f0304255c6807d92be724b1f82ee35ea_JaffaCakes118

resource	yara_rule
static1/unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/vmprotect.exe	upx
static1/unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/ڿԴרøڹ.exe	upx

resource
unpack001/77169.org/ɱ͡AVG-Spyware/S-Player.exe
unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/MaskPE.exe
unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/hmimys-Packer.exe
unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/vmprotect.exe
unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/4.1ƽ.exe
unpack001/77169.org/ɱ͡AVG-Spyware/̳̹/ڿԴרøڹ.exe

SHA256 854a7aead968734846ea63b9423c28f3b0a1080321ef24e7349d497085b233c3
MD5 f0304255c6807d92be724b1f82ee35ea
SHA1 6798404c7f5a16241cdc24f36cceba9def408de8
SHA512 835294a9ba11aae8bf26cadaa9e1b893dee897ad0cc84d0e311ade688018e5ac55e28e22305c14025efbaf3354c49001f65723a74c1089fe003747674e9c0dc6
SSDEEP 98304:BP+ofFqFa+4/r8CNkS7zl8wlqLiOFEAKTDr6vggW:BPdFYsjzKLB9KTivg1
MD5 SHA1 SHA512 SSDEEP

77169.org/ɱ͡AVG-Spyware/77169.orgʹð˵.txt

SHA256 42249eeb031143dc1f0518c96a71abe9bb392f39de131c35a2f559e12d72d927
MD5 ced1f715e148b1d4ea8e33ac9239ff62
SHA1 aedfe0d494d4f515824e2d7c52e240f067193451
SHA512 da824fe3705070b7459ea16b3bceb0692c267f36998148bd68bb35b9913f04f7fb93390792f8031b72c95cf4b5f1e1515b115dc76d247df5e795d7a1de095d16
SSDEEP 96:uZ7XFLkK0e/QihgwEZkjvW8oJ1PmpcAKp979Y:IX9kK0PIgwEZcWJ1PmpcAKb79Y
MD5 SHA1 SHA512 SSDEEP

77169.org/ɱ͡AVG-Spyware/77169.org˵.htm

SHA256 1a246e720e02d8b2f9c59eebb673e48885d6d7a8fb194b5f4f0de57df28c4812
MD5 d122408c88ea147d35137fa775d78d32
SHA1 818dfc81160c9e783e195d914d4b2ad81417a2d2
SHA512 4c1963e822bd52ced208c5906de4901349717b5fed2367b028a4dc8923d8c04f0fa25b8b9c5cf32391acc750a594de4107af71118416cfbe04a53b326634b917
SSDEEP 96:m1OQF/fRA2RWhwM6w6mheySgh/SnqjQhhwQ0660X8bJhnYOPMj1zNMXlGvak:mXF/JA0VdIYehN2hwQpZ+JhnYOPMjxNJ
MD5 SHA1 SHA512 SSDEEP

77169.org/ɱ͡AVG-Spyware/S-Player.exe

IMPHASH ab8f85a05a57a3bb83ada14e5df23469
SHA256 d9cbc849ce8ad308df67c1e4f04b31b3e987d68fb2dd6ae135b487935b8ab533
MD5 529dcf72ea9d5b4923ad6d91ef259d9c
SHA1 49c2443ef837d9043cd8141b03ebe979fdb6526d
SHA512 3a927131f9270953acef1f1f35bc627343dd27794283ed2a90a89c1c98be87e5531646d3df7da17f9d4da9a5d865344c4ecac3a19b50cbe96e9c7019feadf210
SSDEEP 3072:xixEujYX3Jsce07PTMHEOB25YD5SUK+MEICIrjcYmg5:wxExnJscrMkO45GMEHIrjcYm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveOutOpen waveOutRestart waveOutPause waveOutClose waveOutReset waveOutPrepareHeader waveOutWrite

