Resubmissions

20/04/2025, 09:15

250420-k8b7mstlz9 10

20/04/2025, 09:09

250420-k4v4ystlt6 4

General

  • Target

    archive.7z

  • Size

    112.3MB

  • MD5

    93e08c28fa7099c6053c61d817590600

  • SHA1

    938067bef66242ddfe538816372844ef04b12afb

  • SHA256

    cecc051a6568f2e60daa72a70d81b69c0e929f11503f28904b3204ecd38a7111

  • SHA512

    12bff3146503d443f63854fa9df770e66a0c18ce0f5d4c554728957b303cd678c3079927f7ae97bbc993d395673e48dbe2ba453642d127ce1577e95797fe75c2

  • SSDEEP

    1572864:ldosNbFsPGiKzspvJxO+8v/0jMlECcnT4hnb4kvVsSfIUk0JrlIzNr7aPHIRN2st:XXLssGh7T4hnck9JQwI4g2sLks

Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • archive.7z
    .7z

    Password: NMCLDJX3SK2

  • Setup.exe
    .exe windows:10 windows x64 arch:x64

    Password: NMCLDJX3SK2

    d8314833ef52a5350cf45df946c73dd9


    Headers

    Imports

    Sections

  • data/Microsoft.Management.Infrastructure.Native.dll
    .dll windows:4 windows x86 arch:x86

    Password: NMCLDJX3SK2

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • data/Microsoft.Management.Infrastructure.dll
    .dll windows:4 windows x86 arch:x86

    Password: NMCLDJX3SK2

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • data/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    Password: NMCLDJX3SK2

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • data/System.Management.Automation.dll
    .dll windows:4 windows x86 arch:x86

    Password: NMCLDJX3SK2

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • data/brotli/LICENSE.txt
  • data/brotli/README.md
  • data/brotli/decode.h
  • data/brotli/encode.h
  • data/brotli/port.h
  • data/brotli/shared_dictionary.h
  • data/brotli/types.h
  • data/cacert/LICENSE.url
  • data/curl/curl.h
  • data/curl/curlver.h
  • data/curl/easy.h
  • data/curl/header.h
  • data/curl/mprintf.h
  • data/curl/multi.h
  • data/curl/options.h
  • data/curl/stdcheaders.h
  • data/curl/system.h
  • data/curl/typecheck-gcc.h
  • data/curl/urlapi.h
  • data/curl/websockets.h
  • data/gkv.dll
  • data/libbrotlicommon.a
    .js
  • data/libbrotlidec.a
  • data/libcrypto.a
  • data/libcurl.a
  • data/libcurl.dll.a
  • data/libnghttp2.a
  • data/libnghttp3.a
  • data/libngtcp2.a
  • data/libngtcp2_crypto_quictls.a
  • data/libpsl.a
  • data/libpsl.h
  • data/libpsl/AUTHORS.txt
  • data/libpsl/COPYING.txt
  • data/libpsl/NEWS.txt
  • data/libressl/COPYING.txt
  • data/libressl/ChangeLog.txt
  • data/libressl/README.md
  • data/libssh2.a
  • data/libssh2.h
  • data/libssh2/COPYING.txt
  • data/libssh2/NEWS.txt
  • data/libssh2/README.txt
  • data/libssh2/RELEASE-NOTES.txt
  • data/libssh2/docs/AUTHORS.txt
  • data/libssh2/docs/HACKING-CRYPTO.txt
  • data/libssh2/docs/INSTALL_AUTOTOOLS.txt
  • data/libssh2/docs/TODO.txt
  • data/libssh2_publickey.h
  • data/libssh2_sftp.h
  • data/libssl.a
  • data/libz.a
  • data/libzstd.a
  • data/mscorlib.dll
    .dll windows:4 windows x86 arch:x86

    Password: NMCLDJX3SK2

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • data/mscorrc.dll
    .dll windows:6 windows x86 arch:x86

    Password: NMCLDJX3SK2


    Code Sign

    Headers

    Sections

  • data/nghttp2/AUTHORS.txt
  • data/nghttp2/COPYING.txt
  • data/nghttp2/ChangeLog.txt
  • data/nghttp2/README.rst
  • data/nghttp2/nghttp2.h
  • data/nghttp2/nghttp2ver.h
  • data/nghttp3/AUTHORS.txt
  • data/nghttp3/COPYING.txt
  • data/nghttp3/ChangeLog.txt
  • data/nghttp3/README.rst
  • data/nghttp3/nghttp3.h
  • data/nghttp3/version.h
  • data/ngtcp2/AUTHORS.txt
  • data/ngtcp2/COPYING.txt
  • data/ngtcp2/ChangeLog.txt
  • data/ngtcp2/README.rst
  • data/ngtcp2/ngtcp2.h
  • data/ngtcp2/ngtcp2_crypto.h
  • data/ngtcp2/ngtcp2_crypto_quictls.h
  • data/ngtcp2/version.h
  • data/openssl/aes.h
  • data/openssl/asn1.h
  • data/openssl/asn1t.h
  • data/openssl/bio.h
  • data/openssl/blowfish.h
  • data/openssl/bn.h
  • data/openssl/buffer.h
  • data/openssl/camellia.h
  • data/openssl/cast.h
  • data/openssl/chacha.h
  • data/openssl/cmac.h
  • data/openssl/cms.h
  • data/openssl/comp.h
  • data/openssl/conf.h
  • data/openssl/crypto.h
  • data/openssl/ct.h
  • data/openssl/curve25519.h
  • data/openssl/des.h
  • data/openssl/dh.h
  • data/openssl/dsa.h
  • data/openssl/dtls1.h
  • data/openssl/ec.h
  • data/openssl/ecdh.h
  • data/openssl/ecdsa.h
  • data/openssl/engine.h
  • data/openssl/err.h
  • data/openssl/evp.h
  • data/openssl/fs/dgs/fxf/7za.dll
    .dll windows:4 windows x86 arch:x86

    Password: NMCLDJX3SK2

    edb01ced967d1545f46e4d8d004d088e


    Headers

    Imports

    Exports

    Sections

  • data/openssl/fs/dgs/fxf/7za.exe
    .exe windows:4 windows x86 arch:x86

    6f18dc28cf1faef40cedf506a5685aac


    Headers

    Imports

    Sections

  • data/openssl/fs/dgs/fxf/aes.h
  • data/openssl/fs/dgs/fxf/asn1.h
  • data/openssl/fs/dgs/fxf/asn1t.h
  • data/openssl/fs/dgs/fxf/bin
    .zip
  • data/openssl/fs/dgs/fxf/bio.h
  • data/openssl/fs/dgs/fxf/blowfish.h
  • data/openssl/fs/dgs/fxf/bn.h
  • data/openssl/fs/dgs/fxf/buffer.h
  • data/openssl/fs/dgs/fxf/curl.h
  • data/openssl/fs/dgs/fxf/curlver.h
  • data/openssl/fs/dgs/fxf/easy.h
  • data/openssl/fs/dgs/fxf/header.h
  • data/openssl/fs/dgs/fxf/mprintf.h
  • data/openssl/fs/dgs/fxf/multi.h
  • data/openssl/fs/dgs/fxf/options.h
  • data/openssl/fs/dgs/fxf/stdcheaders.h
  • data/openssl/fs/dgs/fxf/system.h
  • data/openssl/fs/dgs/fxf/typecheck-gcc.h
  • data/openssl/fs/dgs/fxf/urlapi.h
  • data/openssl/fs/dgs/fxf/websockets.h
  • data/openssl/hkdf.h
  • data/openssl/hmac.h
  • data/openssl/idea.h
  • data/openssl/kdf.h
  • data/openssl/lhash.h
  • data/openssl/libQt5WebKit.dll
    .dll windows:4 windows x86 arch:x86

    cd21e0f91d706c91efbfd07bb528e811


    Headers

    Imports

    Exports

    Sections

  • data/openssl/libcef.dll
    .dll windows:5 windows x86 arch:x86

    b6d755e11382c3e7f4783c401c9443a1


    Headers

    Imports

    Exports

    Sections

  • data/openssl/md4.h
  • data/openssl/md5.h
  • data/openssl/modes.h
  • data/openssl/obj_mac.h
  • data/openssl/objects.h
  • data/openssl/ocsp.h
  • data/openssl/opensslconf.h
  • data/openssl/opensslfeatures.h
  • data/openssl/opensslv.h
  • data/openssl/ossl_typ.h
  • data/openssl/pem.h
  • data/openssl/pkcs12.h
  • data/openssl/pkcs7.h
  • data/openssl/poly1305.h
  • data/openssl/posix_time.h
  • data/openssl/rand.h
  • data/openssl/rc2.h
  • data/openssl/rc4.h
  • data/openssl/ripemd.h
  • data/openssl/rsa.h
  • data/openssl/safestack.h
  • data/openssl/sha.h
  • data/openssl/sm3.h
  • data/openssl/sm4.h
  • data/openssl/srtp.h
  • data/openssl/ssl.h
  • data/openssl/ssl3.h
  • data/openssl/stack.h
  • data/openssl/tls1.h
  • data/openssl/ts.h
  • data/openssl/txt_db.h
  • data/openssl/ui.h
  • data/openssl/x509.h
  • data/openssl/x509_vfy.h
  • data/openssl/x509v3.h
  • data/zconf.h
  • data/zdict.h
  • data/zlib/ChangeLog.txt
  • mapistub.dll
    .dll windows:6 windows x64 arch:x64

    f4b90afa3bfab6b67ce785a9afa91f7e


    Headers

    Imports

    Sections