General

  • Target

    ObkioAgentInstall-Windows-AMD64-v1308.exe

  • Size

    34.5MB

  • MD5

    bad428f4e0fe12a268c59cc97726efaf

  • SHA1

    5ee79b1bb59aa175855431470b5f5ef16ccb99a9

  • SHA256

    be8b43571c364011358f86534e12a4e367eb658c1fda221693dd2af6790569b0

  • SHA512

    cea82fe6e65813085e542c9fd8303e143e8061c19878b328b18a460ce4ce9c4adb3831313aebd39731cc9e91a92ff0264dcc690fc523bbfe66f4913e24dd7b47

  • SSDEEP

    786432:vBfThBVxXEfpiCs4FTbyQcabxcvTwcEVKX0bTU9ntv3H4:vvDKHFFHTbbevTFEsXUTentv3H4

Score
3/10

Malware Config

Signatures

  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

Files

  • ObkioAgentInstall-Windows-AMD64-v1308.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    56a78d55f3f7af51443e58e0ce2fb5f6


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    c1c7505e1e6e929ebb6b9100e55b050a


    Headers

    Imports

    Exports

    Sections

  • ObkioAgentJwtDecoder.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    c7269d59926fa4252270f407e4dab043


    Code Sign

    Headers

    Imports

    Sections

  • ObkioAgentService.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    c7269d59926fa4252270f407e4dab043


    Code Sign

    Headers

    Imports

    Sections

  • ObkioAgentTimestamper.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    c7269d59926fa4252270f407e4dab043


    Code Sign

    Headers

    Imports

    Sections

  • ObkioAgentUninstall.exe.nsis
  • cacert/cacert.pem
  • curl/curl-ca-bundle.crt
  • curl/curl.exe
    .exe windows:4 windows x64 arch:x64

    Password: infected

    5acf7b5107ffad3ff1b6d93455913267


    Code Sign

    Headers

    Imports

    Sections

  • curl/libcurl-x64.def
  • curl/libcurl-x64.dll
    .dll windows:4 windows x64 arch:x64

    Password: infected

    b286fb1b2349986f7433e8ba3f761e35


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • iperf/cjson.o
  • iperf/cygwin1.dll
    .dll windows:4 windows x64 arch:x64

    e49f2e55576255ce2892923d44184fd5


    Headers

    Imports

    Exports

    Sections

  • iperf/dscp.o
  • iperf/iperf3.exe
    .exe windows:4 windows x64 arch:x64

    3f758afe933efff3b6bb3f2612d257f4


    Headers

    Imports

    Sections

  • iperf/iperf3_ltshwrapper
  • iperf/iperf_api.o
  • iperf/iperf_auth.o
  • iperf/iperf_client_api.o
  • iperf/iperf_error.o
  • iperf/iperf_locale.o
  • iperf/iperf_sctp.o
  • iperf/iperf_server_api.o
  • iperf/iperf_tcp.o
  • iperf/iperf_time.o
  • iperf/iperf_udp.o
  • iperf/iperf_util.o
  • iperf/libiperf.a
  • iperf/libiperf.la
  • iperf/libiperf.lai
  • iperf/lt-iperf3.c
  • iperf/lt-t_api.c
  • iperf/lt-t_auth.c
  • iperf/lt-t_timer.c
  • iperf/lt-t_units.c
  • iperf/lt-t_uuid.c
  • iperf/net.o
  • iperf/t_api.exe
    .exe windows:4 windows x64 arch:x64

    7db685131631ab6a70fdb12249412884


    Headers

    Imports

    Sections

  • iperf/t_api_ltshwrapper
  • iperf/t_auth.exe
    .exe windows:4 windows x64 arch:x64

    1b196cea28e28f7e083aeedee66bfbd7


    Headers

    Imports

    Sections

  • iperf/t_auth_ltshwrapper
  • iperf/t_timer.exe
    .exe windows:4 windows x64 arch:x64

    4f10143ff217f4cceacfcfd5d1aac590


    Headers

    Imports

    Sections

  • iperf/t_timer_ltshwrapper
  • iperf/t_units.exe
    .exe windows:4 windows x64 arch:x64

    e41927b572e0abb24d785a88aa2a2887


    Headers

    Imports

    Sections

  • iperf/t_units_ltshwrapper
  • iperf/t_uuid.exe
    .exe windows:4 windows x64 arch:x64

    7db685131631ab6a70fdb12249412884


    Headers

    Imports

    Sections

  • iperf/t_uuid_ltshwrapper
  • iperf/tcp_info.o
  • iperf/timer.o
  • iperf/units.o
  • license.txt
  • main.dist/ObkioAgentSoftware.exe
    .exe windows:6 windows x86 arch:x86

    6172164f07aae3cccd81746e519b98f4


    Code Sign

    Headers

    Imports

    Sections

  • main.dist/_asyncio.pyd
    .dll windows:6 windows x86 arch:x86

    6fd3efb020fafeb8fb81a1bd3e98fb50


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_bz2.pyd
    .dll windows:6 windows x86 arch:x86

    860fabc223fa0e3065052288bb0637e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_ctypes.pyd
    .dll windows:6 windows x86 arch:x86

    ddd9ed41a5f970ccb4c18f7fcf702338


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_decimal.pyd
    .dll windows:6 windows x86 arch:x86

    9f36169fa1673ceb8a7f6f44a5e20004


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_elementtree.pyd
    .dll windows:6 windows x86 arch:x86

    a59c1df582c940906ef05c1e78149e01


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_hashlib.pyd
    .dll windows:6 windows x86 arch:x86

    72072def8a7e7350f15bfd83ee0f6fe4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_lzma.pyd
    .dll windows:6 windows x86 arch:x86

    d40b846221963c8137978878019e32a9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_msi.pyd
    .dll windows:6 windows x86 arch:x86

    e84aa24d4d04d0eda33ddcdae8cab2c4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_multiprocessing.pyd
    .dll windows:6 windows x86 arch:x86

    cadf2af6345e3e69f7a87eba25bb1707


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_overlapped.pyd
    .dll windows:6 windows x86 arch:x86

    5fe964dd825f994bb0f097f7ed2c47e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_queue.pyd
    .dll windows:6 windows x86 arch:x86

    1fa731eb14702ed9ae35a91b2957d143


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_socket.pyd
    .dll .js windows:6 windows x86 arch:x86 polyglot

    42e9695c8d098ca049c666ead141f895


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_sqlite3.pyd
    .dll windows:6 windows x86 arch:x86

    b0d123538cd0f3869f9da5361f4832c6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_ssl.pyd
    .dll windows:6 windows x86 arch:x86

    32986c47a527e397d1b8641c6ae499b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/_tkinter.pyd
    .dll windows:6 windows x86 arch:x86

    efca71c65d70171c25283eed40f02b27


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/cchardet/_cchardet.pyd
    .dll windows:6 windows x86 arch:x86

    a41c12b879eb5170786a2ddd70cd02b8


    Headers

    Imports

    Exports

    Sections

  • main.dist/certifi/cacert.pem
  • main.dist/comctl32.dll
    .dll windows:10 windows x86 arch:x86

    8b84204d8411bbf33f3f1e9c08db779b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/lib2to3/Grammar3.8.10.final.0.pickle
  • main.dist/lib2to3/PatternGrammar3.8.10.final.0.pickle
  • main.dist/libcrypto-1_1.dll
    .dll windows:6 windows x86 arch:x86

    993da743dc066af7c54afc4bb08b7e02


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/libffi-7.dll
    .dll windows:6 windows x86 arch:x86

    414c0669f9e0759f6229040d3ceb686f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/libssl-1_1.dll
    .dll windows:6 windows x86 arch:x86

    8f9c5a7d80b840d9119af90e4b76ffbd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/multidict/_multidict.pyd
    .dll windows:6 windows x86 arch:x86

    b6c44f155662d8c7bc076d32b3ed43c1


    Headers

    Imports

    Exports

    Sections

  • main.dist/netifaces.pyd
    .dll windows:6 windows x86 arch:x86

    f9de42c3b22705171f23c31b5109dfb6


    Headers

    Imports

    Exports

    Sections

  • main.dist/psutil/_psutil_windows.pyd
    .dll windows:6 windows x86 arch:x86

    82ac4bd8da112ad71ba2522dd2774e74


    Headers

    Imports

    Exports

    Sections

  • main.dist/pyexpat.pyd
    .dll windows:6 windows x86 arch:x86

    5dd178cdeb5142407b337a161d7cd73f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/python38.dll
    .dll windows:6 windows x86 arch:x86

    3dcccf1166619824704f2590ed878b53


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/pythoncom38.dll
    .dll windows:6 windows x86 arch:x86

    41ca48025bf9885e097c7164ae67bfc0


    Headers

    Imports

    Exports

    Sections

  • main.dist/pywintypes38.dll
    .dll windows:6 windows x86 arch:x86

    3cffd909c037e7f0d9a9ef26671ddc47


    Headers

    Imports

    Exports

    Sections

  • main.dist/select.pyd
    .dll windows:6 windows x86 arch:x86

    7eccf09fda6eb5e086ea9a62c0de9463


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/sqlite3.dll
    .dll windows:6 windows x86 arch:x86

    eabf8595ba3a3e25d325e5f0f3856721


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/tcl86t.dll
    .dll windows:6 windows x86 arch:x86

    365afe77f2566c904e876954614cdd4b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/tk86t.dll
    .dll windows:6 windows x86 arch:x86

    a7ab2d88915933dfc8faf14315c1b394


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/ujson.pyd
    .dll windows:6 windows x86 arch:x86

    ddad1392315713efe904dcda9ecccbf2


    Headers

    Imports

    Exports

    Sections

  • main.dist/unicodedata.pyd
    .dll windows:6 windows x86 arch:x86

    971d805157fb156382c0b45b61c6fb73


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    b06d4116da69a513992d529f84731e6f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • main.dist/websockets/speedups.pyd
    .dll windows:6 windows x86 arch:x86

    025989485ca78ba8a907c89d4a927945


    Headers

    Imports

    Exports

    Sections

  • main.dist/win32api.pyd
    .dll windows:6 windows x86 arch:x86

    1970c333c3aa941f6c156b0c874e8afe


    Headers

    Imports

    Exports

    Sections

  • main.dist/win32gui.pyd
    .dll windows:6 windows x86 arch:x86

    9c6f1a4bf078a185f86ac3942fc6d4ea


    Headers

    Imports

    Exports

    Sections

  • main.dist/yarl/_quoting_c.pyd
    .dll windows:6 windows x86 arch:x86

    e16ef09437411f8ae66d186c351a90d4


    Headers

    Imports

    Exports

    Sections

  • mtr/cygjansson-4.dll
    .dll windows:4 windows x64 arch:x64

    7dc83aecb1734a630bb4fad7a3c33730


    Headers

    Imports

    Exports

    Sections

  • mtr/cygwin1.dll
    .dll windows:4 windows x64 arch:x64

    e49f2e55576255ce2892923d44184fd5


    Headers

    Imports

    Exports

    Sections

  • mtr/mtr-packet.exe
    .exe windows:4 windows x64 arch:x64

    938024b6c301acb65f7626d7c3fe94e0


    Headers

    Imports

    Sections

  • mtr/mtr.exe
    .exe windows:4 windows x64 arch:x64

    97d6aca9c89db331bab5fd85b71a2cfc


    Headers

    Imports

    Sections

  • snmp/cygcrypto-1.1.dll
    .dll windows:4 windows x64 arch:x64

    414147a54c767fb442cd8c85a652db2b


    Headers

    Imports

    Exports

    Sections

  • snmp/cygwin1.dll
    .dll windows:4 windows x64 arch:x64

    e49f2e55576255ce2892923d44184fd5


    Headers

    Imports

    Exports

    Sections

  • snmp/cygz.dll
    .dll windows:4 windows x64 arch:x64

    9b87dea50bee52badb0204e28adc7b75


    Headers

    Imports

    Exports

    Sections

  • snmp/snmpbulkget.exe
    .exe windows:4 windows x64 arch:x64

    5cce685eb75cf8b29f2f4670e960de1d


    Headers

    Imports

    Sections

  • snmp/snmpbulkwalk.exe
    .exe windows:4 windows x64 arch:x64

    5cce685eb75cf8b29f2f4670e960de1d


    Headers

    Imports

    Sections

  • snmp/snmpget.exe
    .exe windows:4 windows x64 arch:x64

    3386f5434d8fa832f7e5438d07accb74


    Headers

    Imports

    Sections

  • snmp/snmpwalk.exe
    .exe windows:4 windows x64 arch:x64

    5cce685eb75cf8b29f2f4670e960de1d


    Headers

    Imports

    Sections