bmp00267.png
    .png
  • $_13_/Skins/Default/1x/bmp00268.png
    .png
  • $_13_/Skins/Default/1x/bmp00269.png
    .png
  • $_13_/Skins/Default/1x/bmp00270.png
    .png
  • $_13_/Skins/Default/2x/bmp00154.png
    .png
  • $_13_/Skins/Default/2x/bmp20128.png
    .png
  • $_13_/Skins/Default/2x/bmp20129.png
    .png
  • $_13_/Skins/Default/2x/bmp20130.png
    .png
  • $_13_/Skins/Default/2x/bmp20131.png
    .png
  • $_13_/Skins/Default/2x/bmp20132.png
    .png
  • $_13_/Skins/Default/2x/bmp20133.png
    .png
  • $_13_/Skins/Default/2x/bmp20135.png
    .png
  • $_13_/Skins/Default/2x/bmp20136.png
    .png
  • $_13_/Skins/Default/2x/bmp20137.png
    .png
  • $_13_/Skins/Default/2x/bmp20138.png
    .png
  • $_13_/Skins/Default/2x/bmp20139.png
    .png
  • $_13_/Skins/Default/2x/bmp20140.png
    .png
  • $_13_/Skins/Default/2x/bmp20141.png
    .png
  • $_13_/Skins/Default/2x/bmp20142.png
    .png
  • $_13_/Skins/Default/2x/bmp20143.png
    .png
  • $_13_/Skins/Default/2x/bmp20144.png
    .png
  • $_13_/Skins/Default/2x/bmp20145.png
    .png
  • $_13_/Skins/Default/2x/bmp20146.png
    .png
  • $_13_/Skins/Default/2x/bmp20147.png
    .png
  • $_13_/Skins/Default/2x/bmp20148.png
    .png
  • $_13_/Skins/Default/2x/bmp20149.png
    .png
  • $_13_/Skins/Default/2x/bmp20150.png
    .png
  • $_13_/Skins/Default/2x/bmp20151.png
    .png
  • $_13_/Skins/Default/2x/bmp20152.png
    .png
  • $_13_/Skins/Default/2x/bmp20153.png
    .png
  • $_13_/Skins/Default/2x/bmp20154.png
    .png
  • $_13_/Skins/Default/2x/bmp20155.png
    .png
  • $_13_/Skins/Default/2x/bmp20156.png
    .png
  • $_13_/Skins/Default/2x/bmp20157.png
    .png
  • $_13_/Skins/Default/2x/bmp20158.png
    .png
  • $_13_/Skins/Default/2x/bmp20159.png
    .png
  • $_13_/Skins/Default/2x/bmp20160.png
    .png
  • $_13_/Skins/Default/2x/bmp20161.png
    .png
  • $_13_/Skins/Default/2x/bmp20162.png
    .png
  • $_13_/Skins/Default/2x/bmp20163.png
    .png
  • $_13_/Skins/Default/2x/bmp20164.png
    .png
  • $_13_/Skins/Default/2x/bmp20165.png
    .png
  • $_13_/Skins/Default/2x/bmp20166.png
    .png
  • $_13_/Skins/Default/2x/bmp20167.png
    .png
  • $_13_/Skins/Default/2x/bmp20168.png
    .png
  • $_13_/Skins/Default/2x/bmp20169.png
    .png
  • $_13_/Skins/Default/2x/bmp20170.png
    .png
  • $_13_/Skins/Default/2x/bmp20171.png
    .png
  • $_13_/Skins/Default/2x/bmp20172.png
    .png
  • $_13_/Skins/Default/2x/bmp20173.png
    .png
  • $_13_/Skins/Default/2x/bmp20174.png
    .png
  • $_13_/Skins/Default/2x/bmp20175.png
    .png
  • $_13_/Skins/Default/2x/bmp20176.png
    .png
  • $_13_/Skins/Default/2x/bmp20177.png
    .png
  • $_13_/Skins/Default/2x/bmp20178.png
    .png
  • $_13_/Skins/Default/2x/bmp20179.png
    .png
  • $_13_/Skins/Default/2x/bmp20180.png
    .png
  • $_13_/Skins/Default/2x/bmp20181.png
    .png