msvfw32

DrawDibDraw DrawDibOpen DrawDibClose

mfc42

ord5302 ord5307 ord6375 ord1665 ord413 ord825 ord711 ord6307 ord4167 ord521 ord5265 ord4376 ord4998 ord2514 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4627 ord4425 ord3597 ord324 ord641 ord4234 ord1146 ord1168 ord6199 ord4299 ord2864 ord4710 ord2379 ord6215 ord800 ord537 ord5875 ord2859 ord755 ord470 ord4220 ord2584 ord3654 ord2438 ord6270 ord3797 ord2863 ord6605 ord6157 ord3663 ord1644 ord860 ord540 ord2370 ord3092 ord4853 ord4224 ord6334 ord6055 ord1776 ord5290 ord3402 ord4424 ord3716 ord567 ord790 ord6646 ord2302 ord6111 ord823 ord1842 ord4242 ord2723 ord2390 ord3059 ord5100 ord5103 ord4467 ord4303 ord3350 ord5012 ord975 ord5472 ord3403 ord2879 ord2878 ord4151 ord4077 ord5237 ord5282 ord2649 ord2726 ord4436 ord4427 ord674 ord554 ord366 ord807 ord2086 ord2494 ord2627 ord2626 ord4163 ord6625 ord4457 ord5252 ord1200 ord6131 ord6216 ord4413 ord4612 ord4610 ord4274 ord2256 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord1576 ord2725 ord4079 ord4698 ord4226 ord5289 ord5714 ord4622 ord3738 ord561 ord815 ord617 ord2558 ord5301 ord5214 ord296 ord5503 ord2635 ord986 ord520 ord2621 ord1825 ord4238 ord4696 ord3058 ord3065 ord6336 ord2510 ord2542 ord5243 ord5740 ord1746 ord5577 ord3172 ord5653 ord4420 ord4953 ord4858 ord2399 ord4387 ord3454 ord3198 ord6080 ord6175 ord4623 ord4426 ord338 ord652 ord4823 ord1920 ord4262 ord4589 ord4588 ord4899 ord4370 ord4892 ord5076 ord4341 ord4349 ord4889 ord4531 ord4545 ord4543 ord4526 ord4529 ord4524 ord4963 ord4960 ord4108 ord5240 ord3748 ord1725 ord4432 ord784 ord517 ord5260 ord4723 ord3075 ord5037 ord5146 ord4692 ord1948 ord5303 ord4699 ord5715 ord565 ord817

msvcrt

_stricmp fwrite _ftol calloc memset memcpy __CxxFrameHandler _EH_prolog abs strcpy strlen fclose clock malloc exit fopen fread free ftell fseek sprintf _splitpath _setmbcp __getmainargs floor realloc _msize __dllonexit _onexit _exit _XcptFilter _acmdln __p__fmode _initterm __setusermatherr _adjust_fdiv __p__commode __set_app_type _except_handler3 _controlfp

kernel32

GetStartupInfoA GetModuleHandleA GetModuleFileNameA Sleep

user32

LoadIconA SetTimer GetWindowRect GetDesktopWindow SendMessageA IsWindowVisible ReleaseDC DrawIcon GetClientRect GetDC RedrawWindow SetCursor LoadCursorA GetParent GetSubMenu LoadMenuA EnableWindow PostThreadMessageA UpdateWindow

gdi32

StretchDIBits

shell32

ShellExecuteA

77169.org/ɱ͡AVG-Spyware/ɱ͡AVG-Spyware.smv

SHA256 7f117c26c21031fa142d0c15797edf3a88cef20bf7e114e6705e27e60e0ec358
MD5 0e1743249cc2bcecb44bf424a9752672
SHA1 fbb809b10afec6006170c6f668a7f5c28f527c27
SHA512 6537d114e577c930528b398b048b5144a78597178ae2204c8565d391a5340fa2f5384a5361930838f17ac78fccfe9f7bc83d674c0f19b43c423475a2a56174e4
SSDEEP 49152:jtGIDpAQ2jjOQWAW+5AqHR6AS+Q/6RMZjU/hQuI0OT:UItAQ2jjOQT5A8RJRAY5Q4I
MD5 SHA1 SHA512 SSDEEP

77169.org/ɱ͡AVG-Spyware/ĺڿͬ.url

SHA256 0aeee0ba3eac8e4787109250c895aa0cfbce84416acdec154c33129cb65a56e9
MD5 05ed0537b8052c33a9096c68b4d1d905
SHA1 19fccec1f302e67908f386ac239d31e2edd7b820
SHA512 d633e68263362b027c53df7a3d463ab6db8361702f718670f1717cea6785f4d7a3abcae77d8bb27b40221ef47c54b4ddead00c690468b9339235848948071127
MD5 SHA1 SHA512

77169.org/ɱ͡AVG-Spyware/ԭ.txt

SHA256 c908830f5dbe4506c08135690c22a8e65e028a05a324b3387119cd29d22eeb0c
MD5 1120c2c4f2cb9d30a7c13676cf31db8a
SHA1 ff57302fb04b6f5f6cf6f7a500d34a340ba98bda
SHA512 5eabf627be6136faa6d323579419a79f9cc780b6cb740212422929b190c8e239735a6023b86c5bc6df2244f2e8f6eb28da4013720612c1fdcd6757592bfe7684
MD5 SHA1 SHA512

77169.org/ɱ͡AVG-Spyware/̳̹/MaskPE.exe

IMPHASH 5c98fb011ae1d611811091e0706fc36b
SHA256 8f3783c5d0acb5433e9be681d7da859a160ae3129133766b4f799123d236e757
MD5 3c24e3012a9a9634b80654eb4cba67da
SHA1 472996afb54a6cab0f6c5408675cc6e9eae43ec2
SHA512 30ac6e8bbc9ee6d2933e17168c24a651777ddd4b4b1b4cd8b8ad2a0268f52183c09caae532bc94451420c2f026b38de31d66c36a501896ff38562f4935b0946c
SSDEEP 6144:hERer2UjaK5PQoxiS/Awmp0KRlUi0iZYQMBhpnrng:uer2qaKCaiSYwmG4eJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

80163

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapReAlloc TerminateProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree HeapFree GetCurrentProcessId SetUnhandledExceptionFilter IsBadWritePtr GetTimeZoneInformation GetOEMCP GetCPInfo IsBadReadPtr IsBadCodePtr GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA HeapAlloc GetSystemTimeAsFileTime RtlUnwind ExitProcess GetStartupInfoW GetFileTime GetFileAttributesW FileTimeToLocalFileTime SetErrorMode GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile WritePrivateProfileStringW FileTimeToSystemTime InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc TlsGetValue EnterCriticalSection GlobalHandle GlobalReAlloc LeaveCriticalSection LocalAlloc GlobalFlags lstrcmpiW DeleteCriticalSection InitializeCriticalSection RaiseException InterlockedDecrement GetCurrentThread GetModuleFileNameW ConvertDefaultLocale GetVersion EnumResourceLanguagesW LoadLibraryW GetLocaleInfoW GetLastError lstrcpyW GlobalAlloc FormatMessageW lstrcpynW LocalFree WideCharToMultiByte GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom lstrlenA LoadLibraryA FreeLibrary lstrlenW lstrcatW lstrcmpW GetModuleHandleW GetVersionExA MulDiv GetModuleHandleA GetProcAddress SetLastError GlobalLock GlobalUnlock GlobalFree FreeResource CreateFileW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile CloseHandle IsDebuggerPresent MultiByteToWideChar GetTickCount FindResourceW LoadResource LockResource SizeofResource GetVersionExW GetThreadLocale GetLocaleInfoA GetACP QueryPerformanceCounter InterlockedExchange

user32

RegisterClipboardFormatW PostThreadMessageW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect CopyAcceleratorTableW SetRect IsRectEmpty CharNextW CharUpperW ReleaseCapture SetCapture DestroyMenu LoadCursorW GetSysColorBrush wsprintfW SetWindowContextHelpId MapDialogRect GetMessageW TranslateMessage GetCursorPos ValidateRect SetCursor PostQuitMessage SetMenuItemBitmaps ModifyMenuW EnableMenuItem CheckMenuItem GetMenuCheckMarkDimensions LoadBitmapW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW GetMenuState RegisterWindowMessageW WinHelpW CreateWindowExW SetWindowsHookExW CallNextHookEx GetClassInfoExW GetClassLongW GetClassNameW GetPropW RemovePropW SendDlgItemMessageW SendDlgItemMessageA GetFocus SetFocus IsChild GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints MessageBoxW GetKeyState SetForegroundWindow IsWindowVisible UpdateWindow GetMenu PostMessageW GetSubMenu GetMenuItemID GetMenuItemCount AdjustWindowRectEx EqualRect GetClassInfoW RegisterClassW UnregisterClassW GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement CopyRect PtInRect GetWindow GetSysColor EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GetCapture GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetWindowLongW GetDlgItem IsWindowEnabled GetParent GetNextDlgTabItem EndDialog GetSystemMetrics LoadIconW GetClientRect GetWindowRect IsIconic SendMessageW DrawIcon EnableWindow SetPropW

gdi32

CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetObjectW GetDeviceCaps GetStockObject CreateBitmap DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx CreateFontIndirectW DeleteObject GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC ScaleViewportExtEx

comdlg32

GetOpenFileNameW GetSaveFileNameW GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegOpenKeyW RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

DragQueryFileW DragFinish

comctl32

ord17 ImageList_Destroy

shlwapi

PathFindFileNameW PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoGetClassObject CLSIDFromString CLSIDFromProgID StgOpenStorageOnILockBytes CoTaskMemAlloc CoTaskMemFree StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject OleInitialize

oleaut32

OleCreateFontIndirect SysAllocString SystemTimeToVariantTime SafeArrayDestroy VariantCopy SysStringLen SysFreeString VariantInit VariantChangeType VariantClear SysAllocStringLen

77169.org/ɱ͡AVG-Spyware/̳̹/PEditor.ini

SHA256 e993284080780241456b557692037ea4d959e28543cfe1f977c98de74751e895
MD5 f1310f9a3c877a198cc664f71a41107f
SHA1 77e01d576f9eb0b938fbd35ec1f7d4984b657787
SHA512 db2ea9cff248b652c98e53a555cd9d464a570627243ef4765380655340852919a95dcb580aac2e95a80f8d511007b1136ffab5502763064ada29fac9d3860b09
MD5 SHA1 SHA512

77169.org/ɱ͡AVG-Spyware/̳̹/VMProtect.ini

SHA256 f1e18ab89ad9e40ebfef80e103d5e2d0ebf38a7cf2492294e976abb298cd1134
MD5 9a446fc088bb5946fdfd8982ee73cae8
SHA1 4a154ad64b70b96ee3b6a8f61bd55e5ef73cb516
SHA512 9a281b7bec664c89ed46d2872603edc1795f1cd53392f7a080d7884757dc54f76321ad2b47918c948888c479c1e95043a89cd6d7f153b34c2c749c4c02e376b6
MD5 SHA1 SHA512

77169.org/ɱ͡AVG-Spyware/̳̹/hmimys-Packer.exe

IMPHASH b8111320f794d9e62a7ffe5d84bed59a
SHA256 75bc213d17c3294f89d5a87467cf8aecf3c56bb1cba839a37b6dcc6f8b6947ac
MD5 4378a9540e0c2e532ba7e4269a04b94a
SHA1 e13f1ff7ab4f1bfe6ed8cde0d681ddb5c4f047e1
SHA512 5e38aa9369246cebdd8d3867670885f7c17a438da2d86915d2117878857cdc05a7f1dda7f59be1240462c33b621088c39d2c5beb50a83a78e6d839402070745f
SSDEEP 6144:7h3+nnVpTfkHdH1fTDli+We5TRNRDgzFKvznpo:N3+nzTSpv75TbZ8FaDS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

721600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

77169.org/ɱ͡AVG-Spyware/̳̹/vmprotect.exe

SHA256 ac519422786eabde8c0dffe71c21a29aa592e1ea1f22e9a0472d0cca671645d6
MD5 30af37097ef1dc9c3ba7490b651e086e
SHA1 f067275926f557c6605b8b3e07b1bcbd596e503d
SHA512 6c8dee9dd957a9ff4b1c5e85616e1879e524ca751135d6392ee5677ce106da171b53508ea52ed87ec65294cfcc9f7eee0fe9c75fffa4f10b1fd9a0305963092c
SSDEEP 24576:qko+ikoPIW5ASChLStaMk+8TO0b4YovDDa/zedvVHoTt6y:qvLpPwLgh4P/wvVHo56
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

991620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

964KB

Virtual Size

964KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

28B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UPX0

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.JGLong

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

77169.org/ɱ͡AVG-Spyware/̳̹/4.1ƽ.exe

SHA256 76444221653c00f313cd19146ad4dd4ea254fc1e7c795ae26796b51d67e0f05f
MD5 796b005c315ef1c476b30aa403c4e3d4
SHA1 4b0eae8e6ad0834c9ecbf00afc6539e9810094fc
SHA512 b0229bd94da0d12df3d0bedc1d8f3308ad1d3f16cf21c22a6840ecf13a9c9bd8cb132bd6a031a908b311e91f9781564590c0d3b9236be0d52fa1fe495576000b
SSDEEP 12288:4cXBOWxqGRJ/V+Hy+XkWoBR5/o4iUjNk5XL5SWk9kSX84xlh3TlkZowWp:hROWwG39+S/WIR/iU5UbQX8QtT6ud
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1885764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

77169.org/ɱ͡AVG-Spyware/̳̹/ڿԴרøڹ.exe

SHA256 ebd1d6254a9882b63d3cd3e3f044642a036a2f1d0f3e040b6bc4c1b22e870b35
MD5 6e789000bbbb9ceb6306a4d898991e82
SHA1 1c70bc87425d9f6ee9646e8bf34c16050a1a4c79
SHA512 2e98ca63e8e9e066010f1b05221c2974b3198b78b1a44f0942f900e7b1370d188d72bb95642e4f3d19fc07a20653d3c169d3ea7559cfa11a07be2fd4e7f9047b
SSDEEP 12288:49WPgmXZptcABo99Ps+wQZseQq1WkRn0/ETDdA7kb5/sriZxvaAL5BlVrZB:XPgmXZfcAq1s+wQZJtjTRAa/QkV1B
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

646884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

77169.org/ɱ͡AVG-Spyware/̳.txt

SHA256 3ab23a865bdfbeb56722dee73a110ab2baa0fd059595073b4eab0c8faebb0746
MD5 66f1e7553026cfd64ab38ac9d74d0549
SHA1 61c45ed5ea707df77f445349bfa28c2039e942f2
SHA512 f452db43fd5f0480814014d3349ededd75e3a56ecab0205862c037b4ffbee88cd297b20b7f2fb20e5a5bf0022a95a1487a7b2b72fdb0de44521513fa23af4f02
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer