General

  • Target

    64e1a9bc49e7bb668c3d7b29d289de80

  • Size

    4.8MB

  • MD5

    64e1a9bc49e7bb668c3d7b29d289de80

  • SHA1

    1a7de1d6ca6b8253e72e275768c89a8a6dd6ab8a

  • SHA256

    6af58b386ff310a8f73ff3042935e716e8c0f60d0d995441f81400bdebd3be8a

  • SHA512

    35c6aa38eb08a121c0f3e845f73e8465f5294defd7c01e38597bfa9049baeae42db9d0b415a6079280ab1d6480f0c153daa26cf2fa2fc36fca71f11249f84241

  • SSDEEP

    98304:+oBr1iTElvj8oi0b51UILElf/s5bRVSu+7JeBbzEMBrkWZOZYs8fw8:/Br8TIvj8ox0ICs5bvfmJeBEMBYW0YPj

Score
3/10

Malware Config

Signatures

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

Files

  • 64e1a9bc49e7bb668c3d7b29d289de80
    .rar
  • SETUP1.CAB
    .cab
  • A111.DBF
  • AA
  • AA.DBF
  • AACK
  • AACK.DBF
  • AAHM
  • AAHM.DBF
  • AAHMM
  • AAHMM.DBF
  • AAHMM.FPT
  • AAHZB
  • AAHZB.DBF
  • AAXH
  • AAXH.DBF
  • ACMSETUP.EXE
    .exe windows:1 windows x86 arch:x86

    d057661fa0c57da4e10eca58cdf1dc72


    Headers

    Imports

    Sections

  • ACMSETUP.HLP
  • AKCHM
  • AKCHM.DBF
  • AMECSAEX.LOG
  • ASYCFILT.DLL
    .dll windows:4 windows x86 arch:x86

    28b659576236be75a4bbcbfa9113e470


    Headers

    Imports

    Exports

    Sections

  • CHGJKDJK.DBF
  • CHGJKD~1
  • CHGJKD~1.DBF
  • CHGJKD~2
  • CHGJKD~2.DBF
  • CHGJKSPK
  • CHGJKSPK.DBF
  • CHGJKS~1
  • CHGJKS~1.CDX
  • CHGJKS~1.DBF
  • CHGJKS~2.DBF
  • CHJHTCK
  • CHJHTCK.DBF
  • CHJHTC~1
  • CHJHTC~1.DBF
  • CHJHTC~2
  • CHJHTC~2.DBF
  • CHJHTC~3
  • CHJHTC~3.DBF
  • CHKCK
  • CHKCK.CDX
  • CHKCK.DBF
  • CHKCKDJK
  • CHKCKDJK.DBF
  • CHKCKSPK
  • CHKCKSPK.DBF
  • CHKCKXGK
  • CHKCKXGK.DBF
  • CHKCXGB
  • CHKCXGB.DBF
  • CHQCDJK
  • CHQCDJK.DBF
  • CHQCDJK0
  • CHQCDJK0.DBF
  • CHQCSPK.DBF
  • CHQCSPK0
  • CHQCSPK0.CDX
  • CHQCSPK0.DBF
  • CHSPK.DBF
  • CHSPTJ~1.DBF
  • CHSPTJ~2.DBF
  • CHSPTJ~3.DBF
  • CHSPTJ~4.DBF
  • CHSPTKK.DBF
  • CHSPTKK0.DBF
  • CHSPTK~1.DBF
  • CHSPTK~2.DBF
  • CHXSKDJK.DBF
  • CHXSKD~1.DBF
  • CHXSKD~2.DBF
  • CHXSKSPK.DBF
  • CHXSKS~1.CDX
  • CHXSKS~1.DBF
  • CHXSKS~2.DBF
  • CHXSTHK.DBF
  • CHXSTH~1.DBF
  • CKK.DBF
  • COMCAT.DLL
    .dll regsvr32 windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • COMPATID.TXT
  • CXCHGJB.CDX
  • CXCHGJB.DBF
  • CXCHJH~1.DBF
  • CXCHKCB.DBF
  • CXCHSPPH.CDX
  • CXCHSPPH.DBF
  • CXCHSP~1.DBF
  • CXCHSP~2.DBF
  • CXCHXSB.CDX
  • CXCHXSB.DBF
  • CXCHXS~1.CDX
  • CXCHXS~1.DBF
  • CXCHXS~2.DBF
  • CXHM.CDX
  • CXHM.DBF
  • CXPJGJB.CDX
  • CXPJGJB.DBF
  • CXPJGJ~1.DBF
  • CXPJSP~1.DBF
  • CXPJXSB.CDX
  • CXPJXSB.DBF
  • CXPJXS~1.DBF
  • CXZHQK.DBF
  • DLLOG.DBF
  • DWK.DBF
  • GONGSI.DBF
  • GONGSI.FPT
  • GXB.DBF
  • GXB1.CDX
  • GXB1.DBF
  • KMSZB.CDX
  • KMSZB.DBF
  • KMXZ.CDX
  • KMXZ.DBF
  • LBK.DBF
  • LDMSAPP
    .rar
  • Data/AAHMM.FPT
  • Data/GONGSI.DBF
  • Data/GONGSI.FPT
  • Data/SUOMING.DBF
  • Data/SUOMING.FPT
  • Data/aa.DBF
  • Data/aack.DBF
  • Data/aahm.dbf
  • Data/aahmm.dbf
  • Data/aahzb.DBF
  • Data/aakc.DBF
  • Data/aakclj.DBF
  • Data/aaxh.dbf
  • Data/akchm.dbf
  • Data/chgjkdjk.dbf
  • Data/chgjkdjk0.dbf
  • Data/chgjkdjk00.dbf
  • Data/chgjkspk.DBF
  • Data/chgjkspk0.CDX
  • Data/chgjkspk0.dbf
  • Data/chgjkspk00.dbf
  • Data/chjhtck.dbf
  • Data/chjhtck00.dbf
  • Data/chjhtckdjk.dbf
  • Data/chjhtckdjk0.dbf
  • Data/chkck.CDX
  • Data/chkck.DBF
  • Data/chkckdjk.dbf
  • Data/chkckspk.dbf
  • Data/chkckxgk.dbf
  • Data/chkcxgb.dbf
  • Data/chqcdjk.DBF
  • Data/chqcdjk0.DBF
  • Data/chqcspk.DBF
  • Data/chqcspk0.CDX
  • Data/chqcspk0.DBF
  • Data/chspk.DBF
  • Data/chsptjkdjk.dbf
  • Data/chsptjkdjk0.dbf
  • Data/chsptjkspk.dbf
  • Data/chsptjkspk0.dbf
  • Data/chsptkk.DBF
  • Data/chsptkk0.dbf
  • Data/chsptkkdjk.dbf
  • Data/chsptkkdjk0.dbf
  • Data/chxskdjk.dbf
  • Data/chxskdjk0.dbf
  • Data/chxskdjk00.dbf
  • Data/chxskspk.dbf
  • Data/chxskspk0.CDX
  • Data/chxskspk0.dbf
  • Data/chxskspk00.dbf
  • Data/chxsthk.dbf
  • Data/chxsthk00.dbf
  • Data/ckk.dbf
  • Data/cxchgjb.CDX
  • Data/cxchgjb.dbf
  • Data/cxchjhtcb.dbf
  • Data/cxchkcb.dbf
  • Data/cxchspph.CDX
  • Data/cxchspph.dbf
  • Data/cxchsptjb.dbf
  • Data/cxchsptkb.dbf
  • Data/cxchxsb.CDX
  • Data/cxchxsb.dbf
  • Data/cxchxslrb.CDX
  • Data/cxchxslrb.dbf
  • Data/cxchxsthb.dbf
  • Data/cxhm.CDX
  • Data/cxhm.dbf
  • Data/cxpjgjb.CDX
  • Data/cxpjgjb.dbf
  • Data/cxpjgjtcb.dbf
  • Data/cxpjsptkb.dbf
  • Data/cxpjxsb.CDX
  • Data/cxpjxsb.dbf
  • Data/cxpjxsthb.dbf
  • Data/cxzhqk.dbf
  • Data/dllog.DBF
  • Data/dwk.dbf
  • Data/gxb.dbf
  • Data/gxb1.CDX
  • Data/gxb1.dbf
  • Data/kmszb.dbf
  • Data/kmxz.CDX
  • Data/kmxz.dbf
  • Data/lbk.dbf
  • Data/load.DBF
  • Data/lrfxb.dbf
  • Data/pjckd.DBF
  • Data/pjckd00.CDX
  • Data/pjckd00.dbf
  • Data/pjckd11.dbf
  • Data/pjckddj.dbf
  • Data/pjckddj00.dbf
  • Data/pjckddj11.dbf
  • Data/pjgjtcdjk.dbf
  • Data/pjgjtcdjk00.dbf
  • Data/pjgjtcdjk11.dbf
  • Data/pjgjtck.dbf
  • Data/pjgjtck00.dbf
  • Data/pjgjtck11.dbf
  • Data/pjjck.cdx
  • Data/pjjck.dbf
  • Data/pjjckcx.CDX
  • Data/pjjckcx.dbf
  • Data/pjrkd.dbf
  • Data/pjrkd00.cdx
  • Data/pjrkd00.dbf
  • Data/pjrkd11.dbf
  • Data/pjrkddj.dbf
  • Data/pjrkddj00.dbf
  • Data/pjrkddj11.dbf
  • Data/pjrkddjqc.DBF
  • Data/pjrkddjqc00.DBF
  • Data/pjrkdqc.DBF
  • Data/pjrkdqc00.CDX
  • Data/pjrkdqc00.DBF
  • Data/pjspk.DBF
  • Data/pjsptkdjk.dbf
  • Data/pjsptkdjk00.dbf
  • Data/pjsptkdjk11.dbf
  • Data/pjsptkspk.DBF
  • Data/pjsptkspk00.dbf
  • Data/pjsptkspk11.dbf
  • Data/pjxsthdjk.dbf
  • Data/pjxsthdjk00.dbf
  • Data/pjxsthdjk11.dbf
  • Data/pjxsthk.dbf
  • Data/pjxsthk00.dbf
  • Data/pjxsthk11.dbf
  • Data/pmk.dbf
  • Data/printdj.dbf
  • Data/printspk.dbf
  • Data/pzb.dbf
  • Data/rq.dbf
  • Data/spk.dbf
  • Data/spk00.DBF
  • Data/tcbz.dbf
  • Data/xjyhk.dbf
  • Data/xjzhang.CDX
  • Data/xjzhang.DBF
  • Data/xjzhang00.dbf
  • Data/yfzhang.CDX
  • Data/yfzhang.DBF
  • Data/yfzhang00.dbf
  • Data/yhzhang.CDX
  • Data/yhzhang.DBF
  • Data/yhzhang00.dbf
  • Data/ysk.dbf
  • Data/yszhang.CDX
  • Data/yszhang.DBF
  • Data/yszhang00.dbf
  • Data/zhiyuan.dbf
  • Data/zspk.dbf
  • Data/zysyfkm.dbf
  • Data/zzkm.dbf
  • LOAD.DBF
  • LRFXB.DBF
  • MSCOMCT2.OCX
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • MSSETUP.DLL
    .dll windows:1 windows x86 arch:x86

    9f91a6d65da7fff6bdb420d66d40fac0


    Headers

    Imports

    Exports

    Sections

  • MSVCRT.DLL
    .dll windows:4 windows x86 arch:x86

    f325e1ae915b98bc4702bb3efa8aea4a


    Headers

    Imports

    Exports

    Sections

  • MSVCRT40.DLL
    .dll windows:4 windows x86 arch:x86

    57259dcda30c27e977785c33a8441434


    Headers

    Imports

    Exports

    Sections

  • OLEAUT32.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    20de0b13751dfdb7f5be44c0f947b93a


    Headers

    Imports

    Exports

    Sections

  • OLEPRO32.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    8f50e2228a97d0224410529663a78a82


    Headers

    Imports

    Exports

    Sections

  • OPTIONAL.DBF
  • PJ29EB~1.DBF
  • PJ75BE~1.DBF
  • PJ79BC~1.DBF
  • PJA17E~1.DBF
  • PJCKD.DBF
  • PJCKD00.CDX
  • PJCKD00.DBF
  • PJCKD11.DBF
  • PJCKD99.CDX
  • PJCKD99.DBF
  • PJCKDDJ.DBF
  • PJCKDD~1.DBF
  • PJCKDD~2.DBF
  • PJGJTCK.DBF
  • PJGJTC~1
  • PJGJTC~1.DBF
  • PJGJTC~2
  • PJGJTC~2.DBF
  • PJGJTC~3.DBF
  • PJGJTC~4.DBF
  • PJJCK.CDX
  • PJJCK.DBF
  • PJJCKCX.CDX
  • PJJCKCX.DBF
  • PJRKD.DBF
  • PJRKD00.CDX
  • PJRKD00.DBF
  • PJRKD11.DBF
  • PJRKD99.CDX
  • PJRKD99.DBF
  • PJRKDDJ.DBF
  • PJRKDD~1.DBF
  • PJRKDD~2.DBF
  • PJRKDD~3.DBF
  • PJRKDD~4.DBF
  • PJRKDQC.DBF
  • PJRKDQ~1.CDX
  • PJRKDQ~1.DBF
  • PJRKDQ~2.CDX
  • PJRKDQ~2.DBF
  • PJSPK.DBF
  • PJSPTK~1.DBF
  • PJSPTK~2.DBF
  • PJSPTK~3.DBF
  • PJSPTK~4.DBF
  • PJXSTHK.DBF
  • PJXSTH~1.DBF
  • PJXSTH~2.DBF
  • PJXSTH~3.DBF
  • PJXSTH~4.DBF
  • PMK.DBF
  • PRINTDJ.DBF
  • PRINTDJ.FPT
  • PRINTSPK.DBF
  • PZB.DBF
  • REQUIRED.DBF
  • RQ.DBF
  • SETUP2.LST
  • SPK.DBF
  • SPK00.DBF
  • STDOLE2.TLB
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • SUOMING.DBF
  • SUOMING.FPT
  • TCBZ.DBF
  • TXXTQYB.EXE
    .exe .vbs windows:4 windows x86 arch:x86 polyglot

    208bd77ce42c2f2815c3279bdb7a44d9


    Headers

    Imports

    Sections

  • VFP6R.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    f5980ed470e407cb5f29a5787bb80355


    Headers

    Imports

    Exports

    Sections

  • VFP6RENU.DLL
    .dll windows:4 windows x86 arch:x86

    105a34c3b3ecaf6803be201e74c83cf4


    Headers

    Imports

    Exports

    Sections

  • VFP6RUN.EXE
    .exe windows:4 windows x86 arch:x86

    21b0be9e9c79dd1b598e3cb319374dd2


    Headers

    Imports

    Sections

  • WINRAR.EXE
    .exe windows:4 windows x86 arch:x86

    260f949a366d9e0175fcf035679b98f9


    Headers

    Imports

    Exports

    Sections

  • WIZSET32.DLL
    .dll windows:4 windows x86 arch:x86

    a6ddee4715543289a7e54b780402c0c5


    Headers

    Imports

    Exports

    Sections

  • XJYHK.DBF
  • XJZHANG.CDX
  • XJZHANG.DBF
  • XJZHAN~1.DBF
  • YFZHANG.CDX
  • YFZHANG.DBF
  • YFZHAN~1.DBF
  • YHZHANG.CDX
  • YHZHANG.DBF
  • YHZHAN~1.DBF
  • YSK.DBF
  • YSZHANG.CDX
  • YSZHANG.DBF
  • YSZHAN~1.DBF
  • ZHIYUAN.DBF
  • ZSPK.DBF
  • ZYSYFKM.DBF
  • ZZKM.DBF
  • lx.ico
  • ����PJ~1.DBF
  • ����.TXT
  • �½���~1.TXT
  • odbckey.inf
  • odbcstf.dll
    .dll windows:4 windows x86 arch:x86

    33fa7ded9bb1e257c02160cf3f709998


    Headers

    Imports

    Exports

    Sections

  • setup.exe
  • setup.inf
  • setup.ini
  • setup.lst
  • setup.stf
  • setup.tdf
  • 下载说明.htm
    .html .js polyglot