General

  • Target

    removeanysetup.exe

  • Size

    933KB

  • MD5

    4482b838f6d026d85bbdec727628123b

  • SHA1

    900b647d528a7c459657e0c56b787029718111a1

  • SHA256

    1b2ae3a9e73dd8d91429df6330a89f60484aa1294585fb37937f3c9bea9ded4b

  • SHA512

    ae3fe91433a13cb18ff313f09a536bbe2ec4f30ecfcd16accfdacc9e6f48c99f6563363773550a032931bc94042cd96463673c0afd9362096887ac9d1b98c388

  • SSDEEP

    24576:tfujL3JXQMvhMrhIstaTxWlJwCwJRD8tBYdoLf:gjL3N/JMrhEWlJnwfD8tBYaf

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • removeanysetup.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GetVersion.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    add11ce79d4925abda7b305cc53287d2


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSSCM.DLL
    .dll windows:4 windows x86 arch:x86

    Password: infected

    cae3b41a07819ca715746a4d081b8a6c


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Drivers/RemoveAny.sys
    .sys windows:6 windows x86 arch:x86

    addbd323bbef183bd0ae98558ac2934c


    Code Sign

    Headers

    Imports

    Sections

  • BugTrap.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    1b7b645004f22e7cf6cf83d958ceee2d


    Headers

    Imports

    Exports

    Sections

  • cfu.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    6baf87bb723ea21184d064e4dd4b49dd


    Code Sign

    Headers

    Imports

    Sections

  • dbghelp.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    e246e1939eedffac25310343ba57d266


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lang/1031.txt
  • lang/1033.txt
  • lang/1036.txt
  • lang/1040.txt
  • lang/1049.txt
  • lang/2070.txt
  • lang/3082.txt
  • license.txt
  • lua5.1.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    3c694bdf5ae536700daecd20f13c2718


    Headers

    Imports

    Exports

    Sections

  • removeany.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    cedfb10f525305e54e39209491043bdd


    Code Sign

    Headers

    Imports

    Sections

  • removeany.exe.manifest
    .xml
  • removeany.xml
    .xml
  • uninstall.exe.nsis