Overview

overview

10

Static

static

10

Files/0018...8a.exe

windows7-x64

10

Files/0018...8a.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Files/059c...6b.exe

windows7-x64

3

Files/059c...6b.exe

windows10-2004-x64

3

Files/0761...50.exe

windows7-x64

5

Files/0761...50.exe

windows10-2004-x64

5

Files/0b4a...e6.exe

windows7-x64

10

Files/0b4a...e6.exe

windows10-2004-x64

10

Files/0c10...54.rtf

windows7-x64

8

Files/0c10...54.rtf

windows10-2004-x64

1

Files/0dc6...d8.exe

windows7-x64

7

Files/0dc6...d8.exe

windows10-2004-x64

7

Files/0def...d1.exe

windows7-x64

5

Files/0def...d1.exe

windows10-2004-x64

7

Files/0f64...5d.exe

windows7-x64

10

Files/0f64...5d.exe

windows10-2004-x64

10

Files/0fe5...05.exe

windows7-x64

10

Files/0fe5...05.exe

windows10-2004-x64

10

Files/1150...16.exe

windows7-x64

8

Files/1150...16.exe

windows10-2004-x64

10

Files/11c8...ba.exe

windows7-x64

10

Files/11c8...ba.exe

windows10-2004-x64

10

Files/15e3...5e.exe

windows7-x64

8

Files/15e3...5e.exe

windows10-2004-x64

8

Files/1ca4...74.exe

windows7-x64

10

Files/1ca4...74.exe

windows10-2004-x64

10

Files/1dc7...d8.exe

windows7-x64

5

Files/1dc7...d8.exe

windows10-2004-x64

5

Files/1fb0...c1.exe

windows7-x64

3

Files/1fb0...c1.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

Errors

Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported

General

  • Target

    bb80103ac259b0a260fe3fabea6c6ceedf4286f43b24665a9ec30bc1b19bd267

  • Size

    108.7MB

  • MD5

    541b119f806c80a252c746042bf464ad

  • SHA1

    c9fcbbc03d26a428a412f80e2fe97f25853856cf

  • SHA256

    bb80103ac259b0a260fe3fabea6c6ceedf4286f43b24665a9ec30bc1b19bd267

  • SHA512

    d8bdd55d3021296e9e1688770bc27da0a88d0a36d8f2cac3f469244bd71af6a5a36173fb076376952ad839ecd71d12565bf3e88aa734ce49a3f7bc8195155a5e

  • SSDEEP

    1572864:silUaHZSbqW7IJZ5Q9dWZGoLIP95bARN031ZzlDnFVs9eb8chagiu1Xw+SdBJIpf:sOEzwZ5QlLPfARNAZzlDdosV1Xw+S2f

Score
10/10
upxtelegramruntimebroker.exequasarnjratxredxworm

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

TELEGRAM

C2

212.56.35.232:101

Mutex

QSR_MUTEX_LoEArEgGuZRG2bQs0E

Attributes
  • encryption_key

    yMvSAv7B2dURg67QYU5x

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchosta

  • subdirectory

    media

Extracted

Family

njrat

Version

0.7d

Botnet

RuntimeBroker.exe

C2

hakim32.ddns.net:2000

morning-ultimately.gl.at.ply.gg:14531
Mutex

a7508ccd4c60e6eaa0eb204481c3a0be

Attributes
  • reg_key

    a7508ccd4c60e6eaa0eb204481c3a0be

  • splitter

    |'|'|

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

C2

language-lose.gl.at.ply.gg:64760

park-meetup.gl.at.ply.gg:62592
Attributes
  • Install_directory

    %Temp%

  • install_file

    checker.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://92.255.85.2/Fox.exe
exe.dropper

http://92.255.85.2/Fox.exe

Extracted

Family

xworm

Version

5.0

C2

year-tim.gl.at.ply.gg:24149

Mutex

2kICHr7gSrOzPXii

Attributes
  • Install_directory

    %Temp%

  • install_file

    jusched.exe

aes.plain

Signatures

  • Detect Xworm Payload 3 IoCs
  • Njrat family
    njrat
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Xred family
    xred
  • Xworm family
    xworm
  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 59 IoCs

    Checks for missing Authenticode signature.

  • Office document contains embedded OLE objects 1 IoCs

    Detected embedded OLE objects in Office documents.

