General

  • Target

    e83baf4288ca1bc2b65da0ccb7a04063a8f227b3eddc4a0080fedfb5396d505d.zip

  • Size

    5.2MB

  • MD5

    aa36db3bb9531cd9aed43833a3bcf293

  • SHA1

    77987f17cd688cbad115224973ec86eb37c8c60c

  • SHA256

    e83baf4288ca1bc2b65da0ccb7a04063a8f227b3eddc4a0080fedfb5396d505d

  • SHA512

    696b5be68439783944ffa053d3bb7da5dfd13436219a41b5e1643384fec67c52963ccbe45993847945861643bd62e9b4879359518ce731b84ffb6321fbacdaff

  • SSDEEP

    98304:+z1kquAFhjKuCZLUroz1MHkuqn5T3CIIlzjqObiT0nYsAK6:UkijKuC9Zck5n5T3dIlzjqObih

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e83baf4288ca1bc2b65da0ccb7a04063a8f227b3eddc4a0080fedfb5396d505d.zip
    .zip
  • AudioCapture.dll
    .dll windows:5 windows x86 arch:x86

    b8a1db56beebf8e839dde8e0df72f492


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NSM.LIC
  • NSM.ini
  • PCICHEK.DLL
    .dll windows:5 windows x86 arch:x86

    e05a5a3d0a2f8611baa7485a20209a99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PCICL32.DLL
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • TCCTL32.DLL
    .dll windows:5 windows x86 arch:x86

    12502266fb3759e2dc267188b1b8003e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • client32.exe
    .exe windows:5 windows x86 arch:x86

    a9d50692e95b79723f3e76fcf70d023e


    Code Sign

    Headers

    Imports

    Sections

  • client32.ini
  • htctl32.dll
    .dll windows:5 windows x86 arch:x86

    6ba08298dd09ea8e41ab7285d3183bba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nskbfltr.inf
  • nsm_vpro.ini
  • onedrive.lnk
    .lnk
  • pcicapi.DLL
    .dll windows:5 windows x86 arch:x86

    c09dcd07c8e93b972e6530c73f8ec4bf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • remcmdstub.exe
    .exe windows:5 windows x86 arch:x86

    99c0cd957fc7334714fefa3daa61a6ea


    Code Sign

    Headers

    Imports

    Sections