General

  • Target

    -#[8485_as_pAs$codE]#-.rar

  • Size

    24.2MB

  • MD5

    711e0960dbbed162bb033ac9ff40f5b3

  • SHA1

    5a184bdcb712cec9309f17008f9e898fe2267a4c

  • SHA256

    0616e3db93248deda7f9d435f98a117f66be7c3e5538b42cb54e3dbf2e0d9130

  • SHA512

    760476a04bd82ad130c40612869839af43455349b3cf9436485551fecfa90da00e198b6381b7bde32991fea91988e771bc6f22a0520eb4fdd8db6cd0ba429f66

  • SSDEEP

    393216:GHjuSXkZD8Tv1fbOChwMfsUKEzrE29fEgcU+KSCXFRmuEo1qwzkL4M8y6Xy:hSYG1yCDf7NkgcUzXFAuRqwY6C

Score
3/10

Malware Config

Signatures

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • -#[8485_as_pAs$codE]#-.rar
    .rar

    Password: 8485

  • ProductStatistics3.dll
    .dll windows:5 windows x86 arch:x86

    Password: 8485

    5fd2f6e1202704acb8b9f04e0a443bdd


    Headers

    Imports

    Exports

    Sections

  • Set-up.exe
    .exe windows:5 windows x86 arch:x86

    Password: 8485

    fa6e81994d6cccb7aa417b58a8698fdf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • config.prx
    .exe windows:5 windows x86 arch:x86

    Password: 8485

    d21794f0d47bb5c7f5977a6500854d85


    Code Sign

    Headers

    Imports

    Sections

  • kqgb
  • uchjj
  • updater/NvStWiz.prx
    .exe windows:6 windows x86 arch:x86

    Password: 8485

    a7e73ef2207e9ee97c678506145e1258


    Code Sign

    Headers

    Imports

    Sections

  • updater/Register.dll
    .dll windows:5 windows x86 arch:x86

    Password: 8485

    ee94d9d14cff80538936ff9d276ecfc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • updater/carferry.flv
  • updater/libvlccore.dll
    .dll windows:4 windows x86 arch:x86

    Password: 8485

    f11716690dc3b1ac312b344caaf28102


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • updater/manager/ks_tyres.ini
  • updater/resource_/CMap/Identity-H
  • updater/resource_/CMap/Identity-V
  • updater/resource_/CMap/UCS2-GBK-EUC
  • updater/resource_/CMap/UniKS-UTF16-H
  • updater/resource_/CMap/UniKS-UTF16-V
  • updater/resource_/Font/AdobePIStd.otf
  • updater/resource_/Font/CourierStd-Bold.otf
  • updater/resource_/Font/CourierStd-BoldOblique.otf
  • updater/resource_/Font/CourierStd-Oblique.otf
  • updater/resource_/Font/CourierStd.otf
  • updater/resource_/Font/MinionPro-Bold.otf
  • updater/resource_/Font/MinionPro-BoldIt.otf
  • updater/resource_/Font/MinionPro-It.otf
  • updater/resource_/Font/MinionPro-Regular.otf
  • updater/resource_/Font/MyriadPro-Bold.otf
  • updater/resource_/Font/MyriadPro-BoldIt.otf
  • updater/resource_/Font/MyriadPro-It.otf
  • updater/resource_/Font/MyriadPro-Regular.otf
  • updater/resource_/Font/Pfm/CMap/Identity-H
  • updater/resource_/Font/Pfm/CMap/Identity-V
  • updater/resource_/Font/Pfm/CMap/UCS2-GBK-EUC
  • updater/resource_/Font/Pfm/CMap/UniKS-UTF16-H
  • updater/resource_/Font/Pfm/CMap/UniKS-UTF16-V
  • updater/resource_/Font/Pfm/Font/AdobePIStd.otf
  • updater/resource_/Font/Pfm/Font/CourierStd-Bold.otf
  • updater/resource_/Font/Pfm/Font/CourierStd-BoldOblique.otf
  • updater/resource_/Font/Pfm/Font/CourierStd-Oblique.otf
  • updater/resource_/Font/Pfm/Font/CourierStd.otf
  • updater/resource_/Font/Pfm/Font/MinionPro-Bold.otf
  • updater/resource_/Font/Pfm/Font/MinionPro-BoldIt.otf
  • updater/resource_/Font/Pfm/Font/MinionPro-It.otf
  • updater/resource_/Font/Pfm/Font/MinionPro-Regular.otf
  • updater/resource_/Font/Pfm/Font/MyriadPro-Bold.otf
  • updater/resource_/Font/Pfm/Font/MyriadPro-BoldIt.otf
  • updater/resource_/Font/Pfm/Font/MyriadPro-It.otf
  • updater/resource_/Font/Pfm/Font/MyriadPro-Regular.otf
  • updater/resource_/Font/Pfm/Font/Pfm/SY______.PFM
  • updater/resource_/Font/Pfm/Font/Pfm/zx______.pfm
  • updater/resource_/Font/Pfm/Font/Pfm/zy______.pfm
  • updater/resource_/Font/Pfm/Font/SY______.PFB
  • updater/resource_/Font/Pfm/Font/ZX______.PFB
  • updater/resource_/Font/Pfm/Font/ZY______.PFB
  • updater/resource_/Font/Pfm/Locals/am.pak
  • updater/resource_/Font/Pfm/Locals/ar.pak
  • updater/resource_/Font/Pfm/Locals/fi.pak
  • updater/resource_/Font/Pfm/Locals/fil.pak
  • updater/resource_/Font/Pfm/Locals/fr.pak
  • updater/resource_/Font/Pfm/Locals/gu.pak
  • updater/resource_/Font/Pfm/Locals/he.pak
  • updater/resource_/Font/Pfm/Locals/hi.pak
  • updater/resource_/Font/Pfm/Locals/hr.pak
  • updater/resource_/Font/Pfm/Locals/hu.pak
  • updater/resource_/Font/Pfm/Locals/id.pak
  • updater/resource_/Font/Pfm/Locals/lt.pak
  • updater/resource_/Font/Pfm/Locals/lv.pak
  • updater/resource_/Font/Pfm/Locals/x64/AdonisUI.ClassicTheme.dll
    .dll windows:4 windows x86 arch:x86

    Password: 8485

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • updater/resource_/Font/Pfm/Locals/x64/AdonisUI.ClassicTheme.xml
    .xml
  • updater/resource_/Font/Pfm/Locals/x64/AdonisUI.dll
    .dll windows:4 windows x86 arch:x86

    Password: 8485

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • updater/resource_/Font/Pfm/Locals/x64/AdonisUI.xml
    .xml
  • updater/resource_/Font/Pfm/Locals/x64/SQLite.Interop.dll
    .dll windows:6 windows x64 arch:x64

    a42f73521c784fa06f1d886fcbcefcba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • updater/resource_/Font/Pfm/Locals/x86/BouncyCastle.Crypto.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • updater/resource_/Font/Pfm/Locals/x86/BouncyCastle.Crypto.xml
    .xml
  • updater/resource_/Font/Pfm/Locals/x86/SQLite.Interop.dll
    .dll windows:6 windows x86 arch:x86

    39ace63b362beb47a2a7a8202a5c4f2d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • updater/resource_/Font/Pfm/SY______.PFM
  • updater/resource_/Font/Pfm/SaslPrep/SaslPrepProfile_norm_bidi.spp
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/ICU/icudt26l.dat
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Adobe/symbol.txt
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Adobe/zdingbat.txt
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/CENTEURO.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/CORPCHAR.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/CROATIAN.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/CYRILLIC.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/GREEK.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/ICELAND.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/ROMAN.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/ROMANIAN.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/SYMBOL.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/TURKISH.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/Mac/UKRAINE.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1250.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1251.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1252.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1253.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1254.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1257.TXT
  • updater/resource_/Font/Pfm/TypeSupport/Unicode/Mappings/win/CP1258.TXT
  • updater/resource_/Font/Pfm/opengl64.dll
  • updater/resource_/Font/Pfm/resources.pak
  • updater/resource_/Font/Pfm/zx______.pfm
  • updater/resource_/Font/Pfm/zy______.pfm
  • updater/resource_/Font/SY______.PFB
  • updater/resource_/Font/ZX______.PFB
  • updater/resource_/Font/ZY______.PFB
  • updater/resource_/Register.dll
    .dll windows:5 windows x86 arch:x86

    ee94d9d14cff80538936ff9d276ecfc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • updater/resource_/carferry.flv
  • updater/resource_/glioma.asp
  • updater/resource_/libvlccore.dll
    .dll windows:4 windows x86 arch:x86

    f11716690dc3b1ac312b344caaf28102


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • updater/resource_/resources.pak
  • updater/resource_/rtl120.bpl
    .dll windows:5 windows x86 arch:x86

    71ef3c08452290b9b380ced40a0015c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/trading_api64.dll
    .dll windows:5 windows x64 arch:x64

    f7d326cb8fdda36f97bcf61c5e808a67


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/tradingnetworkingsockets.dll
    .dll windows:6 windows x64 arch:x64

    e917d42bcc53c047e3b944d762080d33


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x86/api-ms-win-core-processthreads-l1-1-1.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-profile-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-synch-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-synch-l1-2-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-timezone-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-core-util-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-conio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-environment-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-private-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • x86/api-ms-win-crt-process-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections