General

  • Target

    mpv-x86_64-v3-20240929-git-c3d9243.7z

  • Size

    31.1MB

  • MD5

    f38921abe6b0835dd71bf539230a2da6

  • SHA1

    ef28f417a923873483519cbc7ef2b27223b7d72c

  • SHA256

    e4c9abf4b845b196271d91a69f9fdb555d70608da165d5651e4b46db998aa775

  • SHA512

    22a8d19bc3980da8f014c54c41236eb0479d64b57dc22dfc9210dd63230d922a88e603defbd41922a121cf8837e792b2de15e5d20a133778e4e8ff4a6176ceed

  • SSDEEP

    786432:K31LSQfPgVJzTeUu6Ino02Vf1afBT5SISmVX+C8PuZMt+sK:K3VSQfPgXTJu6Inm9UZdStu7N0K

Score
10/10
pdf

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/64bit-v3

exe.dropper

https://api.github.com/repos/shinchiro/mpv-winbuild-cmake/releases/latest

exe.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/32bit

exe.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/64bit

exe.dropper

https://sourceforge.net/projects/mpv-player-windows/rss?path=/64bit-v3

exe.dropper

https://github.com/yt-dlp/yt-dlp/releases.atom

exe.dropper

https://yt-dl.org/downloads/latest/youtube-dl.exe

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • mpv-x86_64-v3-20240929-git-c3d9243.7z
    .7z
  • d3dcompiler_43.dll
    .dll windows:10 windows x64 arch:x64

    824d17f150756620b70aa929623006bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • doc/manual.pdf
    .pdf
  • doc/mpbindings.png
    .png
  • installer/mpv-icon.ico
  • installer/mpv-install.bat
    .bat .vbs
  • installer/mpv-uninstall.bat
  • installer/updater.ps1
    .ps1
  • mpv.com
    .exe windows:6 windows x64 arch:x64

    5ca4325448f5c91e78ff8e86c173f1df


    Headers

    Imports

    Sections

  • mpv.exe
    .exe windows:6 windows x64 arch:x64

    e8bbcc1927c522291578f2b7b9eb5e45


    Headers

    Imports

    Exports

    Sections

  • mpv/fonts.conf
    .xml
  • updater.bat