General

  • Target

    687c947e45a7928fbafae7f196e4a47d

  • Size

    7.4MB

  • MD5

    687c947e45a7928fbafae7f196e4a47d

  • SHA1

    a8cebe1564775b9c8150f1a5082e0ec778f7b3a6

  • SHA256

    7ba0f00177eb7d56895a72b7b1b243cf7726b4ab78e397322dc555f3efbc83c0

  • SHA512

    8cf099cde8952efab1c231eedbf7676c631351e50d4de4bc04fb051a9a571d993432d805088b08f01d76f217ba281874d46aba42aecc9cb65d6a09d773e18bf7

  • SSDEEP

    196608:aM947W5v/tn4u/lCki7mZnNIpt4V3W8+rJnhGiQBobLDLJx5X:aiwQlCkias+V3WzJhCQfB

Score
3/10

Malware Config

Signatures

  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 687c947e45a7928fbafae7f196e4a47d
    .rar
  • koodian-v1.3.1.0209.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ZgRecover.dll
    .dll windows:4 windows x86 arch:x86

    51975ddd8aa9c16516580cd5547b5ce0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PROGRAMFILES/koodian/$PROGRAMFILES/koodian/uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ZgRecover.dll
    .dll windows:4 windows x86 arch:x86

    51975ddd8aa9c16516580cd5547b5ce0


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/arrow.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/busy.ani
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/cross.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/helpsel.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/link.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/move.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/nesw.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/ns.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/nwse.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/pen.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/text.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/unavail.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/up.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/we.cur
  • $PROGRAMFILES/koodian/Cursors/koodian_1.3/working.ani
  • $PROGRAMFILES/koodian/Icon/koodian_1.3/koodian_1.3.icl
    .dll windows:4 windows x86 arch:x86

    1d5a05cf7aed59c90f3f52d09111adf7


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/KDUins.dll
    .exe windows:4 windows x86 arch:x86

    07b5aa64ec75ae987212bd4b67001aee


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/KooUpdate.exe
    .exe windows:5 windows x86 arch:x86

    b0fb6459c1e8f83f40f2c341ab660825


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/Logon/logonui.exe
    .exe windows:5 windows x86 arch:x86

    26b589cfdb216ea1e72ef542e2eb607d


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/Skins/BTN/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/BTN/ɾֽ1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾֽ2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾֽ3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾֽ4.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾ1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾ2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾ3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ɾ4.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ӧ1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ӧ2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ӧ3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ӧ4.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ֽԶ1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ֽԶ2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ֽԶ3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ֽԶ4.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊǰ1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊǰ2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊǰ3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊǰ4.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊ¼1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊ¼2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊ¼3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/Ϊ¼4.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ӱֽ1.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ӱֽ2.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ӱֽ3.png
    .png
  • $PROGRAMFILES/koodian/Skins/BTN/ӱֽ4.png
    .png
  • $PROGRAMFILES/koodian/Skins/Banner.png
    .png
  • $PROGRAMFILES/koodian/Skins/NoPreview.png
    .png
  • $PROGRAMFILES/koodian/Skins/Shadow.bmp
  • $PROGRAMFILES/koodian/Skins/Tab/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/Tab/nor.png
    .png
  • $PROGRAMFILES/koodian/Skins/Tab/pres.png
    .png
  • $PROGRAMFILES/koodian/Skins/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/apply/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/apply/fucus.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/normal.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/pass.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/press.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/½ļ/fucus.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/½ļ/normal.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/½ļ/pass.png
    .png
  • $PROGRAMFILES/koodian/Skins/apply/½ļ/press.png
    .png
  • $PROGRAMFILES/koodian/Skins/browse/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/browse/fucus.png
    .png
  • $PROGRAMFILES/koodian/Skins/browse/normal.png
    .png
  • $PROGRAMFILES/koodian/Skins/browse/pass.png
    .png
  • $PROGRAMFILES/koodian/Skins/browse/press.png
    .png
  • $PROGRAMFILES/koodian/Skins/cancel/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/cancel/fucus.png
    .png
  • $PROGRAMFILES/koodian/Skins/cancel/normal.png
    .png
  • $PROGRAMFILES/koodian/Skins/cancel/pass.png
    .png
  • $PROGRAMFILES/koodian/Skins/cancel/press.png
    .png
  • $PROGRAMFILES/koodian/Skins/classic.jpg
    .jpg
  • $PROGRAMFILES/koodian/Skins/cle.gif
    .gif
  • $PROGRAMFILES/koodian/Skins/ok/Thumbs.db
  • $PROGRAMFILES/koodian/Skins/ok/fucus.png
    .png
  • $PROGRAMFILES/koodian/Skins/ok/normal.png
    .png
  • $PROGRAMFILES/koodian/Skins/ok/pass.png
    .png
  • $PROGRAMFILES/koodian/Skins/ok/press.png
    .png
  • $PROGRAMFILES/koodian/Skins/paper/1.png
    .png
  • $PROGRAMFILES/koodian/Skins/paper/2.png
    .png
  • $PROGRAMFILES/koodian/Skins/paper/3.png
    .png
  • $PROGRAMFILES/koodian/Skins/paper/Thumbs.db
  • $PROGRAMFILES/koodian/Theme/koodian_1.3.theme
  • $PROGRAMFILES/koodian/Theme/koodian_1.3/Preview.jpg
    .jpg
  • $PROGRAMFILES/koodian/Theme/koodian_1.3/Shell/NormalColor/Shellstyle.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PROGRAMFILES/koodian/Theme/koodian_1.3/koodian_1.3.msstyles
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PROGRAMFILES/koodian/Theme/Ƽ.url
  • $PROGRAMFILES/koodian/Tools/koodian.exe
    .exe windows:4 windows x86 arch:x86

    a0b97f3dd39d9968a265d02dcd4f5995


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/Wallpaper/koodian_1.3/ֽ1.jpg
    .jpg
  • $PROGRAMFILES/koodian/Wallpaper/koodian_1.3/ֽ2.jpg
    .jpg
  • $PROGRAMFILES/koodian/Wallpaper/koodian_1.3/ֽ3.jpg
    .jpg
  • $PROGRAMFILES/koodian/Wallpaper/koodian_1.3/ֽ4.jpg
    .jpg
  • $PROGRAMFILES/koodian/Wallpaper/koodian_1.3/ֽ5.jpg
    .jpg
  • $PROGRAMFILES/koodian/ZgFun.dll
    .dll windows:5 windows x86 arch:x86

    7929541837a3138aa457e4e30c4d70af


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/koodian/appupdate.cfg
  • $PROGRAMFILES/koodian/cFilepic.ini
  • $PROGRAMFILES/koodian/kDCount.exe
    .exe windows:5 windows x86 arch:x86

    5207e4a6f09f90b25221d08dd174adb2


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/key.ini
  • $PROGRAMFILES/koodian/koodian.exe
    .exe windows:5 windows x86 arch:x86

    193c44f40b49f25530b182ca4280efa3


    Headers

    Imports

    Sections

  • $PROGRAMFILES/koodian/msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/koodian/msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/koodian/news/Ali.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/BaiduSearch.gif
    .gif
  • $PROGRAMFILES/koodian/news/ChaDao.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/IconPackager.GIF
  • $PROGRAMFILES/koodian/news/MangGuoZai.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/Mid-Autumn-Festival.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/MizeRet.GIF
  • $PROGRAMFILES/koodian/news/RocketDock.GIF
  • $PROGRAMFILES/koodian/news/SideAdBg.JPG
    .jpg
  • $PROGRAMFILES/koodian/news/ToolTip.js
    .js
  • $PROGRAMFILES/koodian/news/YzShadow.GIF
  • $PROGRAMFILES/koodian/news/boot_Bg.gif
    .gif
  • $PROGRAMFILES/koodian/news/boot_Home.gif
    .gif
  • $PROGRAMFILES/koodian/news/boot_Show.gif
    .gif
  • $PROGRAMFILES/koodian/news/boot_Shui.gif
    .gif
  • $PROGRAMFILES/koodian/news/daomengkongjian.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/down.gif
    .gif
  • $PROGRAMFILES/koodian/news/kooBootAd.html
    .html .js polyglot
  • $PROGRAMFILES/koodian/news/kooSideAd.html
    .js
  • $PROGRAMFILES/koodian/news/kooSoft.html
  • $PROGRAMFILES/koodian/news/koodian-HeiZhiShi1-2.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/koodian-Mt.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/koodian-ddung.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/koozip.html
  • $PROGRAMFILES/koodian/news/more.gif
    .gif
  • $PROGRAMFILES/koodian/news/picBg.png
    .png
  • $PROGRAMFILES/koodian/news/rewupaidui.jpg
    .jpg
  • $PROGRAMFILES/koodian/news/sideAdLine.jpg
    .jpg
  • $PROGRAMFILES/koodian/newversion.cfg
  • $PROGRAMFILES/koodian/run.ini
  • $PROGRAMFILES/koodian/unicon.ini
    .exe windows:4 windows x86 arch:x86

    6814f8e10ac3c8ac9b677abc7d3d4220


    Headers

    Imports

    Sections

  • 新云软件.url
    .url