General

  • Target
    osxs.zip
  • Size 2.9MB
  • Sample260604-pkbcnaew2s
  • SHA256 af218d3dc42ab39fef2c0780450851b67eaac698f616a76b8c169e347b1f02d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • DLL Hijacking vulnerability 2 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Insecure Codesign Algorithm 2 IoCs

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • osxs.zip
    .zip 2.9MB
  • HTCTL32.DLL
    .dll 320KB
  • NSM.LIC
    257B
  • NSM.ini
    6KB
  • PCICHEK.DLL
    .dll 18KB
  • PCICL32.DLL
    .dll 3.6MB
  • TCCTL32.DLL
    .dll 387KB
  • client32.exe
    .exe 117KB
  • client32.ini
    723B
  • gehsfe/800_arrowup.tga
    1KB
  • gehsfe/InitialDUState V24_4.dat
    357KB
  • gehsfe/msvcp120.dll
    .dll 434KB
  • gehsfe/vpnclient.dll
    .dll 375KB
  • mirres/800_arrowup.tga
    1KB
  • mirres/InitialDUState V24_4.dat
    357KB
  • mirres/msvcp120.dll
    .dll 434KB
  • mirres/vpnclient.dll
    .dll 375KB
  • msvcr100.dll
    .dll 755KB
  • nskbfltr.inf
    328B
  • pcicapi.dll
    .dll 32KB
  • remcmdstub.exe
    .exe 75KB

osxs.zip

  • SHA256 af218d3dc42ab39fef2c0780450851b67eaac698f616a76b8c169e347b1f02d0
  • MD5 SHA1 SHA512 SSDEEP TLSH