General

  • Target

    563299efce875400a8d9b44b96597c8e-sample1.zip

  • Size

    23.9MB

  • MD5

    8625e1f9e8548342a4f9f1641a1ae4eb

  • SHA1

    3b602c272347d14cc91e07bf0dae686d768d7965

  • SHA256

    11fe7a13ad470ff3c39423f1ebb5b7abff8cf8a656d2ac97c0183d680d07687c

  • SHA512

    6c9c07b70e8c53ef10df4cf839ee47a28acdda815dc1a5f337967a4cbe2f9b26b8075ecbc4e5295f755cfddcc2459aef1b21f9f46a7b11a89e554347261fc520

  • SSDEEP

    393216:xUYMp10LmoSzKCcMhttMWlPXxLBzQdDMOf8GInTd7EoOUwY6zcqtXWZ6:mYMsmoexcMhTlBz0f8GOTd7EY6zccWk

Score
3/10

Malware Config

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 563299efce875400a8d9b44b96597c8e-sample1.zip
    .zip

    Password: infected

  • 1a4e5ccd35a56d84281a143f831563be
    .exe windows:4 windows x86 arch:x86

    Password: infected

    730491907e677638ab304e28646ba09c


    Headers

    Imports

    Sections

  • $1/listicka.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $_13_/install/com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip
    .zip

    Password: infected

  • control.ini
  • install.bat
  • msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninstall.bat
  • $_13_/install/com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.autoupdate-1.0.8-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.chromelisticka-2.0.4-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.ielisticka3-3.3.1-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.libfoxcub-3.3.4-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.libfoxcub64-3.3.4-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.libfoxloader-3.2.7-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.libszndesktop-2.1.29-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.lightspeed-1210-12.10.12-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.lightspeed-1210-12.10.17-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.pp-1.0.2-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.szndesktop-2.0.31-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.szninstall-1.1.14-win32.zip
    .zip
  • $_13_/install/cz.seznam.software.sznsetup-1.2.6-win32.zip
    .zip
  • $_13_/install/packages.inf
  • $_13_/install/szn-software-base-1.0.0-win32.zip
    .zip
  • $_13_/install/szn-software-fflisticka-4.0.4-win32.zip
    .zip
  • $_13_/install/szn-software-listicka-3.0.0-win32.zip
    .zip
  • $_13_/sznsetup-lt.exe
    .exe windows:5 windows x86 arch:x86

    dce8b00dde1184b034034c766e230e6c


    Headers

    Imports

    Sections

  • $1/setuppicasa39-setup.exe
    .exe windows:4 windows x86 arch:x86

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ButtonEvent.dll
    .dll windows:5 windows x86 arch:x86

    0ece15e7d9bb35972aec701f46192460


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    aff5d9d526a27f56d720fb3ae00a5bc5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    c442f1649aa0670a32c622fadfcd00bd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/pozadi.bmp