General

  • Target

    RG_Catalyst.zip

  • Size

    126.1MB

  • MD5

    cd8dd343134f809de578f18a4dd3c3fd

  • SHA1

    d993e0eee9a25032c7e30decb27b94152745d55e

  • SHA256

    fda962047f34516580b1c93e778a28df33e5aaa0ae8527918f126a82ba706f68

  • SHA512

    be8aa98411595eb359e4ac63daf9fd6f8cd403019cdef4b51e980563978ff036d940bbf613ff10297d9f0b07a9c9228c2d5951e8fc682dd06e90a2d3b23eb6d1

  • SSDEEP

    3145728:nOKtQpPJ4TeY/iCAD3cB1HrJAZkkqyIMfmNME5hg:XtmJRQiX3K5JADfmNp5hg

Score
3/10

Malware Config

Signatures

  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

Files

  • RG_Catalyst.zip
    .zip

    Password: 1234

  • Data/Extras.cab
    .cab

    Password: 1234

  • Acrobat_Elements.exe
    .exe windows:6 windows x64 arch:x64

    Password: 1234

    ca790508dce137e86a0d325808f1e24e


    Code Sign

    Headers

    Imports

    Sections

  • Adist.dll
    .dll windows:6 windows x86 arch:x86

    Password: 1234

    dd8ad3b5cc9a747adb16f013d9d88774


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Adist64.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1234

    d618b882dfae2701aebab0330e8fd517


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • AdobePDFMToolbarInst.dll2
    .dll windows:6 windows x86 arch:x86

    Password: 1234

    b3b49fe7212a0e0e7fd9ffcd315de394


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • COBO____.PFM
  • COB_____.PFM
  • COM_____.PFM
  • COO_____.PFM
  • DISTSADB.DOS
  • Dist_acrodist.exe
    .exe windows:6 windows x64 arch:x64

    Password: 1234

    75ab2442d34386c1b5a391814ef4b9a0


    Code Sign

    Headers

    Imports

    Sections

  • Dist_acrodistdll.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1234

    b6d39aecf555488fddd513ff5f51a5e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Dist_adistres.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1234

    d4755b9a9aec93c05c955ca11140bdc5


    Code Sign

    Headers

    Imports

    Sections

  • High_Quality_Print.joboption
  • High_Quality_Print.joboption1
  • MAGAZINE_Ad_2006_JPN.jobopti
  • Oversized_Pages.joboptions
  • Oversized_Pages.joboptions2
  • PDFA1b_2005_CMYK.joboptions1
  • PDFA1b_2005_CMYK.joboptions3
  • PDFA1b_2005_RGB.joboptions1
  • PDFA1b_2005_RGB.joboptions3
  • PDFMLotus_Lcppn.dll
    .dll windows:4 windows x86 arch:x86

    a8d7731213f116066b047256e0f9ce7c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PDFMLotus_PDFMLotusNotes.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    2aa398a48ca7808608da59e20213da36


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PDFMLotus_ndbPDFML.dll
    .dll windows:6 windows x86 arch:x86

    c58291bc0502903c5625ffc973348d28


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PDFMProject.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    ea3558d8e084ffc2599073090383e8da


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PDFMRKEX.PS1
  • PDFMVisio.vsl1
    .dll regsvr32 windows:6 windows x86 arch:x86

    41b60e9acb3be38184b6df68eb205f4b


    Headers

    Imports

    Exports

    Sections

  • PDFMVisio.vsl17
    .dll regsvr32 windows:6 windows x86 arch:x86

    41b60e9acb3be38184b6df68eb205f4b


    Headers

    Imports

    Exports

    Sections

  • PDFMVisio.vsl2
    .dll regsvr32 windows:6 windows x86 arch:x86

    41b60e9acb3be38184b6df68eb205f4b


    Headers

    Imports

    Exports

    Sections

  • PDFMVisio.vsl6
    .dll regsvr32 windows:6 windows x86 arch:x86

    41b60e9acb3be38184b6df68eb205f4b


    Headers

    Imports

    Exports

    Sections

  • PDFX1a_2001.joboptions1
  • PDFX1a_2001.joboptions2
  • PDFX1a_2001_JPN.joboptions2
  • PDFX1a_2003.joboptions3
  • PDFX1a_2003_JPN.joboptions2
  • PDFX3_2002.joboptions1
  • PDFX3_2002.joboptions3
  • PDFX3_2002_JPN.joboptions2
  • PDFX3_2003.joboptions
  • PDFX3_2003_JPN.joboptions3
  • PaperCapture.api
    .dll windows:6 windows x64 arch:x64

    68287225a809dfea7b26b5bf784e2695


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Press_Quality.joboptions
  • Press_Quality.joboptions2
  • RUNDIREX.TXT1
  • RUNFILEX.PS1
  • SelectPageRange.ocx
    .dll regsvr32 windows:6 windows x86 arch:x86

    9959a3646e8d9de03f1f20c1b4cdb671


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Smallest_File_Size.joboption
  • Smallest_File_Size.joboption2
  • Standard.joboptions1
  • StandardClassic.joboptions1
  • acrobatacadic.arx
    .dll regsvr32 windows:6 windows x64 arch:x64

    65081a5e02400920addf06f891881ac8


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.arx1
    .dll regsvr32 windows:6 windows x64 arch:x64

    887436a088c256e7b51845aa74328b3c


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.arx11
    .dll regsvr32 windows:6 windows x64 arch:x64

    9f107fa10b884c1477089567b01398eb


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.arx3
    .dll regsvr32 windows:5 windows x64 arch:x64

    cc9f9e61a9cb195686ca4012d4c2611a


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.arx4
    .dll regsvr32 windows:5 windows x64 arch:x64

    cc9f9e61a9cb195686ca4012d4c2611a


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.dbx
    .dll regsvr32 windows:6 windows x64 arch:x64

    4913d577c09047aa83f7e10197484ce1


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.dbx1
    .dll regsvr32 windows:6 windows x64 arch:x64

    58cf08bc782c2a78d50d5e455bc1cf4e


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.dbx11
    .dll regsvr32 windows:6 windows x64 arch:x64

    3e59e0d27b8038660267c73ffbfddd65


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.dbx3
    .dll regsvr32 windows:5 windows x64 arch:x64

    318c9de783ba4baa655e7bea09d179cd


    Headers

    Imports

    Exports

    Sections

  • acrobatacadic.dbx4
    .dll regsvr32 windows:5 windows x64 arch:x64

    318c9de783ba4baa655e7bea09d179cd


    Headers

    Imports

    Exports

    Sections

  • acrobatacadicribbon.dll
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • acrobatacadicribbon.dll1
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • acrobatacadicribbon.dll11
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • acrobatacadicribbon.dll3
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • acrobatacadicribbon.dll4
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • acroiefavclient.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    d8f616021a24d6fa39a773ea59264184


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acroiefavclient.dll64
    .dll regsvr32 windows:6 windows x64 arch:x64

    b87dddd80a5ef6cde97c15aa3ac47774


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acroiefavstub.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    c34aad727b6d7b7bd966fa8fb7c29079


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acroiefavstub.dll64
    .dll regsvr32 windows:6 windows x64 arch:x64

    2b40a46e0882957cd8e3248ee685d464


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • adobe_acrobat_1.0_windows.xpi
    .zip
  • ahclient.dll1
    .dll windows:6 windows x86 arch:x86

    800f01a5330507457ba7f21df9cdfb88


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • alb.ilex
  • azl.ilex
  • bas.ilex
  • brt.ilex
  • brz.ilex
  • bul.ilex
  • cat.ilex
  • cmc7.ocr
  • cob_____.pfb
  • cobo____.pfb
  • com_____.pfb
  • contextmenushim64.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    09c3d4ffc947454f157584c0de69723d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • coo_____.pfb
  • cro.ilex
  • cyrillic.ocr
  • cze.ilex
  • dan.ilex
  • defaults.js
  • distinit.ps
  • dut.ilex
  • e13b.ocr
  • eng.ilex
  • epilogue.ps1
  • est.ilex
  • example.ps
  • fast_invert_x_power_y.bin
  • fin.ilex
  • fontmetrics.bin
  • frn.ilex
  • gal.ilex
  • greek.ocr
  • grk.ilex
  • grm.ilex
  • handpr.ocr
  • heb.ilex
  • hebrew.ocr
  • html2pdfwrapfor64bit.exe
    .exe windows:6 windows x86 arch:x86

    94749b2611ae3df779ea92d149e5472e


    Code Sign

    Headers

    Imports

    Sections

  • hun.ilex
  • idrsarabic15.dll
    .msi
  • idrsasian15.dll
    .dll windows:6 windows x64 arch:x64

    eb4840622ed7230c13e801213bed42bd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • idrsasian215.dll
    .dll windows:6 windows x64 arch:x64

    4b79fad42c1c294adc64ed310a949efd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • idrsdocout15.dll
    .dll windows:6 windows x64 arch:x64

    c4ca75fa364942096114952e3afcf3d1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • idrsimp15.dll
    .dll windows:6 windows x64 arch:x64

    43dc9151313031339d4b75e7c3734fc6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • idrskrn15.dll
    .dll windows:6 windows x64 arch:x64

    135da793d240b12d4b70e0d0c1cdae86


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • idrslex15.dll
    .msi
  • idrsocr15.dll
    .dll windows:6 windows x64 arch:x64

    1778b21997ff0e199b93626922cfd5cb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • idrsprepro15.dll
    .dll windows:6 windows x64 arch:x64

    ffc391d7c8c3ba9279cd4c77d1d255d2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageconversion.ppi2
    .dll windows:6 windows x86 arch:x86

    b5e2da9f1d817fa46ea397054e9f3c03


    Headers

    Imports

    Exports

    Sections

  • imageconversion.ppi64
    .dll windows:6 windows x64 arch:x64

    99779dbb5ddd41a9a95390ad33927402


    Headers

    Imports

    Exports

    Sections

  • interop.adobepdfmakerx.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • interop.adobepdfmakerx.dll1
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • interop.adobepdfmakerx.dll11
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • interop.adobepdfmakerx.dll3
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • interop.adobepdfmakerx.dll4
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • itl.ilex
  • japclas.dic
  • japlang.dic
  • japparam.dic
  • jappp.dic
  • korclas.dic
  • korlang.dic
  • korparam.dic
  • korpp.dic
  • latin.ocr
  • latin_1_engine.bin
  • lav.ilex
  • let.res
  • lit.ilex
  • ltn.ilex
  • mac.ilex
  • manifest.mf
  • manifest1.json
  • mfc42.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1557eebc6134cee9eb9d0583a2b40341


    Headers

    Imports

    Exports

    Sections

  • mlt.ilex
  • mozilla.rsa
  • mozilla.sf
  • net_latin_1.bin
  • nop.ilex
  • nrw.ilex
  • nyn.ilex
  • occ.ilex
  • ocra1.ocr
  • ocrb1.ocr
  • ocrlibraryinf.dll
    .dll windows:6 windows x64 arch:x64

    3bb158e30e29f443b8b29b0837387eb8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pdflibpi.ppi2
    .dll windows:6 windows x86 arch:x86

    5c90b06ee7c8d522628ba39b422bbde7


    Headers

    Imports

    Exports

    Sections

  • pdflibpi.ppi64
    .dll windows:6 windows x64 arch:x64

    562f85837bd5ebb7231fe191c80110bc


    Headers

    Imports

    Exports

    Sections

  • pdfmacad.arx
    .dll regsvr32 windows:6 windows x64 arch:x64

    dc48a9814e09cc9a9c686ee8838342e1


    Headers

    Imports

    Exports

    Sections

  • pdfmacad.arx1
    .dll regsvr32 windows:6 windows x64 arch:x64

    3180c88855bdb79010d306f4f78c91c9


    Headers

    Imports

    Exports

    Sections

  • pdfmacad.arx11
    .dll regsvr32 windows:6 windows x64 arch:x64

    c0a063023903ea84ad6c1d0e7a94c927


    Headers

    Imports

    Exports

    Sections

  • pdfmacad.arx3
    .dll regsvr32 windows:5 windows x64 arch:x64

    73bfc7a41eac3c35e16ec0ed68bc4eca


    Headers

    Imports

    Exports

    Sections

  • pdfmacad.arx4
    .dll regsvr32 windows:5 windows x64 arch:x64

    73bfc7a41eac3c35e16ec0ed68bc4eca


    Headers

    Imports

    Exports

    Sections

  • pdfmacadribbon.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • pdfmacadribbon.dll1
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • pdfmacadribbon.dll11
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • pdfmacadribbon.dll3
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • pdfmacadribbon.dll4
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • pdfmoutlookaddin.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    bfbb3d9b732fe0c43f57b4ee2d8552c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pdfmoutlookaddin.dll1
    .dll regsvr32 windows:6 windows x64 arch:x64

    e115a7fb0ab12720eacc15aff993cb74


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pdfmoutlookcore.dll
    .dll windows:6 windows x86 arch:x86

    46e640f2132c0b395ca187c65aade3e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pdfmoutlookcore.dll1
    .dll windows:6 windows x64 arch:x64

    1f87146fa26d7501c7e572991b3b3b25


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pol.ilex
  • prologue.ps1
  • prt.ilex
  • ps.vm
  • rom.ilex
  • rus.ilex
  • schclas.dic
  • schlang.dic
  • schparam.dic
  • schpp.dic
  • sendaslinkaddin.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    8eab8f59d838bfe824213885d18fb7c6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sendaslinkaddin.dll1
    .dll regsvr32 windows:6 windows x64 arch:x64

    577cb107eabd997af231e12a18c2ea3d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sendaslinkcore.dll
    .dll windows:6 windows x86 arch:x86

    620e937a10af9cb3444fd4c49e352816


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sendaslinkcore.dll1
    .dll windows:6 windows x64 arch:x64

    0ba460f6a304d3859c3a94886fba450f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sendaslinkx.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    8ca2d8c9c5fb948f959996b941adfd06


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sendaslinkx.dll1
    .dll regsvr32 windows:6 windows x64 arch:x64

    db0aaebe65de38951e47dcc045eaefbb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sendaslinkx.tlb
  • sendaslinkx.tlb1
  • ser.ilex
  • slk.ilex
  • sln.ilex
  • spn.ilex
  • swd.ilex
  • swg.ilex
  • tchclas.dic
  • tchlang.dic
  • tchparam.dic
  • tchpp.dic
  • trk.ilex
  • ukr.ilex
  • wcfirefoxextn.dll
    .dll windows:6 windows x64 arch:x64

    8d24bf0d5487f181ce88255ab9136ae6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • wcfirefoxextn.jar
    .zip .js polyglot
  • SetLoader.exe
    .exe windows:5 windows x86 arch:x86

    75e9596d74d063246ba6f3ac7c5369a0


    Headers

    Imports

    Sections

  • ult.ucas