5f3ab41ada3f586e59d2343ac24ed0c226f97fca82b7b03975db73fcf4ade317

General

Target
Stardock.WindowBlinds.10.89.rar
Size 49.9MB
Sample260810-sga49sha25
SHA256 5f3ab41ada3f586e59d2343ac24ed0c226f97fca82b7b03975db73fcf4ade317
MD5 d6bc96a7cd2b465c4318f9e28ac7b234
SHA1 4b85834f533f17998a50c2eafe52fc2abc6a260e
SHA512 20b315bc07abfe06562b8d2bbddf785b83f29bfe8be6787e9201a8d2b7b4d4994245d12e3afbfaab7ebf1ad018bde62a3c298034419e542e2bfd7ff70b139b29
SSDEEP 1572864:Okp8rNmhaZSqE/zd2zR4erQtELTu5ueKauws:OM8rNmhaZ/ErdRersELZLPws
TLSH
T1A5B73353DC09FB3A5261C08F465D2FA05CB70D8D367250A62D8D53C92E0EEE6A52F9BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Stardock.WindowBlinds.10.89/Patch/Patch.exe
- Size 382KB
- SHA256 c4b10c37c3feee757f262bfaaaf1583d3d7c067457564502d34f3e97a4461c92
- MD5 6044d4bfa5d75615b52cd096078ff932
- SHA1 67d14a059e3b785d331c5897d30e7c5ce7897a06
- SHA512 7ca92a0eef7d2d0b11b4b98b12cfc3121fdaa20c3ab9ab2159faa16f8a6e4170b5133921990fb5f4cf675c430b96733d6e8ad362593410539b2c7a2e6371d2f7
- SSDEEP 6144:yIs+VR97rqKeeM4yc0DlokG35MhU6/JM6JgSFJpA5k6qlan/c3V9oVkQtz:yUVR97GPz4eDlFGpKT/S6JzFrA5mlJlM
- TLSH
  T14C842332C4EB1C84D07448B796628BE3C3155776B0635AAB830628BEFF6901BD9D723D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  Stardock.WindowBlinds.10.89/Setup.exe
- Size 54.3MB
- SHA256 c8f1f37c5fa19b5f1775a6938c1b9da950ea9081527d210d743494dc72334a4e
- MD5 cedc351accf5351ecf7ed073095b6e1b
- SHA1 5db245ebf32afce6068a1aa92366b98f60f5c6b7
- SHA512 2a770c55088b636e2b174fd4e63c3b012caa186d4a3fb583f171917dec1bb7951190bf5987e1ea7122eab9c23728abbbc374495abf098b055c646ad23ceec27a
- SSDEEP 1572864:EG6Y1xUkVenE8Go+oYk0qQIr5ZEXLtxgsrr/aJB:EGCkViE8Go1YZqbLuT9aL
- TLSH
  T1E3C73313EDB6D5FCF0160539C06353283A2A3E1C469799EB4FC9B893BEF62829D12535
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

adware defense_evasion discovery spyware trojan upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  Stardock.WindowBlinds.10.89/Soft98.iR.url
- Size 202B
- SHA256 cd49c8c8a991a045e07e301c17735760a6c0c4ef533882c48a7f1d9af6fc8582
- MD5 3ddf222b0633a83ecd9f4dd34f1d3fd3
- SHA1 66cd0d6b22af41cc99a87e7dda2605857f17cb37
- SHA512 ddc1d3cd6f07bc913b0907188ec03f35f4e4f7ba67072317d4c9597e90fa29843b28bb12ff95495b1e4cde4112100dff417dce8e49ea82e0fc4d9b3e3171c010
- TLSH
  T1D5D022584F08C0F4C2A3B80A50F8FC1CE80D708016EAE65862C0DECA0CA9090CC0AF72
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3