General

  • Target

    System32Problems4.zip

  • Size

    62.8MB

  • MD5

    71bbca24bb7d2a03c526c949b9a8ba9a

  • SHA1

    386068ba74e75cf2cb037bee0df788985370db0d

  • SHA256

    af5331cb2d0fc6d4af50d792f12a91ab0ebaf647566e1c332018b369bd71b351

  • SHA512

    89baab5ef783785b6d1bef6983a247e61280668d8ade9a5ecb9fada097f41364702b9bc3cd87e884549d0872953e3bd2adeac2039eab6421dfc7c95c2fb15d24

  • SSDEEP

    1572864:Tpo6bgNaGN3m4T0L+49qZ46EbWVbVY7WFI4LX/9qxA/N8:TGNaGNYva46EbWVJY7gDJ8

Score
3/10

Malware Config

Signatures

  • Unsigned PE 80 IoCs

    Checks for missing Authenticode signature.

Files

  • System32Problems4.zip
    .zip
  • MultiDigiMon.exe
    .exe windows:10 windows x64 arch:x64

    d912785ee3106afa32d10c36e887032f


    Headers

    Imports

    Sections

  • NDKPerfCmd.exe
    .exe windows:10 windows x64 arch:x64

    7da48a208498a9fa7b90d053471c59d9


    Code Sign

    Headers

    Imports

    Sections

  • NDKPing.exe
    .exe windows:10 windows x64 arch:x64

    17f5437822db9af8e58ae3971b905f6c


    Code Sign

    Headers

    Imports

    Sections

  • NETSTAT.EXE
    .exe windows:10 windows x64 arch:x64

    44159a75d63569050dd7973f8d92278f


    Headers

    Imports

    Sections

  • Narrator.exe
    .exe windows:10 windows x64 arch:x64

    c26f75d5b9663548ec24cd6d8a5b1cd2


    Headers

    Imports

    Sections

  • NetCfgNotifyObjectHost.exe
    .exe windows:10 windows x64 arch:x64

    7f990e89ef0fbc9f060b374e41557971


    Headers

    Imports

    Sections

  • NetEvtFwdr.exe
    .exe windows:10 windows x64 arch:x64

    b194e8cee136f2419eb0d33c5ac52e3f


    Headers

    Imports

    Sections

  • NetHost.exe
    .exe windows:10 windows x64 arch:x64

    68873b7b30277427484800907f68e033


    Headers

    Imports

    Sections

  • Netplwiz.exe
    .exe windows:10 windows x64 arch:x64

    33207161f1f01d54e759e316f16998d2


    Headers

    Imports

    Sections

  • NgcIso.exe
    .exe windows:10 windows x64 arch:x64

    a40109f5b05a25db1cd3b6f7b263a78b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • OOBE-Maintenance.exe
    .exe windows:10 windows x64 arch:x64

    e177744ee905124d86f35d2b80a0e4cd


    Code Sign

    Headers

    Imports

    Sections

  • OneDriveSetup.exe
    .exe windows:6 windows x64 arch:x64

    e35861eff59498a8462b8c59a7cde298


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • OpenWith.exe
    .exe windows:10 windows x64 arch:x64

    c9d688e9591d69636f921914b8c58481


    Code Sign

    Headers

    Imports

    Sections

  • OptionalFeatures.exe
    .exe windows:10 windows x64 arch:x64

    b1da23e5bf146552e38fa70dee47601e


    Headers

    Imports

    Sections

  • PATHPING.EXE
    .exe windows:10 windows x64 arch:x64

    1a0378360a885737213846e9571a1e47


    Headers

    Imports

    Sections

  • PING.EXE
    .exe windows:10 windows x64 arch:x64

    52182582db3fc49e327853c5e45e3fb9


    Headers

    Imports

    Sections

  • PackagedCWALauncher.exe
    .exe windows:10 windows x64 arch:x64

    7417db9eac14d3383f0430e33081c07e


    Headers

    Imports

    Sections

  • PasswordOnWakeSettingFlyout.exe
    .exe windows:10 windows x64 arch:x64

    efbb2ae327c24ac043ba293919f6dedd


    Code Sign

    Headers

    Imports

    Sections

  • PickerHost.exe
    .exe windows:10 windows x64 arch:x64

    400808860662ea1c9f82731f5f32d9c6


    Code Sign

    Headers

    Imports

    Sections

  • PinEnrollmentBroker.exe
    .exe windows:10 windows x64 arch:x64

    2b15d9d2e88543c98e5f44a260b577e7


    Headers

    Imports

    Sections

  • PkgMgr.exe
    .exe windows:10 windows x64 arch:x64

    1a5f3792f2ccf80b306e2859d468bc56


    Headers

    Imports

    Sections

  • PktMon.exe
    .exe windows:10 windows x64 arch:x64

    4b36a74a32d9b6c294ccb7a0c40d71f1


    Code Sign

    Headers

    Imports

    Sections

  • PnPUnattend.exe
    .exe windows:10 windows x64 arch:x64

    b785fc9feca50acb62b3378712b6bda0


    Headers

    Imports

    Sections

  • PresentationHost.exe
    .exe windows:10 windows x64 arch:x64

    b1c8422be3a752bdad4e20658b636e91


    Headers

    Imports

    Sections

  • PrintIsolationHost.exe
    .exe windows:10 windows x64 arch:x64

    6ac27955c1a84b7a0ea061ecfa67d8dc


    Headers

    Imports

    Sections

  • ProximityUxHost.exe
    .exe windows:10 windows x64 arch:x64

    12efa0b6ab4ac41a85e8f25950d0cbe8


    Code Sign

    Headers

    Imports

    Sections

  • RdpSa.exe
    .exe windows:10 windows x64 arch:x64

    ea2d56d44b563d355630390df8e80581


    Headers

    Imports

    Sections

  • RdpSaProxy.exe
    .exe windows:10 windows x64 arch:x64

    38572cf26926c24efb1fba5e5629f252


    Headers

    Imports

    Sections

  • RdpSaUacHelper.exe
    .exe windows:10 windows x64 arch:x64

    8af12edd150a1168dc2b3c264d8f5383


    Headers

    Imports

    Sections

  • ReAgentc.exe
    .exe windows:10 windows x64 arch:x64

    498a49f8301ecece04f6a27c7229ca18


    Headers

    Imports

    Sections

  • RecoveryDrive.exe
    .exe windows:10 windows x64 arch:x64

    143219cce86ad5386e385de7a80166c2


    Headers

    Imports

    Sections

  • Register-CimProvider.exe
    .exe windows:10 windows x64 arch:x64

    37fcce5845a29682f27dd5ddac6aa7ec


    Headers

    Imports

    Sections

  • RelPost.exe
    .exe windows:10 windows x64 arch:x64

    8e846e5c63eccf919d49ea27dd263ef6


    Headers

    Imports

    Sections

  • RemotePosWorker.exe
    .exe windows:10 windows x64 arch:x64

    c6e4fb88aba54e5e339120511bb8f20d


    Headers

    Imports

    Sections

  • nbtstat.exe
    .exe windows:10 windows x64 arch:x64

    cde20737aa225d4df469dded810acf10


    Headers

    Imports

    Sections

  • ndadmin.exe
    .exe windows:10 windows x64 arch:x64

    64f3eecff5f5a778f51d1aa0187df5c1


    Headers

    Imports

    Sections

  • net.exe
    .exe windows:10 windows x64 arch:x64

    d45c37a5c97135204ad6e116c34946c3


    Headers

    Imports

    Sections

  • net1.exe
    .exe windows:10 windows x64 arch:x64

    76ee66a0f294eab08dcaef5e64fbf02f


    Headers

    Imports

    Sections

  • netbtugc.exe
    .exe windows:10 windows x64 arch:x64

    894a8067e3107b433f0e938d4efbb5bc


    Headers

    Imports

    Sections

  • netcfg.exe
    .exe windows:10 windows x64 arch:x64

    f4666acbf024767fff0861a8ec8e8908


    Headers

    Imports

    Sections

  • netiougc.exe
    .exe windows:10 windows x64 arch:x64

    06f9626be5ae71582d4df67e4eba810d


    Headers

    Imports

    Sections

  • netsh.exe
    .exe windows:10 windows x64 arch:x64

    06f091dbec9c3f0dd14808ffe59b95de


    Headers

    Imports

    Exports

    Sections

  • newdev.exe
    .exe windows:10 windows x64 arch:x64

    fdb0aac8ae8648b09599fa21e577d5b2


    Headers

    Imports

    Sections

  • nltest.exe
    .exe windows:10 windows x64 arch:x64

    e6d22ecaa5772b23183363959c9f82b8


    Headers

    Imports

    Sections

  • nmbind.exe
    .exe windows:10 windows x64 arch:x64

    5b9bed4627214d7ad933eb9f17d888da


    Code Sign

    Headers

    Imports

    Sections

  • nmscrub.exe
    .exe windows:10 windows x64 arch:x64

    29fce0b185a9a33ad1ab22b207847f4f


    Code Sign

    Headers

    Imports

    Sections

  • notepad.exe
    .exe windows:10 windows x64 arch:x64

    0e6bccf88f4251909d1746dba78cba57


    Headers

    Imports

    Sections

  • nslookup.exe
    .exe windows:10 windows x64 arch:x64

    ec3e3c718c086fab4f7f35008a5e9116


    Headers

    Imports

    Sections

  • ntkrla57.exe
    .sys windows:10 windows x64 arch:x64

    8a6a24dc179d1d583e1d3b5fddaea3d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ntoskrnl.exe
    .sys windows:10 windows x64 arch:x64

    8a6a24dc179d1d583e1d3b5fddaea3d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ntprint.exe
    .exe windows:10 windows x64 arch:x64

    598ca250c4ce0ed92cfa650d081ad874


    Headers

    Imports

    Sections

  • nvspinfo.exe
    .exe windows:10 windows x64 arch:x64

    de5d8b97c8fedbaf7b7d7366051e6e60


    Code Sign

    Headers

    Imports

    Sections

  • odbcad32.exe
    .exe windows:10 windows x64 arch:x64

    69feebd40feb17dcc302c7a64d65bd53


    Headers

    Imports

    Sections

  • odbcconf.exe
    .exe windows:10 windows x64 arch:x64

    09ae8655c843b33d7fa4cdd4f87ad0bf


    Headers

    Imports

    Sections

  • ofdeploy.exe
    .exe windows:10 windows x64 arch:x64

    09c42344ab28bcc85e705a4ed698e793


    Headers

    Imports

    Sections

  • omadmclient.exe
    .exe windows:10 windows x64 arch:x64

    8a4ac9e4fc1e14159ac1dd230d658cab


    Headers

    Imports

    Sections

  • omadmprc.exe
    .exe windows:10 windows x64 arch:x64

    c83da75364ddd7ae6caa6691f7642981


    Headers

    Imports

    Sections

  • openfiles.exe
    .exe windows:10 windows x64 arch:x64

    b8df5d84ff68243788ad32e37c441dde


    Headers

    Imports

    Sections

  • osk.exe
    .exe windows:10 windows x64 arch:x64

    5dd120dc6a23a12489d1e4e7b5afb1aa


    Headers

    Imports

    Sections

  • pacjsworker.exe
    .exe windows:10 windows x64 arch:x64

    84970980433aae64352684fdbfe4e420


    Code Sign

    Headers

    Imports

    Sections

  • pcalua.exe
    .exe windows:10 windows x64 arch:x64

    65181227a3f528925438a98cb935f5cf


    Headers

    Imports

    Sections

  • pcaui.exe
    .exe windows:10 windows x64 arch:x64

    4bf57eba3b7099c31e7f2d38d3460f0a


    Headers

    Imports

    Sections

  • pcwrun.exe
    .exe windows:10 windows x64 arch:x64

    f377d135d63e07adc800e6f236499a9f


    Headers

    Imports

    Sections

  • perfmon.exe
    .exe windows:10 windows x64 arch:x64

    c558b7a765839c058d47628a59e81cdd


    Headers

    Imports

    Sections

  • phoneactivate.exe
    .exe windows:10 windows x64 arch:x64

    da01aba632042a34353c786f41878181


    Code Sign

    Headers

    Imports

    Sections

  • plasrv.exe
    .exe windows:10 windows x64 arch:x64

    71297308fdb1be310422f78b8e23f73c


    Headers

    Imports

    Sections

  • pnputil.exe
    .exe windows:10 windows x64 arch:x64

    8f47eb65ebe877be06b87402556253df


    Headers

    Imports

    Sections

  • poqexec.exe
    .sys windows:10 windows x64 arch:x64

    53a44d5c493b9234dafc0dc163b81690


    Headers

    Imports

    Sections

  • pospaymentsworker.exe
    .exe windows:10 windows x64 arch:x64

    4f405554d882f78a05e90f7d0e034497


    Headers

    Imports

    Sections

  • powercfg.exe
    .exe windows:10 windows x64 arch:x64

    e85330399b67b18f4577e432ca6ce70d


    Headers

    Imports

    Sections

  • prevhost.exe
    .exe windows:10 windows x64 arch:x64

    14e7a56ce14dad875047d7ec617bc003


    Headers

    Imports

    Sections

  • print.exe
    .exe windows:10 windows x64 arch:x64

    d67c73847bd1dc0d9109ba544ad6c11d


    Headers

    Imports

    Sections

  • printfilterpipelinesvc.exe
    .exe windows:10 windows x64 arch:x64

    fbc12e38838e6890bccd0777da4496e3


    Headers

    Imports

    Sections

  • printui.exe
    .exe windows:10 windows x64 arch:x64

    de8c59512ca98fb3e224769147985370


    Headers

    Imports

    Sections

  • proquota.exe
    .exe windows:10 windows x64 arch:x64

    3f32c4f6ebfec67c604916772e1803f1


    Headers

    Imports

    Sections

  • provlaunch.exe
    .exe windows:10 windows x64 arch:x64

    5e2bd8bdc63e61f7e0d77c0b742a3dc3


    Headers

    Imports

    Sections

  • provtool.exe
    .exe windows:10 windows x64 arch:x64

    32a66f804cdbf1298dd7e3bae661d502


    Headers

    Imports

    Sections

  • prproc.exe
    .exe windows:10 windows x64 arch:x64

    6c59001e0768c2b59f1f170dae94ead2


    Code Sign

    Headers

    Imports

    Sections

  • psr.exe
    .exe windows:10 windows x64 arch:x64

    c89d20643dc07bfe7517000ab83d9fbb


    Headers

    Imports

    Sections

  • pwlauncher.exe
    .exe windows:10 windows x64 arch:x64

    83c9df9631980adba74edd944ab6f667


    Headers

    Imports

    Sections

  • rasautou.exe
    .exe windows:10 windows x64 arch:x64

    69dc1709b7740448a0dc0ad149c69d48


    Headers

    Imports

    Sections

  • rasdial.exe
    .exe windows:10 windows x64 arch:x64

    d893fb6dd140ff7107d0e41ffbaaaec9


    Headers

    Imports

    Sections

  • raserver.exe
    .exe windows:10 windows x64 arch:x64

    e20b4754318a11b8eb79040b310ad904


    Headers

    Imports

    Sections

  • rasphone.exe
    .exe windows:10 windows x64 arch:x64

    bafee5a15041b808dad2d2fdf7d204f7


    Headers

    Imports

    Sections

  • rdpclip.exe
    .exe windows:10 windows x64 arch:x64

    e0421433defcad674f59db8672487c3d


    Headers

    Imports

    Sections

  • rdpinput.exe
    .exe windows:10 windows x64 arch:x64

    224fd90eecbc5c37e4d8d6d4947c54cb


    Headers

    Imports

    Sections

  • rdrleakdiag.exe
    .exe windows:10 windows x64 arch:x64

    bbaeddb424d5e6ad0fea37aaae4fa16c


    Headers

    Imports

    Sections

  • readCloudDataSettings.exe
    .exe windows:10 windows x64 arch:x64

    952778e7951347b92084f804a66ed621


    Headers

    Imports

    Sections

  • recdisc.exe
    .exe windows:10 windows x64 arch:x64

    a2042075d402c99a2a280af40042a5ad


    Headers

    Imports

    Sections

  • recover.exe
    .exe windows:10 windows x64 arch:x64

    15ec0ace85d3228adcc66943670ef7d8


    Headers

    Imports

    Sections

  • refsutil.exe
    .exe windows:10 windows x64 arch:x64

    3dee2855457795a8df5ddb338d1f718e


    Headers

    Imports

    Sections

  • reg.exe
    .exe windows:10 windows x64 arch:x64

    1085bd82b37a225f6d356012d2e69c3d


    Headers

    Imports

    Sections

  • regedt32.exe
    .exe windows:10 windows x64 arch:x64

    a3060ec916831020104fae5bc9414975


    Headers

    Imports

    Sections

  • regini.exe
    .exe windows:10 windows x64 arch:x64

    59eadf2e64b87e9c2b8f545b5e2b4a03


    Headers

    Imports

    Sections

  • regsvr32.exe
    .exe windows:10 windows x64 arch:x64

    939d090d03567fad6f1ac6f2c641a4b2


    Headers

    Imports

    Sections

  • rekeywiz.exe
    .exe windows:10 windows x64 arch:x64

    2d39e9413bd47309718b763e13774fcf


    Headers

    Imports

    Sections

  • relog.exe
    .exe windows:10 windows x64 arch:x64

    fb8ee34a945ac23f2c29fed831421a52


    Headers

    Imports

    Sections

  • repair-bde.exe
    .exe windows:10 windows x64 arch:x64

    c367e5351e6b578f24e96ce56960c8a1


    Headers

    Imports

    Sections