42027f43c985a233cd17fa11800e4510d4399bcf6d19ddd43ec07656cec8fff0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.6fbbe07144086075c53b04c8d505b907
Size 2.2MB
Sample261018-tlj4eags7x
SHA256 42027f43c985a233cd17fa11800e4510d4399bcf6d19ddd43ec07656cec8fff0
MD5 6fbbe07144086075c53b04c8d505b907
SHA1 d4aca0a42db343d3c1e14ecdfddd84c8d35936d2
SHA512 ef4551f0b10e057af49b0c4386505b3d889221c9cbc5dfb24c4816411b0e4418414de5d77e3844a2dc4640b499e6f41f2e06e42b80913e75a6b0695dd759ea01
SSDEEP 49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjA:FOGzDOuGP9sOypugTO7F1dzf
TLSH
T11CB5336295C8C9B3C59202B9D652C6BFB736D9CD11012606ABE33F7E236F911E75A330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.6fbbe07144086075c53b04c8d505b907
- Size 2.2MB
- SHA256 42027f43c985a233cd17fa11800e4510d4399bcf6d19ddd43ec07656cec8fff0
- MD5 6fbbe07144086075c53b04c8d505b907
- SHA1 d4aca0a42db343d3c1e14ecdfddd84c8d35936d2
- SHA512 ef4551f0b10e057af49b0c4386505b3d889221c9cbc5dfb24c4816411b0e4418414de5d77e3844a2dc4640b499e6f41f2e06e42b80913e75a6b0695dd759ea01
- SSDEEP 49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjA:FOGzDOuGP9sOypugTO7F1dzf
- TLSH
  T11CB5336295C8C9B3C59202B9D652C6BFB736D9CD11012606ABE33F7E236F911E75A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery installer persistence spyware stealer trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $LOCALAPPDATA/dealply.exe
- Size 923KB
- SHA256 8854c7a980c5489d1dd6bec436369c14d1264e2f04e3d46a5d78ac9a875629c6
- MD5 caaca3d3783173998fbb157fdd07a846
- SHA1 92e8b1d702c8b8411a33f9497f8bfba72628522d
- SHA512 d77915dc3b7f3182a64625f778e921716dbe0226fb90a425c685fd95c07696872b46b199b42835b77ed1eb6bf602fc4f8e2f0de2f1b8e25b00d07e8c33c8aec8
- SSDEEP 24576:tKkd4HgrpbPhyiE4gIMcXFKW3O+GxodwJz:QBHgrpbcizcc15LGxo2x
- TLSH
  T17B15236712C09877C592B8F0D19AC2BE9FB97EA62A04540F77313F6E0A35583CD5963C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery installer spyware stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH
  T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsRandom.dll
- Size 21KB
- SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
- MD5 ab467b8dfaa660a0f0e5b26e28af5735
- SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
- SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
- SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
- TLSH
  T1A3A2E1AFFA7A8B72C21162394365DDF861D08DDD01EE1E479A2EC226ACBD0400D7221B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsisdt.dll
- Size 5KB
- SHA256 2261027077f23c8dba6b72af28862832aaa059740d0f5634b46cabb14326dd10
- MD5 df4795dfabe3bc9278a73d496cc4b40d
- SHA1 2648ded47e29ecf3e1a1cc20c631e83caf566897
- SHA512 013d9712c3d699a7f41ab3e55931c9abb421fb2eda3542da5a4831ad2f073a1b0643120cc78147db0bfcd01df98ade3045ecb2f1e252fff1dc40be845e5ae303
- SSDEEP 24:etGSyYi61xyMmuEwv61OVXOwr+t5blXgO8ELnD3TPrHjf7Xz5CY1aeBEW58q6TvK:6y2xyNuEwWwU5blmPeB958xTvT7L/
- TLSH
  T143C16366BB1848F2C0AC4D73126E586283BDE00C25ECE05D9FC10C266CA99567FB8A4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- TLSH
  T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/version.dll
- Size 6KB
- SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
- MD5 ebc5bb904cdac1c67ada3fa733229966
- SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
- SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
- SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
- TLSH
  T115C14DD52E7C5673E2F1433742CF8B983632909000B81A5B5779425ABD8A3E1416B77C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  $_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
- Size 90B
- SHA256 4fb8d38e19a950ea24098dfded5f46bee24581a0ddd20e759bd76c40c358a653
- MD5 0539649dfb977fcb9a6f9818524ee150
- SHA1 5754dda1453246119b3c130b70a7c61a90c9ee0c
- SHA512 4cca23a2ee74bac095e217aa5151368f230a08119f51f5a0561c5b03d6ad47132e131cf82dc05709527de6b0a8bcd9c7c5087230749af0aa52d3ce8c5dcb134c
- TLSH
  T12FB01100CE8B2B8000388A03CA088003EBA2A2F0B2E8B02022C808038203AAAC0CB082
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  background.html
- Size 1KB
- SHA256 67cb79577f26d6632168145a2b7b4d3ad6b46247f0244a9f6f25b45fceaeddc3
- MD5 b283e8f75dcc4349e1d88e72358ea3b8
- SHA1 b017c920e90daeae106ad152ecfb42a1d8d203a7
- SHA512 c714233bc1d7ae252695d7b56213523525beb4b8e198b11377213647418a76824e89c49dd75b82beb0fa205646ca458ba7f14d42fc350d6836a6921aa9524402
- TLSH
  T16F2195CCC7CD061350E41468C8A700C4527DB7B23B988CBA3CAAC02A68BC26B825C3B6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  DealPlyIE.dll
- Size 81KB
- SHA256 c28c50700c5560d834b058e0ca816e1ccd003e77fb58777f55cd4b9d015f9013
- MD5 53905cd4461961f341c0b41d4d0ec02b
- SHA1 aa9d6284707f25a4ad35336ed6c131ac56f175aa
- SHA512 84da2711dbeed65043150ed5afc23a6482ebb13e080a2e311f687ede136751c5f6e5fbeb947c0380e8b29ac64cb5741226a8ec23d69cd340ed8070fd48177248
- SSDEEP 1536:FXEdWDidDMsRs/sbOyDsxbU3Q+HUWY9f5YJ+/W5P:F0iX/AyS3HHi9f5YJ+yP
- TLSH
  T18F837B217AD0C032C0AA59305979C6602F7DB931DFF4C88B7F1A066D5E617D0B63A3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral23 behavioral24
- Target
  vn-zugo.exe
- Size 720KB
- SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
- MD5 6ee75d20b907780781e90fa97897b8ed
- SHA1 03c0ce29326ceef11b237c91ca0922f3dc6ac0b4
- SHA512 36eb2dc03ec76756a92aca72b3827105344b4ee2b179b4abf9432828505ee6d151df6959b2280d4086952ebefa4b273f83ab25ae1e2299bb4c3ef859483f1e08
- SSDEEP 12288:CU1qWMBibgTEX4MXAoQu7uIpKfHB/mY+oCIPR08gu+8uRj2d4Gp57m63OM0u:CIqWeibgoIaUCoh+/ZyudGp5/3JB
- TLSH
  T139F42343BBC090A3F08F5B31DACBD939EA7ADD1046484523B3D7AD9BB8F2F422914559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral25 behavioral26
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 20KB
- SHA256 8f62633831a326174f05e89503e42a493aa834fa6d7ba7138d9d57ac5873512d
- MD5 de2b06d8abcd4a1d3330e415ce638a6a
- SHA1 2f1bf738915b288530dedb861f4ea4f60069a91f
- SHA512 8dbc0edb71d6acc327418270b33d5627d7940ce406e54152af9f6c8f6d90c7239aa647a0e1f4769d0aa8bd3e38d60643e6356ff7a5ccf7dc44c5617f72277b70
- SSDEEP 96:J1szPlsFYmIGExrjwIqiwZePAYyU76b+4d:Juztr+8wzg7xN4
- TLSH
  T1AB928232038452F3E0C4033331C676C7AAFB5468A3AF085F9A43566918912ABED7CB43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/Math.dll
- Size 66KB
- SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
- MD5 b140459077c7c39be4bef249c2f84535
- SHA1 c56498241c2ddafb01961596da16d08d1b11cd35
- SHA512 fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
- SSDEEP 1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
- TLSH
  T184639E3375D540F2D19E40B514A55F2BDF7DA6248BE24DD34F6628CAAE20EE1A233707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32