General

  • Target

    Collapse.zip

  • Size

    54.3MB

  • MD5

    c9c09a7de133528b18d8687475099f00

  • SHA1

    92efc6c5a138d5631dd113cbc0f501f8e1d6f5c2

  • SHA256

    d94fafd3cbab6f1fc8486ba4f56f21723aa4934e04a8d91e1fec10c5d8fdf67f

  • SHA512

    d8a2eded28250713e55475258c769156300ff5770c28ae447690ed4fbe33ababf2972577f67c9d0f09ad55811f16e439d89789238be56992068f18e44bc7957e

  • SSDEEP

    1572864:YHEcPNHBrThiiGaNh7YQU44tu/Thr2hL4Yyqxb:YH7FVThZNVYn4euQF47qV

Score
3/10

Malware Config

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Collapse.zip
    .zip

    Password: Collapse

  • Collapse/Collapse.exe
    .exe windows:4 windows x86 arch:x86

    Password: Collapse

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Collapse/Microsoft.Web.Core.dll
    .dll windows:4 windows x86 arch:x86

    Password: Collapse

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Collapse/cfg/hi.pak
  • Collapse/cfg/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    Password: Collapse

    b3384e5182b61c941805b07b7dc28efe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/locales/af.pak
  • Collapse/cfg/locales/am.pak
  • Collapse/cfg/locales/ar.pak
  • Collapse/cfg/locales/bn.pak
  • Collapse/cfg/locales/ca.pak
  • Collapse/cfg/locales/cs.pak
  • Collapse/cfg/locales/da.pak
  • Collapse/cfg/locales/de.pak
    .ps1
  • Collapse/cfg/locales/el.pak
  • Collapse/cfg/locales/en-GB.pak
  • Collapse/cfg/locales/en-US.pak
  • Collapse/cfg/locales/es-419.pak
  • Collapse/cfg/locales/es.pak
  • Collapse/cfg/locales/et.pak
  • Collapse/cfg/locales/fa.pak
  • Collapse/cfg/locales/fi.pak
  • Collapse/cfg/locales/fil.pak
  • Collapse/cfg/locales/fr.pak
  • Collapse/cfg/locales/gu.pak
  • Collapse/cfg/locales/he.pak
  • Collapse/cfg/locales/hi.pak
  • Collapse/cfg/locales/hr.pak
  • Collapse/cfg/locales/hu.pak
  • Collapse/cfg/locales/id.pak
  • Collapse/cfg/locales/it.pak
  • Collapse/cfg/locales/ja.pak
  • Collapse/cfg/locales/kn.pak
  • Collapse/cfg/locales/ko.pak
  • Collapse/cfg/locales/lt.pak
  • Collapse/cfg/locales/lv.pak
  • Collapse/cfg/locales/ml.pak
  • Collapse/cfg/locales/mr.pak
  • Collapse/cfg/locales/ms.pak
  • Collapse/cfg/locales/nb.pak
  • Collapse/cfg/locales/nl.pak
  • Collapse/cfg/locales/pl.pak
  • Collapse/cfg/locales/pt-BR.pak
  • Collapse/cfg/locales/pt-PT.pak
  • Collapse/cfg/locales/ro.pak
  • Collapse/cfg/locales/ru.pak
  • Collapse/cfg/locales/sk.pak
  • Collapse/cfg/locales/sl.pak
  • Collapse/cfg/locales/sr.pak
  • Collapse/cfg/locales/sv.pak
  • Collapse/cfg/locales/sw.pak
  • Collapse/cfg/locales/ta.pak
  • Collapse/cfg/locales/te.pak
  • Collapse/cfg/locales/th.pak
  • Collapse/cfg/locales/tr.pak
  • Collapse/cfg/locales/uk.pak
  • Collapse/cfg/locales/ur.pak
  • Collapse/cfg/locales/vi.pak
  • Collapse/cfg/locales/zh-CN.pak
  • Collapse/cfg/locales/zh-TW.pak
  • Collapse/cfg/resources/LICENSE.electron.txt
  • Collapse/cfg/resources/LICENSES.chromium.html
  • Collapse/cfg/resources/af.pak
  • Collapse/cfg/resources/app.asar
  • Collapse/cfg/resources/app.asar.unpacked/node_modules/btime/binding.node
    .dll windows:6 windows x64 arch:x64

    Password: Collapse

    0242ceb286e744ddd6dd8e963da637ee


    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
    .dll windows:6 windows x64 arch:x64

    Password: Collapse

    2a1b9a0a23b390c22659b30f7660d0da


    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
    .dll windows:6 windows x64 arch:x64

    Password: Collapse

    56e83fb6e818a708f7895cf9d6058c3a


    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/ar.pak
  • Collapse/cfg/resources/bg.pak
  • Collapse/cfg/resources/bn.pak
  • Collapse/cfg/resources/ca.pak
  • Collapse/cfg/resources/chrome_100_percent.pak
  • Collapse/cfg/resources/chrome_200_percent.pak
  • Collapse/cfg/resources/cs.pak
  • Collapse/cfg/resources/d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    Password: Collapse

    dc71769f237c0a3ba38879380c54a4e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/da.pak
  • Collapse/cfg/resources/de.pak
    .ps1
  • Collapse/cfg/resources/el.pak
  • Collapse/cfg/resources/en-GB.pak
  • Collapse/cfg/resources/en-US.pak
  • Collapse/cfg/resources/es-419.pak
  • Collapse/cfg/resources/es.pak
  • Collapse/cfg/resources/et.pak
  • Collapse/cfg/resources/fa.pak
  • Collapse/cfg/resources/ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    Password: Collapse

    14338d2168d869b1b53d66354179e8c5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/fi.pak
  • Collapse/cfg/resources/fil.pak
  • Collapse/cfg/resources/fr.pak
  • Collapse/cfg/resources/gu.pak
  • Collapse/cfg/resources/he.pak
  • Collapse/cfg/resources/hi.pak
  • Collapse/cfg/resources/hr.pak
  • Collapse/cfg/resources/hu.pak
  • Collapse/cfg/resources/icudtl.dat
  • Collapse/cfg/resources/id.pak
  • Collapse/cfg/resources/it.pak
  • Collapse/cfg/resources/ja.pak
  • Collapse/cfg/resources/kn.pak
  • Collapse/cfg/resources/ko.pak
  • Collapse/cfg/resources/lesecinsa.txt
  • Collapse/cfg/resources/lt.pak
  • Collapse/cfg/resources/lv.pak
  • Collapse/cfg/resources/mkl_mc3.1.dll
    .dll windows:6 windows x64 arch:x64

    5e6d5c0dd72cf0e0075c17b32e860f2e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/ml.pak
  • Collapse/cfg/resources/mr.pak
  • Collapse/cfg/resources/ms.pak
  • Collapse/cfg/resources/nb.pak
  • Collapse/cfg/resources/nl.pak
  • Collapse/cfg/resources/obsidian.asar
  • Collapse/cfg/resources/pl.pak
  • Collapse/cfg/resources/pt-BR.pak
  • Collapse/cfg/resources/pt-PT.pak
  • Collapse/cfg/resources/resources.pak
  • Collapse/cfg/resources/ro.pak
  • Collapse/cfg/resources/ru.pak
  • Collapse/cfg/resources/sk.pak
  • Collapse/cfg/resources/sl.pak
  • Collapse/cfg/resources/snapshot_blob.bin
  • Collapse/cfg/resources/sr.pak
  • Collapse/cfg/resources/sv.pak
  • Collapse/cfg/resources/sw.pak
  • Collapse/cfg/resources/ta.pak
  • Collapse/cfg/resources/te.pak
  • Collapse/cfg/resources/th.pak
  • Collapse/cfg/resources/tr.pak
  • Collapse/cfg/resources/uk.pak
  • Collapse/cfg/resources/ur.pak
  • Collapse/cfg/resources/v8_context_snapshot.bin
  • Collapse/cfg/resources/vi.pak
  • Collapse/cfg/resources/vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    6d7b823ac45e01133a6ba8c35160fef1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Collapse/cfg/resources/vk_swiftshader_icd.json
  • Collapse/cfg/resources/vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    49ed29c3ff417b26c7cd92ecc9b7dcb3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Collapse/library/IY_FE.iy
  • Collapse/library/test/appendfile.txt
  • Collapse/library/test/getcustomasset.txt
  • Collapse/library/test/isfile.txt
  • Collapse/library/test/listfiles/test_1.txt
  • Collapse/library/test/listfiles/test_2.txt
  • Collapse/library/test/loadfile.txt
  • Collapse/library/test/readfile.txt
  • Collapse/library/test/writefile
  • Collapse/library/test/writefile.txt
  • Collapse/libssl-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • Collapse/loader/Dexy.lua
    .js
  • Collapse/loader/InfiniteYield.lua
    .js
  • Collapse/loader/SineWave.lua
  • Collapse/loader/Spinning Donut.lua
  • Collapse/loader/UNCCheckEnv.lua
    .js
  • Collapse/update/Microsoft.Build.Engine/2.0.0.0__b03f5f7f11d50a3a/Microsoft.Build.Engine.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Collapse/update/Microsoft.Build.Engine/3.5.0.0__b03f5f7f11d50a3a/Microsoft.Build.Engine.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Collapse/update/Microsoft.IntelliTrace.11.0.0/11.0.0.0__b03f5f7f11d50a3a/Microsoft.IntelliTrace.11.0.0.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Collapse/update/Microsoft.Office.Interop.Access/15.0.0.0__71e9bce111e9429c/Microsoft.Office.Interop.Access.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections