General

  • Target

    rcsetup154.exe

  • Size

    25.3MB

  • MD5

    990c04965d0069c6b30399bd7996d26e

  • SHA1

    de2cf03a1dbdbe1b02327e92aeaef96a583280df

  • SHA256

    dbf0895d886b428c8465ee57aea56a7e7b6e4c003efd04ca00d216a2d821eac9

  • SHA512

    6cd56b81ca5e4850b24bf3ba76d3975430f672ea1692f511e1a74a4fdb9d83f1a37ec21a35c3b540a37cbd9259720a3d6686acdabe522c44d2cf3a5ac73cff6a

  • SSDEEP

    393216:9XswzpKCszHe29+awN4Ac4Li2qtl5TtBgT2ef9su3OMJfS6uWuuJ3CCfTpTTofm:93zeBFwaf2OTtB3ahfSzuJ31Fvo

Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • rcsetup154.exe
    .exe windows:4 windows x86 arch:x86

    61259b55b8912888e90f516ca08dc514


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ButtonEvent.dll
    .dll windows:5 windows x86 arch:x86

    59070d80178eb0db7b7113b7a8608502


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/INetC.dll
    .dll windows:4 windows x86 arch:x86

    917ae9b9adb269abd5543f5bf5676bac


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    5e62e8e248e7364886b604bd1fcf4c13


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/g/gcapi_dll.dll
    .dll windows:5 windows x86 arch:x86

    26266d1a8a5fbe7334adaf3309d96608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $_107_/$_107_/pfUI.dll
    .dll windows:6 windows x86 arch:x86

    68b4aaaff94b6071a671ef870771b06d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_108_/Montserrat-Regular.otf
  • $_108_/PF_logo.png
    .png
  • $_108_/RC_Computer.png
    .png
  • $_108_/Recuva_Logo_72px.png
    .png
  • $_108_/lang-1025.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1026.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1027.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1028.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1029.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1030.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1031.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1032.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1034.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1035.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1036.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1037.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1038.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1040.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1041.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1043.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1044.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1045.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1046.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1048.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1049.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1050.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1051.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1052.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1053.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1054.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1055.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1057.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1058.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1059.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1060.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1061.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1062.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1063.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1066.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1067.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1068.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1071.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-1079.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-2052.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-2074.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-3098.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-5146.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_108_/lang-9999.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $_24_/$_24_/InstallerHelper.dll
    .dll windows:6 windows x86 arch:x86

    43fa99abb2d10e7f602d6ab8ee9c7fa0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Lang/lang-1025.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1026.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1027.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1028.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1029.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1030.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1031.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1032.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1034.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1035.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1036.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1037.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1038.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1040.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1041.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1043.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1044.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1045.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1046.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1048.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1049.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1050.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1051.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1052.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1053.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1054.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1055.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1057.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1058.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1059.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1060.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1061.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1062.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1063.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1066.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1067.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1068.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1071.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-1079.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-2052.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-2074.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-3098.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-5146.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Lang/lang-9999.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • RecuvaShell.dll.new
    .dll regsvr32 windows:6 windows x86 arch:x86

    bf3b674ca92d00a2ee68314f9886ecd0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RecuvaShell64.dll.new
    .dll regsvr32 windows:6 windows x64 arch:x64

    a8db0eed40af034aac1acce96b0eed93


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • recuva.exe
    .exe windows:6 windows x86 arch:x86

    45aec8b83386d2098b6a6f60e283b004


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • recuva64.exe
    .exe windows:6 windows x64 arch:x64

    6c28d753d7ff3ae4d390e38b9e65d41c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    61259b55b8912888e90f516ca08dc514


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    3e8d18bb71c7ebbda2ddc2a4bb03547b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    5e62e8e248e7364886b604bd1fcf4c13


    Headers

    Imports

    Exports

    Sections

  • $_24_/$_24_/InstallerHelper.dll
    .dll windows:6 windows x86 arch:x86

    43fa99abb2d10e7f602d6ab8ee9c7fa0


    Code Sign

    Headers

    Imports

    Exports

    Sections