  • $_13_/Skins/Default/2x/bmp20182.png
    .png
  • $_13_/Skins/Default/2x/bmp20183.png
    .png
  • $_13_/Skins/Default/2x/bmp20184.png
    .png
  • $_13_/Skins/Default/2x/bmp20185.png
    .png
  • $_13_/Skins/Default/2x/bmp20186.png
    .png
  • $_13_/Skins/Default/2x/bmp20187.png
    .png
  • $_13_/Skins/Default/2x/bmp20188.png
    .png
  • $_13_/Skins/Default/2x/bmp20189.png
    .png
  • $_13_/Skins/Default/2x/bmp20190.png
    .png
  • $_13_/Skins/Default/2x/bmp20191.png
    .png
  • $_13_/Skins/Default/2x/bmp20192.png
    .png
  • $_13_/Skins/Default/2x/bmp20193.png
    .png
  • $_13_/Skins/Default/2x/bmp20194.png
    .png
  • $_13_/Skins/Default/2x/bmp20195.png
    .png
  • $_13_/Skins/Default/2x/bmp20196.png
    .png
  • $_13_/Skins/Default/2x/bmp20197.png
    .png
  • $_13_/Skins/Default/2x/bmp20198.png
    .png
  • $_13_/Skins/Default/2x/bmp20199.png
    .png
  • $_13_/Skins/Default/2x/bmp20200.png
    .png
  • $_13_/Skins/Default/2x/bmp20201.png
    .png
  • $_13_/Skins/Default/2x/bmp20202.png
    .png
  • $_13_/Skins/Default/2x/bmp20203.png
    .png
  • $_13_/Skins/Default/2x/bmp20204.png
    .png
  • $_13_/Skins/Default/2x/bmp20205.png
    .png
  • $_13_/Skins/Default/2x/bmp20206.png
    .png
  • $_13_/Skins/Default/2x/bmp20207.png
    .png
  • $_13_/Skins/Default/2x/bmp20208.png
    .png
  • $_13_/Skins/Default/2x/bmp20209.png
    .png
  • $_13_/Skins/Default/2x/bmp20210.png
    .png
  • $_13_/Skins/Default/2x/bmp20211.png
    .png
  • $_13_/Skins/Default/2x/bmp20212.png
    .png
  • $_13_/Skins/Default/2x/bmp20213.png
    .png
  • $_13_/Skins/Default/2x/bmp20214.png
    .png
  • $_13_/Skins/Default/2x/bmp20215.png
    .png
  • $_13_/Skins/Default/2x/bmp20216.png
    .png
  • $_13_/Skins/Default/2x/bmp20217.png
    .png
  • $_13_/Skins/Default/2x/bmp20219.png
    .png
  • $_13_/Skins/Default/2x/bmp20220.png
    .png
  • $_13_/Skins/Default/2x/bmp20221.png
    .png
  • $_13_/Skins/Default/2x/bmp20222.png
    .png
  • $_13_/Skins/Default/2x/bmp20223.png
    .png
  • $_13_/Skins/Default/2x/bmp20224.png
    .png
  • $_13_/Skins/Default/2x/bmp20225.png
    .png
  • $_13_/Skins/Default/2x/bmp20226.png
    .png
  • $_13_/Skins/Default/2x/bmp20227.png
    .png
  • $_13_/Skins/Default/2x/bmp20228.png
    .png
  • $_13_/Skins/Default/2x/bmp20229.png
    .png
  • $_13_/Skins/Default/2x/bmp20230.png
    .png
  • $_13_/Skins/Default/2x/bmp20231.png
    .png
  • $_13_/Skins/Default/2x/bmp20232.png
    .png
  • $_13_/Skins/Default/2x/bmp20233.png
    .png
  • $_13_/Skins/Default/2x/bmp20234.png
    .png
  • $_13_/Skins/Default/2x/bmp20235.png
    .png
  • $_13_/Skins/Default/2x/bmp20236.png
    .png
  • $_13_/Skins/Default/2x/bmp20237.png
    .png
  • $_13_/Skins/Default/2x/bmp20238.png
    .png
  • $_13_/Skins/Default/2x/bmp20239.png
    .png
  • $_13_/Skins/Default/2x/bmp20240.png
