General

  • Target

    74025ddfc4d186d32bf7110cc57c3f3c

  • Size

    1.6MB

  • MD5

    74025ddfc4d186d32bf7110cc57c3f3c

  • SHA1

    bf18f0187ede66413e963823f65197518e3fe896

  • SHA256

    12e951dccb37b1bd744327116aee763279fd74d866dd6ef0bac1ad91d429697d

  • SHA512

    ffac94aecd6c462cd624069fcb5c9da6243adff4fe76f6a81f2e9c93f54bfa4f7027f2db6f3800c766d67ef1e36a19c27ba59f0c61621032d2cfc8b2437b8f7c

  • SSDEEP

    49152:MbyDT6lJLyCmow+0rAHaHxz8CvPriwQ0REV4auQ:nmlJbvw+taRz8Cv60EkQ

Score
3/10

Malware Config

Signatures

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 74025ddfc4d186d32bf7110cc57c3f3c
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/SelfDel.dll
    .dll windows:4 windows x86 arch:x86

    7b20d7ddf67d32ef46980776247198a1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    cd53277eaa7bbb8fb5b2b678274dcb4e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/coopen_setup_100063.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/PartnerDlg.ini
  • $PLUGINSDIR/install.bmp
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $_10_/$_10_/HttpDownloader.exe
    .exe windows:4 windows x86 arch:x86

    4095847f15924fd0fef7c9ebf1826f51


    Code Sign

    Headers

    Imports

    Sections

  • $_10_/Coopen.scr
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_10_/CoopenActiveControl110.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6aa21ccdbbbb0d1fd90240b162f05b98


    Headers

    Imports

    Exports

    Sections

  • $_10_/CoopenAir.exe
    .exe windows:4 windows x86 arch:x86

    7811f517d961bce7675eefabcb7f4606


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_10_/CoopenMainManager.dll
    .dll windows:4 windows x86 arch:x86

    c46dbef156038cf8343e2004d38045a0


    Headers

    Imports

    Exports

    Sections

  • $_10_/Resource/Plugins/CoopenLottery.png
    .png
  • $_10_/Resource/Plugins/CoopenNotepad.png
    .png
  • $_10_/Resource/Plugins/CoopenSearchTool.png
    .png
  • $_10_/Resource/Plugins/CoopenWeather.png
    .png
  • $_10_/Resource/Plugins/border.png
    .png
  • $_10_/Resource/Plugins/hover.png
    .png
  • $_10_/Resource/Plugins/running.png
    .png
  • $_10_/Resource/Plugins/tip.png
    .png
  • $_10_/Resource/SkinFormal/Background.png
    .png
  • $_10_/Resource/SkinFormal/Button_Channel.png
    .png
  • $_10_/Resource/SkinFormal/Button_Close.png
    .png
  • $_10_/Resource/SkinFormal/Button_Commit.png
    .png
  • $_10_/Resource/SkinFormal/Button_Next.png
    .png
  • $_10_/Resource/SkinFormal/Button_Pause.png
    .png
  • $_10_/Resource/SkinFormal/Button_Play.png
    .png
  • $_10_/Resource/SkinFormal/Button_Prev.png
    .png
  • $_10_/Resource/SkinFormal/Button_Widget.png
    .png
  • $_10_/Resource/SkinFormal/CheckC.png
    .png
  • $_10_/Resource/SkinFormal/CheckU.png
    .png
  • $_10_/Resource/SkinFormal/Indicator1.png
    .png
  • $_10_/Resource/SkinFormal/Indicator2.png
    .png
  • $_10_/Resource/SkinFormal/MainIcon.png
    .png
  • $_10_/Resource/SkinFormal/Message.png
    .png
  • $_10_/Resource/SkinFormal/Notify.png
    .png
  • $_10_/Resource/SkinFormal/Progress.png
    .png
  • $_10_/Resource/SkinFormal/Push_Cancel.png
    .png
  • $_10_/Resource/SkinFormal/Push_Config.png
    .png
  • $_10_/Resource/SkinFormal/Push_Confirm.png
    .png
  • $_10_/Resource/SkinFormal/Push_Folder.png
    .png
  • $_10_/Resource/SkinFormal/RadioC.png
    .png
  • $_10_/Resource/SkinFormal/RadioU.png
    .png
  • $_10_/Resource/SkinFormal/SkinClient.ini
  • $_10_/Resource/SkinFormal/SkinClose.ini
  • $_10_/Resource/SkinFormal/Synopsis1.ini
  • $_10_/Resource/SkinFormal/Synopsis1.png
    .png
  • $_10_/Resource/SkinFormal/Synopsis2.png
    .png
  • $_10_/Resource/SkinFormal/close.png
    .png
  • $_10_/Resource/SkinFormal/downarrow.png
    .png
  • $_10_/Resource/SkinFormal/hover.png
    .png
  • $_10_/Resource/SkinFormal/leftarrow.png
    .png
  • $_10_/Resource/SkinFormal/rightarrow.png
    .png
  • $_10_/Resource/SkinFormal/setting.png
    .png
  • $_10_/Resource/SkinFormal/uparrow.png
    .png
  • $_10_/Templete/CoopenPhoto.jpg
    .jpg
  • $_10_/Templete/DefaultCoopenWallpaper.jpg
    .jpg
  • $_10_/Templete/ModeB.tpl
  • $_10_/Templete/ModeB_logo.jpg
    .jpg
  • $_10_/Templete/ModeC.tpl
  • $_10_/conf/ChannelListReal.txt
  • $_10_/conf/PluginConfig.ini
  • $_10_/image/Wallpaper/coopen wallpaper/DefaultCoopenWallpaper.jpg
    .jpg
  • $_10_/image/Wallpaper/local wallpaper/DefaultCoopenWallpaper.jpg
    .jpg
  • $_10_/licence.txt
  • Coopen.exe
    .exe windows:4 windows x86 arch:x86

    37bdd694e262b9b644cfec8bf5405995


    Code Sign

    Headers

    Imports

    Sections

  • $_50_/$DESKTOP/Ա.ؼƵ.r38
    .js
  • $_50_/$DESKTOP/СϷ.r39
    .js
  • $_50_/1
    .js
  • $_50_/2
    .js
  • $_50_/3
    .js
  • $_50_/3.bat
  • $_50_/3.vbs
    .vbs
  • $_50_/360.vbs
    .vbs
  • $_50_/c.vbs
    .vbs
  • $_50_/game.ico
  • $_50_/kj.vbs
    .vbs
  • $_50_/qq
    .vbs
  • $_50_/qq.ico
  • $_50_/s
    .vbs
  • $_50_/taobao.ico
  • D:/RECYCLER/360.vbs
    .vbs
  • ֮.exe
    .exe windows:4 windows x86 arch:x86

    529e31f77e52cbf0a3f800a64416df7b


    Code Sign

    Headers

    Imports

    Sections

  • ֮.ini