General

  • Target

    65d9ba96fdad94d5e987c0775ec51133

  • Size

    5.9MB

  • MD5

    65d9ba96fdad94d5e987c0775ec51133

  • SHA1

    8173e33f15921e8b82f6e506aeb918b7d63db61a

  • SHA256

    482fb3de712674447b86d5c333d2d4a920330a250a598db3db2b70b9caad8f92

  • SHA512

    0baeb19c25a512e54ee0d0ec7e1168e9df67e84962b1ded33bbd0d9a4db517c167a62997a0833589b66b30138f8e9cd2dc3935a2cb1923ee113a5cf61a00a9a4

  • SSDEEP

    98304:eIvpCbb8PjYDNaDuKsEcAqb9LdiodFaSu7xVIxcFZrX8QUHGINjQ5fgfAky:NhCHijIaCKsEZ0f7avuqjMHtQDf

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 65d9ba96fdad94d5e987c0775ec51133
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/MFC71.dll
    .dll windows:4 windows x86 arch:x86

    a2daecae000dbd619d54759f02a99a73


    Headers

    Imports

    Sections

  • $SYSDIR/MFC71u.dll
    .dll windows:4 windows x86 arch:x86

    b3fbf4599c17e9bc7ccae6518bf0f868


    Headers

    Imports

    Sections

  • $SYSDIR/atl71.dll
    .dll windows:4 windows x86 arch:x86

    7c3004ebf21f282412fa952c164aa2bb


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/WebThunder_SetupHelper.dll
    .dll windows:4 windows x86 arch:x86

    cb15c4ce4f27454ccf6f64d3e8a9ffaf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • BugReport.exe
    .exe windows:4 windows x86 arch:x86

    4740164c3e34bd4b4976d13c9a3a65a8


    Code Sign

    Headers

    Imports

    Sections

  • BugReport.ini
  • CacheServer.dll
    .dll windows:4 windows x86 arch:x86

    fad2350edfe7fa7fb5f912300ced00ad


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • CrackFW.exe
    .exe windows:5 windows x86 arch:x86

    09f61428eded5dc41ba22093f0258844


    Code Sign

    Headers

    Imports

    Sections

  • FileIcon.dll
    .dll windows:4 windows x86 arch:x86

    b15f50e3f2711e0feb9b6d0b6f0258b5


    Code Sign

    Headers

    Imports

    Sections

  • FileSortType.dat
  • GetAllUrl.htm
    .html .vbs polyglot
  • GetUrl.htm
    .html .js polyglot
  • Packer.dll
    .dll windows:4 windows x86 arch:x86

    66a925fd48fd95340dda6602e57cc059


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Profiles/Language.ini
  • RealNameCfg.ini
  • RegisterDll.dll
    .dll windows:4 windows x86 arch:x86

    206297af3ee4c4b103d86bc06c874a10


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TaskManager.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f18b9145db7c88d3641271dbf8daf24d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderLiveUD.exe
    .exe windows:4 windows x86 arch:x86

    2c111f895d87ea8cce066919761ae1f6


    Code Sign

    Headers

    Imports

    Sections

  • ThunderLoader/IThunderDownload.xpt
  • ThunderLoader/NsThunderLoader.dll
    .dll windows:4 windows x86 arch:x86

    5e179d164188f94230b8f3641c5ebf2d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderLoader/NsThunderLoaderInstaller.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    010d328133240c24863d78e97a8b2589


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderLoader/regxpcom.exe
    .exe windows:4 windows x86 arch:x86

    8a5fa7e9e22145cbaf8580dbd2f15762


    Code Sign

    Headers

    Imports

    Sections

  • Thunder_cfg.ini
  • UpdateCtrl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a2087ffac6c5135e9de45f32b0b19e66


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WebThunder.exe
    .exe windows:4 windows x86 arch:x86

    cac5c5d316054d9963687fe4bd7039fd


    Code Sign

    Headers

    Imports

    Sections

  • WebThunderBHO.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    624f434af99c2955ff15223a61f00d94


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WebThunderInstaller.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2de99431891621dc6b216f079829916d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WebThunder_SetupHelper.dll
    .dll windows:4 windows x86 arch:x86

    cb15c4ce4f27454ccf6f64d3e8a9ffaf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLCrypto.dll
    .dll windows:4 windows x86 arch:x86

    4a01333d1673a520341f5d0fb358b573


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLNet.dll
    .dll windows:4 windows x86 arch:x86

    430f2e770b41fba0e1b6279623076d5e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLSafe/RMFScan.dll
    .dll windows:4 windows x86 arch:x86

    3e0ce9a9e7a68903b3278ad495a907ea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLSafe/SafeInfo.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1d2aa51bc4cc9cf9d9a66873e6ceeb60


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLSafe/WebThunderSafe.dll
    .dll windows:4 windows x86 arch:x86

    9c1c66d7bed644c755879e147f6ebfc0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLStatistic/XLStatisticAddin.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ca08127b136ae977b81558ef12ea2413


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XLStatistic/sconfig.ini
  • XLWebDownload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d0834c7882fd078ece70c64f48789fac


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • al.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    19371fb4ba91a468572b79428ba8b576


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • asyn_frame.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1b54c5944e6e9e117d99eb621c91ea53


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • backend_agent.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    93db1ebf3868dca94a5786b5b090ce32


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bd.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    eda069047124d69c039c95c6312c5387


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bootstrap.dat
  • bt_kernel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f6669c53c07f511afa3cc1de110a6437


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bt_shell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    aa3023f8301491adb9700e8e22210263


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • dhtnodes.dat
  • dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    91a6f2c3d727ac8f7fefbb4c7bb5d43a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • down_dispatcher.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2a2861fb752f9ffb26b67c41a937e6cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download-complete.wav
  • download_interface.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2c178c5da022f854b9c53ca4e36c879f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • emule_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6f2f334f3fd7a504834f9cb96ceac394


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • emule_kernel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    57d765cc468ee838c747eddd37e5b289


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • emule_shell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    bf6dff9897cbb0aeb825e2ba63ed4e31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fs.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    843de2b2c79dd388803592a4baae9c4b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ipfilter.dat
  • mp.dll
    .dll windows:4 windows x86 arch:x86

    5eb73d86204ca34865ffbbadc69bd66a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcirt.dll
    .dll windows:5 windows x86 arch:x86

    c9e4d1c3c611270cb8fe488259e71c2a


    Headers

    Imports

    Exports

    Sections

  • nodes.dat
  • p2p.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6fb5caac2b6797e3ca750a53163f51a6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • p2p_local_res.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5ad959a3f9f432f3ca7e595b7fd37e7a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • p2p_upload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0adec18f973fc4483185284868ce77d1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • p2sp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    be16034405717fd5394340df2d5acb5e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • p2sp_pd.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    48ae31546b76c23d1f822a34410174a1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • page.wtp
  • patchversion.dat
  • ptl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    e74049cbc787835e3164280d0583de13


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • server.bak
  • server.met
  • sl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a6075091b3108be1aae13203ddf0d66d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis
  • unrar.dll
    .dll windows:4 windows x86 arch:x86

    b4d076238051fcc22607f17c728e83bc


    Headers

    Imports

    Exports

    Sections

  • upnp.exe
    .exe windows:4 windows x86 arch:x86

    75cfe3ad857c17f0b51c6076988bab31


    Code Sign

    Headers

    Imports

    Sections

  • vd.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8800a59f30cc00e1f2f3cf89eeed5419


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_stat.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    057ed0c4dd4aa1069c4556bac109a6d1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xldc.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0152f2d914f37a61251b34e74bb4b022


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xldcsubtask.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    93e47a2dc5bfbdc5b3df94caeacf7038


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xlpfmc.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    70391e8c9be5e82e706bfc543f8302c0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zlib1.dll
    .dll windows:4 windows x86 arch:x86

    7e3560e4dd2deaa398fa039458dd4b4b


    Headers

    Imports

    Exports

    Sections