General

  • Target
    ModsHubSetup.exe
  • Size 113.5MB
  • Sample260825-t58k4scl8x
  • SHA256 7a0d488e54283c0e0e20864b8734580d7057e190601fd97463df8e9a6b5a1192
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 10 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • ModsHubSetup.exe
    .exe 113.5MB
  • $PLUGINSDIR/SpiderBanner.dll
    .dll 9KB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/WinShell.dll
    .dll 3KB
  • $PLUGINSDIR/app-64.7z
    .7z 113.0MB
  • LICENSE.electron.txt
    1KB
  • LICENSES.chromium.html
    18.6MB
  • ModsHub.exe
    .exe 212.7MB
  • chrome_100_percent.pak
    113KB
  • chrome_200_percent.pak
    183KB
  • d3dcompiler_47.dll
    .dll 4.5MB
  • dxcompiler.dll
    .dll 24.5MB
  • dxil.dll
    .dll 1.4MB
  • ffmpeg.dll
    .dll 3.0MB
  • icudtl.dat
    10.3MB
  • libEGL.dll
    .dll 510KB
  • libGLESv2.dll
    .dll 7.6MB
  • locales/af.pak
    596KB
  • locales/am.pak
    966KB
  • locales/ar.pak
    1.0MB
  • locales/bg.pak
    1.1MB
  • locales/bn.pak
    1.4MB
  • locales/ca.pak
    671KB
  • locales/cs.pak
    697KB
  • locales/da.pak
    626KB
  • locales/de.pak
    672KB
  • locales/el.pak
    1.2MB
  • locales/en-GB.pak
    543KB
  • locales/en-US.pak
    549KB
  • locales/es-419.pak
    662KB
  • locales/es.pak
    659KB
  • locales/et.pak
    602KB
  • locales/fa.pak
    996KB
  • locales/fi.pak
    612KB
  • locales/fil.pak
    695KB
  • locales/fr.pak
    716KB
  • locales/gu.pak
    1.4MB
  • locales/he.pak
    871KB
  • locales/hi.pak
    1.5MB
  • locales/hr.pak
    671KB
  • locales/hu.pak
    717KB
  • locales/id.pak
    592KB
  • locales/it.pak
    648KB
  • locales/ja.pak
    791KB
  • locales/kn.pak
    1.6MB
  • locales/ko.pak
    671KB
  • locales/lt.pak
    729KB
  • locales/lv.pak
    727KB
  • locales/ml.pak
    1.6MB
  • locales/mr.pak
    1.3MB
  • locales/ms.pak
    624KB
  • locales/nb.pak
    598KB
  • locales/nl.pak
    623KB
  • locales/pl.pak
    696KB
  • locales/pt-BR.pak
    652KB
  • locales/pt-PT.pak
    656KB
  • locales/ro.pak
    681KB
  • locales/ru.pak
    1.1MB
  • locales/sk.pak
    708KB
  • locales/sl.pak
    678KB
  • locales/sr.pak
    1.0MB
  • locales/sv.pak
    605KB
  • locales/sw.pak
    640KB
  • locales/ta.pak
    1.6MB
  • locales/te.pak
    1.5MB
  • locales/th.pak
    1.3MB
  • locales/tr.pak
    651KB
  • locales/uk.pak
    1.1MB
  • locales/ur.pak
    981KB
  • locales/vi.pak
    774KB
  • locales/zh-CN.pak
    554KB
  • locales/zh-TW.pak
    547KB
  • resources.pak
    6.5MB
  • resources/app-update.yml
    369B
  • resources/app.asar
    112.9MB
  • resources/app.asar.unpacked/node_modules/node-notifier/.prettierrc
    73B
  • resources/app.asar.unpacked/node_modules/node-notifier/LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/node-notifier/index.js
    1KB
  • resources/app.asar.unpacked/node_modules/node-notifier/lib/checkGrowl.js
    .js 550B
  • resources/app.asar.unpacked/node_modules/node-notifier/lib/utils.js
    .js 14KB
  • resources/app.asar.unpacked/node_modules/node-notifier/notifiers/balloon.js
    .js 4KB
  • resources/app.asar.unpacked/node_modules/node-notifier/notifiers/growl.js
    .js 1KB
  • resources/app.asar.unpacked/node_modules/node-notifier/notifiers/notificationcenter.js
    .js 2KB
  • resources/app.asar.unpacked/node_modules/node-notifier/notifiers/notifysend.js
    .js 2KB
  • resources/app.asar.unpacked/node_modules/node-notifier/notifiers/toaster.js
    .js 4KB
  • resources/app.asar.unpacked/node_modules/node-notifier/package.json
    1KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/Info.plist
    .xml 1KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/MacOS/terminal-notifier
    .macho 85KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/PkgInfo
    8B
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/Resources/Terminal.icns
    360KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/Resources/en.lproj/Credits.rtf
    .rtf 436B
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/Resources/en.lproj/InfoPlist.strings
    92B
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/Resources/en.lproj/MainMenu.nib
    25KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/notifu/LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/notifu/notifu.exe
    .exe 250KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/notifu/notifu64.exe
    .exe 299KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/snoreToast/LICENSE
    7KB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/snoreToast/snoretoast-x64.exe
    .exe 2.4MB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/snoreToast/snoretoast-x86.exe
    .exe 2.0MB
  • resources/app.asar.unpacked/node_modules/node-notifier/vendor/terminal-notifier-LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/ps-list/index.js
    .js 3KB
  • resources/app.asar.unpacked/node_modules/ps-list/license
    1KB
  • resources/app.asar.unpacked/node_modules/ps-list/package.json
    606B
  • resources/app.asar.unpacked/node_modules/ps-list/vendor/fastlist-0.3.0-x64.exe
    .exe 275KB
  • resources/app.asar.unpacked/node_modules/ps-list/vendor/fastlist-0.3.0-x86.exe
    .exe 220KB
  • resources/app.asar.unpacked/node_modules/registry-js/.prettierignore
    102B
  • resources/app.asar.unpacked/node_modules/registry-js/LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.node.recipe
    320B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/CL.command.1.tlog