Files

  • bb80103ac259b0a260fe3fabea6c6ceedf4286f43b24665a9ec30bc1b19bd267
    .zip
  • Files/0018f4feb99c7f12c3f5bfe53998c3c6ca7e2908f666f44a93f914c8c41c588a.exe
    .exe windows:4 windows x86 arch:x86

    7192d3773f389d45ebac3cc67d054a8a


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • Cretics.Bru
  • Gformet.Sve
  • Gravmles56.jpg
    .jpg
  • annicut.jpg
    .jpg
  • augsburg.ini
  • batiks.cen
  • byvaabnernes.jpg
    .jpg
  • grazing.ini
  • lmarkeds.rot
  • Files/059cf78adefc07c8225fde4b20f705dfed5c8c90f0d360b84d941c432b99f76b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Files/07610c4fda6b5d6e8920d8da44a58213ef6c4309c794978477e81ed50f885150.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/0b4a12968bf32f01c3aacc96ab4888e8b04f4ff334f903968afe452fec9bb2e6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/0c10532495658ae6099011796249e76b9ef33235a019df54086bd07547685354.doc
    .rtf .doc
  • Files/0dc6fa2e838c3b03b801833f45d683b0cb27a787aa533e652e449f0456871cd8.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/0def0868347c89485ceb5386573bce41ed3a83b343adc3308441f7822988c7d1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/0f6481dabf7871823f259eb95f3b85c37d1de8a7d1884ac77a97d887cf96f75d.exe
    .exe windows:6 windows x86 arch:x86

    2716f32d1d63b3fc977d6064633b778d


    Headers

    Imports

    Sections

  • Files/0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
    .exe windows:6 windows x64 arch:x64

    f89d971f855e5743dd4d1e73a5da5699


    Headers

    Imports

    Sections

  • Files/115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/11c893b8175b916691afb56498a2a35c4fcf038a5f418e3ae7db3c66049abeba.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/15e3d2f2ae29c63206f13aa1768289a830ac2ef71c83227e3bc61a634ad7b05e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/1ca4a73b1076d2c6c0b97b3544919281b091e260f4970f62ae7f1cbcb9cc5e74.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/1dc75c16bf526f435cbdf05c73df57040791b7809d64e158b0b66565e444b3d8.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Files/1fb08d6dc54e057419e21ca6c5aa959c2f9833eebd6e8998843a737c009de5c1.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • Files/20f3f526fbe016d6a3a5c2531affd5bc7bb81c0bc686f30ed2ecc27408a140b2.exe
    .exe windows:4 windows x86 arch:x86

    7192d3773f389d45ebac3cc67d054a8a


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • Flatteress.Spe
  • Spiritlessly.Min
  • Subordinated.ini
  • arrowless.jpg
    .jpg
  • rudskallers.dro
  • traguline.ric
  • underrepresented.gos
  • Files/291f97f1440e70c5aa72954afb88dc65287cd38d1c35cb92360872cf6ee560a6.vbs
    .vbs
  • Files/2c6beede4c6cf738c67bcf1fc7e99e4cdcdcdebaff763f0ec4dcb352921a1df2.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/2edf703005001488ac02fe1c1b08784c938d944a5e8dd4345b00ea3d6e7b68f6.xlsx
    .xls .xlsx windows office2003
  • Files/3240ba805b47c8113426171d02796e776b782cbd76560c024cbea07fbe519d7d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/33b2b67b33d1e021d63c507a98bc2cd73c9f888ee81fb9473ede1926992c3a1d.exe
    .exe windows:5 windows x86 arch:x86

    9771ee6344923fa220489ab01239bdfd


    Code Sign

    Headers

    Imports

    Sections

  • Files/39b7d36f78ad70c878581c1052fc6c1e0aab18312c9d8e229d9041494784f4b2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/3c8aa9cd25db23f2c9b64554f5e9fe43cbe76c0082e33a1e67ce9d257bb7a179.exe
    .exe windows:5 windows x64 arch:x64

    74224dd151827e33f203b04f96765c8e


    Headers

    Imports

    Sections

  • Files/3e58881476063c82ed5b70cff860034d4a7351cbaf81a26a17737ca2dffa4602.ps1
  • Files/42405a0aa535f94fd92eb82a2e3a3bc4e514b54803cb5df81a054dbd75a27c1e.exe
    .exe windows:6 windows x64 arch:x64

    d743740f06aa0a325bb5c948f63319ce


    Headers

    Imports

    Sections

  • Files/4330364ed7044671ea3d48f8ad3ac8bb079eac0a7d12d1e6ddfcb47927386835.hta
    .html .vbs polyglot
  • Files/43c68b7dd1c862d41e95e3db196a0d2005df40d3f19c3ae0b580cc21863ea81d.xlsx
    .xls .xlsx windows office2003
  • Files/43f565ce5681801d39edfbd9b823aecd39e89a8cb5ec33d763bbd09921acba9a.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/47d78f1f5b4b94c444b061adbb7341abaa3183fe85093e5947525979f391f628.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/4b91205c420e776d0aca1c9d3104ea1577d91e7336018f93ccf3109c4d3fd8c6.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/4b996a6185805172205a50877cb7efdcf52966757e78b0f1554bef288cd793ac.bat
    .bat .vbs
  • Files/4c753d4c900f614b1ae03309d3b319bb4081c9628dc3f61a9dee7e16e023e1ba.vbs
    .vbs
  • Files/510a8252e38f939bc4a7bbe8ec4410a6bba68e8c7cf68cd7ebbabaa75daef632.ps1
    .ps1
  • Files/568ed2f1c14bb07e19ea22e96ad3ba077561c312438f4548c79052df64cafc3a.vbs
    .vbs
  • Files/5a058231a03da912910e97861d3e6d437a61df22a176e1a11e3847cc5ee31ec2.exe
    .exe windows:4 windows x86 arch:x86

    6b66e60e14c372415591c47456045b2c


    Headers

    Imports

    Sections

  • Files/5ba530ebd87d7cb1bc0a2a368bdab568bf533a4da5399428feadc79a7947eb9d.exe
    .exe windows:6 windows x86 arch:x86

    91802a615b3a5c4bcc05bc5f66a5b219


    Headers

    Imports

    Sections

  • Files/5c059a6d583afa2014badd301e7bb48a1b9d65ad64f9f91a334daeba23ba7828.exe
    .exe windows:6 windows x86 arch:x86

    a3ece79ab73c37cd94ea81723067aecd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Files/5c3555e3b74e3010777c6ec069cb4fef79b534b4e5ba1fdbe57b0bdaf770efd5.js
  • Files/5fd7a1d8d4083ed82cff3fce09c63c0945404c8cc37997b79448700cdf218ba5.exe
    .exe windows:5 windows x86 arch:x86

    c4540f421523fe2dc591e50be5ad7d0b


    Headers

    Imports

    Sections

  • Files/613ef1b3284bd796382e0136d3687aa95c0087254a10efb68a3e109ad9165c2c.bat
    .bat .vbs
  • Files/63c28edf52979a1cc3b621872db1bc1135d32545f2ec5a6a461a5187fcb0d53c.exe
    .exe windows:4 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • Files/665e41e416954d5ff623a37c7bce17d409c11e003c29ae9ddeb25fc736e533c7.vbs
    .vbs
  • Files/66f078e58ebd64a0dc663e8b45e21469d9b7b020b130d7f4bd31de6de4a4ce7a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906.exe
    .exe windows:5 windows x86 arch:x86

    483f0c4259a9148c34961abbda6146c1


    Headers

    Imports

    Sections

  • Files/71aca0caaf09673c4619fb1df0de355be5dbacfc5c5babbe5d031e94affdd32b.vbs
  • Files/7487a3ebf201e047992676ccf53d756aa939f8a3b9b8a53d1ba870e3cdd63379.vbs
    .vbs
  • Files/75c586da01d32f155a7cb27fd91a00a4104fee81096787599fd28d5977b87f00.exe
    .exe windows:4 windows x64 arch:x64

    fc274ceb5aa20e8c9a5eb18d1be9c77c


    Code Sign

    Headers

    Imports

    Sections

  • Files/766ab23a314977156bd7b40904d72a755f2df9426144aa1d8ca54e941cd973ca.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/76bcbacf419d50bf48f4a635bfcee7481f9906f38e11a40833e44aeb211635ed.zip
    .zip
  • 468311519_2025-03-24-7137888904_5U9X8.vbs
  • ~/-/~~/5kPg0FKa4/z6QdVsK8v/orxLhG831uQJO/BJZ53eL9/296627773.xml
    .dll windows:6 windows x86 arch:x86

    cb96c8441baf88ba95188ade1a2097bf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ~/-/~~/5kPg0FKa4/z6QdVsK8v/orxLhG831uQJO/BJZ53eL9/4985810901191.xml
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ~/-/~~/5kPg0FKa4/z6QdVsK8v/orxLhG831uQJO/BJZ53eL9/80043181362123437151306412842.xml
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ~/-/~~/5kPg0FKa4/z6QdVsK8v/orxLhG831uQJO/BJZ53eL9/886096022545641162732739528525005.xml
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ~/-/~~/5kPg0FKa4/z6QdVsK8v/orxLhG831uQJO/BJZ53eL9/922038887091389498760504.xml
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Files/8044ef90039da44bd84ba788ca28ee0648e0672b2b6531af0c1f2961c1ae0ad3.exe
    .exe windows:6 windows x64 arch:x64

    261b2bf5d3e981c1d4ef0b71f10a899a


    Headers

    Imports

    Sections

  • Files/82ac677beb7c696987793490a668e5475137b4e17aad7aac41a16ac2c2583bc5.rar
    .rar
  • Business Order Letter.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Files/832c9fff9119971e24be408c892db66a20202af2089d4693047b8e785ebc08dc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/841f58752bc745d62a108bff362df80ca7694a612843de53f8fe4b228089e9da.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Files/84715f7375086ffb94dc811eafd66ffaea10c0307337dfb454f1badd0986c0f9.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/8ab69beaddf4e1df506da6f5969e569a985a2bd2293e2c377a85fa6b0cbf0d93.exe
    .exe windows:4 windows x86 arch:x86

    7192d3773f389d45ebac3cc67d054a8a


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • Baggrundsfarvens120.Rte198
  • Fodlanges.Chr134
  • Gravmles56.jpg
    .jpg
  • annicut.jpg
    .jpg
  • augsburg.ini
  • batiks.cen
  • byvaabnernes.jpg
    .jpg
  • grazing.ini
  • lmarkeds.rot
  • Files/8bc3dc7cafef105a854d94ee515146c0e094b7f5003fa6a145df689cbc846b28.xlsx
    .xls .xlsx windows office2003
  • Files/8e5021734b22342186a7b51235fbccc3d72ca27aa940c5b5c5e876d9fd406a85.exe
    .exe windows:6 windows x64 arch:x64

    d743740f06aa0a325bb5c948f63319ce


    Headers

    Imports

    Sections

  • Files/91f4d71337abe448d6ab73b5406531206732d3ca4a466bf13036c5f2fa7112ef.xlsx
    .xls .xlsx windows office2003
  • Files/99546679227b3930201f5d43d862732bb6ff89cfd6ad672904e98d6cf9c80d10.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/996eb3cc4aacf6c5ea3edfedc425023e5a257c1ac0c7e3feb3273b76fd203a42.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/9a2536a0527594798f792450e53c71d9b401bab9ddbd74dadb451c76c8e43992.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/9f57de82602699e0a3031f06b98ebe647661a9d6e7c918aeee8dd4af8208f910.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/a1424373adddd61cfd77b11602b30d58b28908748dc7490a96ff28e11396aa30.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Files/a53e674bc9f94e77feacc7cd7fa7feb2e7ffcf5c4564e7dde8929a3af12a09c6.doc
    .docx .doc office2007
  • Files/ab6b0dc77b4b5cf9e82d8500889f65ef1714da2222f70821ce159d110d294d56.vbs
    .vbs
  • Files/adb07f246886c9b3923cb565463a66cc3e69f16982dd513669d09b5285ac5cfa.exe
    .exe windows:4 windows x86 arch:x86

    a9c887a4f18a3fede2cc29ceea138ed3


    Headers

    Imports

    Sections

  • Files/aebd1c602c94b9a62652de5497d97d25a48d4480f7f5d4aeb3bed24a41488761.zip
    .zip
  • AutoIt3.exe
    .exe windows:5 windows x86 arch:x86

    83ee9b886c5471409b079d5c97928db2


    Code Sign

    Headers

    Imports

    Sections

  • script.a3x
  • Files/b24c140f1ab6876e230826f829468f77c4f72316ee71477fe51c4c42906dd3ef.ps1
    .ps1
  • Files/b2b9b4ee2a4edc1926c1bfdfa07061968a2e8f3685f5cae15bfbe4723f9156c9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/b315de383e867d0068388adb76517a6afe58475e7e047aacbec656bdb40fa7f6.hta
    .html .vbs polyglot
  • Files/b346d90c384a274825265ae0c9791e164b37ffe660f5bc9b0b27fcb4fa52c0d9.docx
    .docx office2007
  • Files/b4b5676c7e5c5498cf02e60f99d79b0dcacfd143e1e7ace0cd383d9868a78dc3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/b8a69e7edfebd9208c08dc1f3e0add11183ed357ab5d587b3178ad3f83bdf9f3.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/bcd4c78326d20e0467c2f25bf48918f11e477206c88e49add8a5db66e2c89eba.exe
    .exe windows:4 windows x86 arch:x86

    d4b94e8ee3f620a89d114b9da4b31873


    Code Sign

    Headers

    Imports

    Sections

  • Agrar.Min
  • Necropoli/Favnfuldenes/inkorporeringer.ini
  • Necropoli/Favnfuldenes/kunai.jou
  • Necropoli/Favnfuldenes/omregnedes.ino
  • Necropoli/Favnfuldenes/rottefngeren.rad
  • Necropoli/Favnfuldenes/sprogvidenskabsmands.tor
  • Necropoli/Favnfuldenes/truancy.jpg
    .jpg
  • Necropoli/coolingly.gra
  • Synligeres.Spi
    .ps1
  • Files/c0472272fbb70a86f21f0b3f156a74e29c9cb3b9c56fefc5594e90879144d4b9.exe
    .exe windows:6 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • Files/c282ebc2d219603b8e34bd2caf4c1d47cb51f610026fae0efd240da216a7542a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Files/cb11d6775bea68d478da413f47a6877da5ce8d9b07765a3c31637817417b5160.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/cf9b3fedc1121843164755c3205e9bb4f1d83d8595b79498a2a2a2fffc052693.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/d083f48c6a565f994bb04351ca40d8d59147fb1a512435dd4d91a80c86a63b0a.vbs
    .vbs
  • Files/d274a8fca173bf675c950aad9a3d09ef48dce2522756bc6beba0e08db8dcfc90.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/d3d4f2ba231eb442476f53448ce4ee6c56b668b0ff3f108998e24b41c177cf52.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/d9b53ac21c34d2a031131fa607a22b7c4c3de4a3d5ede5679e50971055b16b7a.docx
    .xml
  • Files/db9a5ad78c71de3317658d883c0ea179ea9e6336bb9421cdc3855ec441f10c65.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/dc1ba4ebca29ad4495a29aa2877be92e0e104fde2a40fbde972a3143dab43491.bat
  • Files/de2b16c406a932ab788f74900bdad5b00f926126d98437f151e740905ec2bece.bat
  • Files/e3077c9b095fbabf72fd5c63f5e2a84371c349a057f1b6daacd529a3b0ca79d6.docx
    .docx office2007
  • Files/e48176cbdc36ab68a2299bdd589e7b4358086dcb4da30fedc56b07104efc4726.exe
    .exe windows:4 windows x64 arch:x64

    147442e63270e287ed57d33257638324


    Headers

    Imports

    Sections

  • Files/e4dc621e2aef5e6f4d3b3087572efb9816ce555894a039002fa5cebf053df8cd.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Files/e76a26d2f6641b7ea6f3cde3a349ddc36b4c77c791bbad5b769d16e2f405e47b.vbs
    .vbs
  • Files/e7a44ea5adc366e7600623e7ff433d57cf3ba0bfac8171899497fec6c8a28acc.exe
    .exe windows:6 windows x64 arch:x64

    6c864ce260dd3952094fbdbfe5597535


    Headers

    Imports

    Sections

  • Files/ead2e4a51db0b94f949a6ade2897f78808a9751943ccaac2af4ab199d905743a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/efde274a71cb59f75ece16678bf10427a79e7a39ad244f244041a6038be0c2e9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Files/f4fce85e00e3140f5b060ed982f89a8facd3f23d93925533633d0a456e50d8ca.zip
    .zip
  • Files/f8df3201da8c8008d0434f53809c67758a4bea483191d93dc72202e489f9594c.hta
    .html .js polyglot
  • Files/f8f18e2fbb30de3c6d6af1598ecdabeb99a4cd6c2cfb0ffc212318788ae3d453.lnk
    .lnk
  • Files/fabc467aee7674695a0e55e90f4d7136835d9876fddeac5a9af3e4a071772af5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Files/fccb42f6351784b5530b26c97ef1d2011637ca62273324ff22d9e35657741dc7.xlsx
    .xls .xlsx windows office2003
  • Files/fceb45eb22ef8d6487df8ac9c1d4a61f85e3eba3015b421c12f75c50bc4a0dc5.bat
  • Files/ff7eab60677d54572eecafca54c450d04aa49462ec7f71f44f0af67268ae8312.xlsx
    .xlsx office2007
  • Files/ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e.zip
    .zip