General

  • Target

    LexisNexis.msix.zip

  • Size

    5.7MB

  • MD5

    ff25441b7631d64afefdb818cfcceec7

  • SHA1

    8448f344c3e05d70506899859cf61ba47bb906f2

  • SHA256

    902c9aba42378c40c6c9623bab2326cb8b98fa06cfc0ee0379349055137c9500

  • SHA512

    e452e6c92f724107af0f693daf3b04dec5c9f4a2572f0d2d70ef061128f2f37f67bef7a22613f54ddbfdbd69f721b0c723e17ab70a5d2e59e5d5647d2a0e6646

  • SSDEEP

    98304:bp4MHFnNFy1CJBAeAbIqRChCKbGh6R4DyPw6/OJjwfWSblKqE+lbQp+JvnJtLSiD:aeFvy1CHANISChCKahEmyIuOJjwf5Ntx

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://www.lexisnexis.com/

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • LexisNexis.msix.zip
    .appx
  • AppxBlockMap.xml
    .xml
  • AppxManifest.xml
  • AppxMetadata/CodeIntegrity.cat
  • AppxSignature.p7x
  • Assets/logo.png
    .png
  • PsfLauncher32.exe
    .exe windows:6 windows x86 arch:x86

    7b63f97e8f0c360699c20e7c30842630


    Code Sign

    Headers

    Imports

    Sections

  • PsfLauncher64.exe
    .exe windows:6 windows x64 arch:x64

    8e9b7caff9376bbdc8b416a414b64656


    Code Sign

    Headers

    Imports

    Sections

  • PsfRunDll32.exe
    .exe windows:6 windows x86 arch:x86

    b1a931f51b30b56b60ecdb5d25bf3458


    Code Sign

    Headers

    Imports

    Sections

  • PsfRunDll64.exe
    .exe windows:6 windows x64 arch:x64

    0e5c9a29fdcee2791341cd303678be64


    Code Sign

    Headers

    Imports

    Sections

  • PsfRuntime32.dll
    .dll windows:6 windows x86 arch:x86

    f229992937d1d790b50a1cb368509a49


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PsfRuntime64.dll
    .dll windows:6 windows x64 arch:x64

    de350c6095b02fd305afdbe337b14afd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Registry.dat
  • Resources.pri
  • StartingScriptWrapper.ps1
    .ps1
  • User.dat
  • VFS/ProgramFilesX64/7z2404-extra/7za.dll
    .dll windows:4 windows x86 arch:x86

    edb01ced967d1545f46e4d8d004d088e


    Headers

    Imports

    Exports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/7za.exe
    .exe windows:4 windows x86 arch:x86

    6f18dc28cf1faef40cedf506a5685aac


    Headers

    Imports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/7zxa.dll
    .dll windows:4 windows x86 arch:x86

    cd3731e16c560eee547e3c651dae4f7f


    Headers

    Imports

    Exports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/Far/7-ZipEng.hlf
  • VFS/ProgramFilesX64/7z2404-extra/Far/7-ZipEng.lng
  • VFS/ProgramFilesX64/7z2404-extra/Far/7-ZipFar.dll
    .dll windows:4 windows x86 arch:x86

    ea76c211bceaa0b3e988007ef472c487


    Headers

    Imports

    Exports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/Far/7-ZipFar64.dll
    .dll windows:4 windows x64 arch:x64

    de297ca23880e1543f5c5121dfbab235


    Headers

    Imports

    Exports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/Far/7-ZipRus.hlf
  • VFS/ProgramFilesX64/7z2404-extra/Far/7-ZipRus.lng
  • VFS/ProgramFilesX64/7z2404-extra/Far/7zToFar.ini
  • VFS/ProgramFilesX64/7z2404-extra/Far/far7z.reg
  • VFS/ProgramFilesX64/7z2404-extra/Far/far7z.txt
  • VFS/ProgramFilesX64/7z2404-extra/License.txt
  • VFS/ProgramFilesX64/7z2404-extra/arm64/7-ZipFar.dll
  • VFS/ProgramFilesX64/7z2404-extra/arm64/7za.dll
  • VFS/ProgramFilesX64/7z2404-extra/arm64/7za.exe
  • VFS/ProgramFilesX64/7z2404-extra/arm64/7zxa.dll
  • VFS/ProgramFilesX64/7z2404-extra/history.txt
  • VFS/ProgramFilesX64/7z2404-extra/readme.txt
  • VFS/ProgramFilesX64/7z2404-extra/x64/7za.dll
    .dll windows:4 windows x64 arch:x64

    18bc3b4099180bc67dd68352a0d42b48


    Headers

    Imports

    Exports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/x64/7za.exe
    .exe windows:4 windows x64 arch:x64

    8122af7382bf626d4b6d8f35f0d8143e


    Headers

    Imports

    Sections

  • VFS/ProgramFilesX64/7z2404-extra/x64/7zxa.dll
    .dll windows:4 windows x64 arch:x64

    1353ce6b26348ac6f792fe77a59eff9d


    Headers

    Imports

    Exports

    Sections

  • VFS/ProgramFilesX64/PsfRunDll64.exe
    .exe windows:6 windows x64 arch:x64

    0e5c9a29fdcee2791341cd303678be64


    Code Sign

    Headers

    Imports

    Sections

  • VFS/ProgramFilesX64/client2.7z
    .7z
  • [Content_Types].xml
    .xml
  • config.json
  • fix.ps1
    .ps1