Avira Phantom VPN Pro 2[.]41[.]1[.]25731[.]kuyhAa[.]7z | Triage

Sharing

General

Target

Avira Phantom VPN Pro 2.41.1.25731.kuyhAa.7z
Size

7.2MB
MD5

07f25861b7118c243ed05a75d79a8492
SHA1

65b72c0c0fa9d1fd6b00964faf7dd0b45ad10a45
SHA256

3d829d5826297e66e2471fa4c0b4a7fc23e784ca1cdca0288c435f367bb912d1
SHA512

4ce43f32ab7271f1c9e7bcf8722f2ecb1b46a1e48dcd618c59edc8c51401890590b4d89e0ce489dee2264f64968941f6905b9a31d57abdef262a1ca2741a48c8
SSDEEP

196608:L8+XQMbvtkVzQTl+Kx4x9/LUP1oLaF5s3iR0GsIdyt:L8kxvGVzs+1oPmGFXegdyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Avira Phantom VPN Pro 2.41.1.25731.kuyhAa/Avira Phantom VPN 2.41.1.25731.exe

Files

Avira Phantom VPN Pro 2.41.1.25731.kuyhAa.7z
.7z
Avira Phantom VPN Pro 2.41.1.25731.kuyhAa/Avira Phantom VPN 2.41.1.25731.exe
.exe windows:1 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Avira Phantom VPN Pro 2.41.1.25731.kuyhAa/VERYSILENT.url
Avira Phantom VPN Pro 2.41.1.25731.kuyhAa/_Silent Install.cmd
Avira Phantom VPN Pro 2.41.1.25731.kuyhAa/kuyhAa.Me.url
Avira Phantom VPN Pro 2.41.1.25731.kuyhAa/www.kuyhAa.Me.url