    5KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/CL.read.1.tlog
    59KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/CL.write.1.tlog
    668B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/Cl.items.tlog
    329B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/link.command.1.tlog
    1KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/link.read.1.tlog
    5KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/link.secondary.1.tlog
    507B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/link.write.1.tlog
    702B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/obj/registry/registry.tlog/registry.lastbuildstate
    187B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/registry.exp
    987B
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/registry.iobj
    604KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/registry.ipdb
    264KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/registry.lib
    2KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/Release/registry.node
    .dll 200KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/registry.vcxproj
    .xml 11KB
  • resources/app.asar.unpacked/node_modules/registry-js/build/registry.vcxproj.filters
    .xml 2KB
  • resources/app.asar.unpacked/node_modules/registry-js/dist/lib/index.js
    .js 658B
  • resources/app.asar.unpacked/node_modules/registry-js/dist/lib/index.js.map
    128B
  • resources/app.asar.unpacked/node_modules/registry-js/dist/lib/registry.js
    .js 5KB
  • resources/app.asar.unpacked/node_modules/registry-js/dist/lib/registry.js.map
    3KB
  • resources/app.asar.unpacked/node_modules/registry-js/package.json
    946B
  • resources/app.asar.unpacked/node_modules/utimes/LICENSE.md
    1KB
  • resources/app.asar.unpacked/node_modules/utimes/dist/main.js
    .js 10KB
  • resources/app.asar.unpacked/node_modules/utimes/dist/main.js.map
    9KB
  • resources/app.asar.unpacked/node_modules/utimes/lib/binding/napi-v3/utimes.node
    .dll 143KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/LICENSE.md
    1KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/common.gypi
    762B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/except.gypi
    560B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/index.js
    296B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/napi-inl.deprecated.h
    7KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/napi-inl.h
    .js 199KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/napi.h
    .js 118KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/node_api.gyp
    132B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/noexcept.gypi
    639B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/package-support.json
    467B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/package.json
    927B
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/tools/README.md
    3KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/tools/check-napi.js
    .js 3KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/tools/clang-format.js
    .js .sh 1KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/tools/conversion.js
    .js 14KB
  • resources/app.asar.unpacked/node_modules/utimes/node_modules/node-addon-api/tools/eslint-format.js
    .js .sh 1KB
  • resources/app.asar.unpacked/node_modules/utimes/package.json
    1KB
  • resources/app.asar.unpacked/node_modules/win-version-info/LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/win-version-info/bin.js
    .js .sh 247B
  • resources/app.asar.unpacked/node_modules/win-version-info/deps/UTF8Conversion/LICENSE
    573B
  • resources/app.asar.unpacked/node_modules/win-version-info/deps/UTF8Conversion/utf8conv.h
    4KB
  • resources/app.asar.unpacked/node_modules/win-version-info/deps/UTF8Conversion/utf8conv_inl.h
    10KB
  • resources/app.asar.unpacked/node_modules/win-version-info/index.js
    .js 514B
  • resources/app.asar.unpacked/node_modules/win-version-info/package.json
    947B
  • resources/app.asar.unpacked/node_modules/win-version-info/prebuilds/win32-ia32/node.napi.node
    .dll 198KB
  • resources/app.asar.unpacked/node_modules/win-version-info/prebuilds/win32-x64/node.napi.node
    .dll 251KB
  • resources/app.asar.unpacked/node_modules/win-version-info/skip.js
    117B
  • resources/app.asar.unpacked/node_modules/win-version-info/src/showver.h
    116B
  • resources/elevate.exe
    .exe 115KB
  • snapshot_blob.bin
    333KB
  • v8_context_snapshot.bin
    698KB
  • vk_swiftshader.dll
    .dll 5.4MB
  • vk_swiftshader_icd.json
    106B
  • vulkan-1.dll
    .dll 932KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/nsis7z.dll
    .dll 424KB
  • $R0/Uninstall ModsHub.exe
    .exe 156KB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/WinShell.dll
    .dll 3KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB

ModsHubSetup.exe

  • IMPHASH b34f154ec913d2d2c435cbd644e91687
  • SHA256 7a0d488e54283c0e0e20864b8734580d7057e190601fd97463df8e9a6b5a1192
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
13:38:14:9d:64:4e:8a:df:af:5b:17:63:84:30:da:17:44:fe:a6:6e:e5:cb:f3:83:fb:12:6f:25:13:58:60:d3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=16879619,CN=OpenCore OÜ,O=OpenCore OÜ,L=Tallinn,ST=Harju maakond,C=EE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024545
Chains

Jan 1, 0001

Minor OS version
0
Major OS version
4
Entry point
13199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths