Overview

overview

8

Static

static

8

ec9c04d3f2...9c.exe

windows7-x64

3

ec9c04d3f2...9c.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...up.exe

windows7-x64

8

$PLUGINSDI...up.exe

windows10-2004-x64

8

To-do List.exe

windows7-x64

1

To-do List.exe

windows10-2004-x64

8

myapp.exe

windows7-x64

7

myapp.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ec9c04d3f23bf00312dcc765c8ca1724540f3cfdd69d5b36f77f11931057499c

  • Size

    12.8MB

  • MD5

    98468324bfa756fce580c75aab3a72d5

  • SHA1

    76787431c49979d8e86b224fa1c3057d96cd578d

  • SHA256

    ec9c04d3f23bf00312dcc765c8ca1724540f3cfdd69d5b36f77f11931057499c

  • SHA512

    5078f924acb0c13158a4aa8edf396b7e2bceee8ac2de0303b9fecf71fee009d13f0863bd7ce6ddca3ed1b9f50f5e037a768eb2908780748d6c875867aa2be6d0

  • SSDEEP

    393216:/fOF6WmxOlt944Be+6jRO1bPt2IpOvxgsk:/fH7x2HXl6jRobPr6gsk

Score
8/10
upx

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • ec9c04d3f23bf00312dcc765c8ca1724540f3cfdd69d5b36f77f11931057499c
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    85f08eb0cbec010ecbc287fa68321173


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
    .exe windows:5 windows x86 arch:x86

    ccc6e30409f96054ca558f4765d32e38


    Code Sign

    Headers

    Imports

    Sections

  • To-do List.exe
    .exe windows:6 windows x64 arch:x64

    c2d457ad8ac36fc9f18d45bffcd450c2


    Headers

    Imports

    Sections

  • myapp.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • out.upx
    .exe windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections