Extracted

• • Target
    d3dcompiler_43.dll
  • Size 4.3MB
  • SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
  • MD5 fea40e5b591127ae3b065389d058a445
  • SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
  • SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
  • SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
  • TLSH
    T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    doc/manual.pdf
  • Size 1008KB
  • SHA256 b6ca877df71e52c95b38477229323e52677f65435991b0f0c0697f4bf24c7ef6
  • MD5 7e204e1144f00d8cb798aa8d55dc3c2f
  • SHA1 3aed32fb513b49f7aea9422f1ba9b57f7141bd7a
  • SHA512 3c1f94b41c27a75307f17006002205a20989760d294797b7715314cc8319440333d15c4766f2f85b00aade04ece871ce27a2410517871335ce613321ccf1b377
  • SSDEEP 24576:uQYQPAfFzFhx80tV3G2fnJf5rV4tg+Y0udpqa027woU5FS:lP2FzFhJbJrV4tTtQka027woH
  • TLSH
    T139257C5DF5E80C8DE842CA95953E3FAB83AD3137E4C4BCC044BC5A4A718611DDB9BAD2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral2behavioral3
• • Target
    installer/mpv-install.bat
  • Size 16KB
  • SHA256 906669f7c397d5137fd3e3dde5d78beff27dd0c51edd4b22ef7d27ae578f0436
  • MD5 113f42bbf4fa18ce9cb8887b156ea10a
  • SHA1 af21674e5f2082368c9fa18e31988b0eb27a5171
  • SHA512 f6682b6bcff867a167c6ca1bc36887ff22b6b434fbb17891fd050623d50f12b107928e95f96a34999afe731f4e7b23b4a36c38c4663467d8c61a512a0248dce9
  • SSDEEP 384:JtsU9AbKBMNzsc6qwJHNWsaziMrkzMBtJjndy3PsMZc0nuTOLDLEGbwFBnQQUzJ0:Jtb9AbKBMNzsc6qwJHNWsIiMQzMBLjnL
  • TLSH
    T1CD72DCE3D0052AB28AD723F2BE2615D3B315C3695E255A8D739FD1BDB34F106021E7A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral4behavioral5
• • Target
    installer/mpv-uninstall.bat
  • Size 3KB
  • SHA256 5770710c6e39549db0df6a0e88491f862b12d90ae14177968bbf2dbcce60ea27
  • MD5 ab233e5cff33841387b6862520eda465
  • SHA1 c0f5ac9ce0b4c5c9a6e8a945db87cf1514763737
  • SHA512 3bb445ba15168ae08ce119158abecb9559fb8724737b6fb0c21dc7ecccda61e91187997b0c68a258dd8ff24a3263d6fc4a3e80fe0e1f8a2257c68e70754c3518
  • TLSH
    T10451426FBB0541910DA011C3D1789B4373AE816F59B2E2C472C2A2E0B507C5E47B42ED
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  executionpersistenceransomware
  behavioral6behavioral7
• • Target
    installer/updater.ps1
  • Size 19KB
  • SHA256 01c35d27f90de8da36b5106511c8c4937c934b80708abd8d44c1edd925b6a98d
  • MD5 f6c0fe3de38ad47054acb3c26fb379e9
  • SHA1 4b1dc616c18f1c4d38fc89a3c0434a24da6efac5
  • SHA512 f10cc47223af1572f0106246a1e29e72cc48ad1b7fe32fcff2c2ecae1bbb4dc0926351a7575ac4d52c042a2827747e4931197e5a0a1859b02b28d7a48dffc721
  • SSDEEP 192:xK5BM9kD4A/m7gmURle1yV742fSSsXMG/kZFzFAMlPGVKIQKYK7NvHK93xKnHAx+:xqM9CRlDV742fSHXKXilHAinRkqqo2u1
  • TLSH
    T12092756A7546C12556B3773ECD424588FD67412B824981A0B9ACC0C4BF7026EE3F9EDF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  behavioral8behavioral9
• • Target
    mpv.com
  • Size 3KB
  • SHA256 6295c40d4fd6dacaf7fa7e9b13f49d053f42a8ca748d8c55fe802b465b580c7f
  • MD5 98a841b458d1faea31d9ca2245a03c8e
  • SHA1 b127ac8b51e52c6aef0a25da55c3e5b9c1ebec22
  • SHA512 848ebe41f913a949f9bde5920c07cb4e4867dfbf5a2bfc3ed24e1ba1e147be6369d07d652f23835a3498caa4f69f7b3d05d99f0f2eeaf494d1a7676747667245
  • TLSH
    T17771527159A405BDD09D0F79121991867CB03B200B828AEF545A3B4A2E62FFFB53CB42
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral10behavioral11
• • Target
    mpv.exe
  • Size 112.1MB
  • SHA256 b0bb2dc1928e6d86cc26d950815c80c977440081e814c6a46e93f6e9e99c276d
  • MD5 f2ab2afdacc529e91dfd3e8c44f122d4
  • SHA1 1accdaeee508ff62b2eecce936d077c0128e21d4
  • SHA512 1a52812902f9d390b0700e8c382ff058c497fa5151a8eb8fca239c3dc80615778bfe1566e22a5db461037595753db79ee2fa67c13f47624bdb1d3df54e55c4a4
  • SSDEEP 786432:NfIocCA6qqBLCs/ERleFvozth0BbhagZGuS9JJia0v/Ilf9:NvcCA6FBLCivoxl8GpKv29
  • TLSH
    T11A489E8BF1A750ACD41BC4B4436AB722FA34785D43245AFB22D996343E76BC06B79F04
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral12behavioral13
• • Target
    updater.bat
  • Size 818B
  • SHA256 120fd67c7d0109eb01961a47c301f77da7f6da18b80a7b39c5f7ea4664817f7b
  • MD5 2d24ee440f67d85e00a8543f50d9110e
  • SHA1 8e1cafa4ac8610a7024e1a3f9a3f478395b30134
  • SHA512 f582361502bc419e93ddd9cd60c0b094ba8d2a9dbe75a39978fb991d81afb5f268e8136098d24730f8656a7fb2b1e7b5cc9eeb36f0f9b34da3592597f2c23c27
  • TLSH
    T154018E118949D21033715639B9D2C8B2D32D4167038353D272C012DCA7677A69D8F5DD
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  defense_evasionexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  behavioral14behavioral15