    .png
  • $_13_/Skins/Default/2x/bmp20241.png
    .png
  • $_13_/Skins/Default/2x/bmp20242.png
    .png
  • $_13_/Skins/Default/2x/bmp20243.png
    .png
  • $_13_/Skins/Default/2x/bmp20244.png
    .png
  • $_13_/Skins/Default/2x/bmp20245.png
    .png
  • $_13_/Skins/Default/2x/bmp20246.png
    .png
  • $_13_/Skins/Default/2x/bmp20247.png
    .png
  • $_13_/Skins/Default/2x/bmp20248.png
    .png
  • $_13_/Skins/Default/2x/bmp20249.png
    .png
  • $_13_/Skins/Default/2x/bmp20250.png
    .png
  • $_13_/Skins/Default/2x/bmp20251.png
    .png
  • $_13_/Skins/Default/2x/bmp20252.png
    .png
  • $_13_/Skins/Default/2x/bmp20253.png
    .png
  • $_13_/Skins/Default/2x/bmp20254.png
    .png
  • $_13_/Skins/Default/2x/bmp20255.png
    .png
  • $_13_/Skins/Default/2x/bmp20256.png
    .png
  • $_13_/Skins/Default/2x/bmp20257.png
    .png
  • $_13_/Skins/Default/2x/bmp20258.png
    .png
  • $_13_/Skins/Default/2x/bmp20259.png
    .png
  • $_13_/Skins/Default/2x/bmp20260.png
    .png
  • $_13_/Skins/Default/2x/bmp20262.png
    .png
  • $_13_/Skins/Default/2x/bmp20265.png
    .png
  • $_13_/Skins/Default/2x/bmp20266.png
    .png
  • $_13_/Skins/Default/2x/bmp20267.png
    .png
  • $_13_/Skins/Default/2x/bmp20268.png
    .png
  • $_13_/Skins/Default/2x/bmp20269.png
    .png
  • $_13_/Skins/Default/2x/bmp20270.png
    .png
  • $_13_/Skins/Default/Fonts/Nunito-Regular.ttf
  • $_13_/Skins/Default/Fonts/OFL.txt
  • C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/Contents/Win32/Serum.aaxplugin
    .dll windows:6 windows x86 arch:x86

    4c8d31cc56985625860a91362dc62131


    Headers

    Imports

    Exports

    Sections

  • C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/Contents/x64/Serum.aaxplugin
    .dll windows:5 windows x64 arch:x64

    9fdc08aac25be749c01bf89f807c6af9


    Headers

    Imports

    Exports

    Sections

  • C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/PlugIn.ico
  • C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/desktop.ini
  • C:/Program Files/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/Contents/Win32/Serum.aaxplugin
    .dll windows:6 windows x86 arch:x86

    4c8d31cc56985625860a91362dc62131


    Headers

    Imports

    Exports

    Sections

  • C:/Program Files/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/Contents/x64/Serum.aaxplugin
    .dll windows:5 windows x64 arch:x64

    9fdc08aac25be749c01bf89f807c6af9


    Headers

    Imports

    Exports

    Sections

  • C:/Program Files/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/PlugIn.ico
  • C:/Program Files/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/desktop.ini
  • Serum.dll
    .dll windows:5 windows x86 arch:x86

    0880e29664022f4c8bcda0cae03d2de0


    Headers

    Imports

    Exports

    Sections