General

  • Target

    2feaa163f577eac8ec3401adeb232fa4

  • Size

    1.7MB

  • MD5

    2feaa163f577eac8ec3401adeb232fa4

  • SHA1

    31929b9ce6fd5b1678c8f28e0ad4e78d95a74221

  • SHA256

    6bf518ec84e0c61a8a4e4d0d967d116a55edea9cb2322c699e95c6eb4b9f01aa

  • SHA512

    c9fe332dcca08ef7006e8504a468f1f437f2300cd105803bda0592dce39edf031a665a00f17ea4abce5b0df8c5b149ad7cf5405e86c5b23f64480cd6468174fe

  • SSDEEP

    49152:Br4m2oc9s27ALCMu52TfPAjViNQmNG+KDlBvKI8M6bd:Z4jokYLTu563ApmQPDlFKI8lh

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • 2feaa163f577eac8ec3401adeb232fa4
    .rar
  • zhqy/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    711c893e4d8189fd14b6563a4e35e663


    Headers

    Imports

    Exports

    Sections

  • zhqy/CHESS.CHM
    .chm
  • zhqy/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • zhqy/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    946eb0a1e85c9ade4acaf634eb5a64f1


    Headers

    Imports

    Exports

    Sections

  • zhqy/chess.dat
  • zhqy/chess.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • zhqy/d3dx10.dll
    .exe windows:4 windows x86 arch:x86

    f073f0e961d0c47737566e8dc4a1bfaa


    Headers

    Imports

    Exports

    Sections

  • zhqy/ioSpecial.ini
  • zhqy/modern-header.bmp
  • zhqy/modern-wizard.bmp