General

  • Target

    cafc1243ebcf0f59efc99dab412f7a9b

  • Size

    6.1MB

  • MD5

    cafc1243ebcf0f59efc99dab412f7a9b

  • SHA1

    3b97a56e38a82880d8c0b9ced29fe7d323bc20b5

  • SHA256

    52bc4420c0dafa652f376bc99865c1b93792538c4e1892cba4865f28105d0185

  • SHA512

    c660a501a7ad10adcea192e9b02ebf8e308eb74525af8178049d845e61547a84fde694b895bfca793b8550b798325c1028eac23550b4319c33e39ce46ed765a0

  • SSDEEP

    98304:x6aBGlKF6dRoE0w4ln4YClNJAkpoNKW/APO31GMuImStcdm4ZB9ax+zMavjWg5sO:6lKod1Il4FJPiNKW/MOgFRSifZVPj7B

Score
3/10

Malware Config

Signatures

  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • cafc1243ebcf0f59efc99dab412f7a9b
    .rar
  • VASetup_1.0.0.12.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $0/va.cfg
    .js
  • $0/va.lua
    .js
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    295fc8c35dee88b924b0f6bafc807c6c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/jscript.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    f5c2ec3f2d0669defbf38fcfa1d3e83f


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msscript.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    3793b90a92464f525c430a6b5fdf224f


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/VASetupHelper.dll
    .dll windows:4 windows x86 arch:x86

    74d85950366534c61bcf9e072a064709


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • AdminShell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9f5ade8c56b27fa3971d1d736a7ffff9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EventX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cb788b53e23df0827675a7f5030e1849


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Skin.db
    .js
  • TaskSechduler.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9b8d1a675ff35d0c52faf505052d87fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/DownloadServerNeedFileList.dat
  • ThunderService/LiveUpdateLanguage/Language.ini
  • ThunderService/LiveUpdateLanguage/zh_CN/LiveUpdate.xml
  • ThunderService/LiveUpdateLanguage/zh_CN/UpdateCtrl.xml
  • ThunderService/ThunderFW.exe
    .exe windows:5 windows x86 arch:x86

    7717b5d034e4ed74403172187d115c63


    Code Sign

    Headers

    Imports

    Sections

  • ThunderService/ThunderLiveUD.exe
    .exe windows:4 windows x86 arch:x86

    6d21328934c8bef8fb603479ab60530f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/ThunderService.exe
    .exe windows:4 windows x86 arch:x86

    3ee8942114492dbefe20a1f307fd839e


    Code Sign

    Headers

    Imports

    Sections

  • ThunderService/ThunderSmartLimiter.exe
    .exe windows:4 windows x86 arch:x86

    fb84d52c71a8fe5cc4e9dedc7b52078f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/UACTool.dll
    .dll windows:4 windows x86 arch:x86

    80602813e88379342331b281ba0235f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/UpdateCtrl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    734e52cb2f5cca203c6e3571436ba1e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/XLBugHandler.dll
    .dll windows:4 windows x86 arch:x86

    4ea7fb5164665f4db9d8b54362b77bdf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/XLBugReport.exe
    .exe windows:4 windows x86 arch:x86

    3f8bfe0657929f219c8c757b5dd2f70d


    Code Sign

    Headers

    Imports

    Sections

  • ThunderService/XLCrypto.dll
    .dll windows:4 windows x86 arch:x86

    4a01333d1673a520341f5d0fb358b573


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/al.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    244a0fee8abc4d0c932f74cd97a4f48c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/asyn_frame.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fb1b8715fe73abd1d928963180cc6d81


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • ThunderService/backend_agent.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    514567f5760f2c73dff6b2442b74579e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/bootstrap.dat
  • ThunderService/bt_kernel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1487d7a72a9da93154682c3ff144f560


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/bt_shell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    59fdb5551125f5784710d659e7567b1f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/bt_shell.ini
  • ThunderService/dhtnodes.dat
  • ThunderService/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d3758c594888fd981d5b78ad288a0a5d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/down_dispatcher.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8d9079c46419a07b54e6913861e9e78b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/download_engine.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d59c77b11b6d9368a04c6a0cb3db2296


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/download_interface.dll
    .dll windows:4 windows x86 arch:x86

    df0490b6b8ea5c9e9e04b3d3513c142d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/emule_kernel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d3146b036bb65d4a5d402818d68460ff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/emule_shell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ee864016bee04f49493fd632e0ccef9a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/emule_shell.ini
  • ThunderService/fs.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fb201c4ab2b0c00e1c24414963b238aa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/ipfilter.dat
  • ThunderService/libexpat.dll
    .dll windows:4 windows x86 arch:x86

    69d7ecc3f9a79e86856bf1b248c86c0d


    Headers

    Imports

    Exports

    Sections

  • ThunderService/liblua.dll
    .dll windows:4 windows x86 arch:x86

    7e5ef1408e6fc487f6fa1885aadb01b6


    Headers

    Imports

    Exports

    Sections

  • ThunderService/media_data.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    784ee7cb2f1455f3e53ee9b3837acbe2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/mini_unzip_dll.dll
    .dll windows:4 windows x86 arch:x86

    75dd547330e8f24ff6ed8a3e6e7a5efc


    Headers

    Imports

    Exports

    Sections

  • ThunderService/minizip.dll
    .dll windows:4 windows x86 arch:x86

    3f59f1f01bb799ed307333678d83c70c


    Headers

    Imports

    Exports

    Sections

  • ThunderService/module_downloader.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    013a0f717e58b32752e76af91e5437e9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/module_downloader.ini
  • ThunderService/mp.dll
    .dll windows:4 windows x86 arch:x86

    5eb73d86204ca34865ffbbadc69bd66a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • ThunderService/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • ThunderService/nodes.dat
  • ThunderService/p2p.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    05468af2166edae6d256070fcdcc3a61


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/p2p_local_res.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    22f27bda78ec119c26514c45e6e05271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/p2p_session_com.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    91c6bf69ea3344ac3065d050e4abe392


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/p2p_upload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    89ea4ba6bc6768a9ee6a8c2a2d6c7074


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/p2sp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b4798260ec6f0c157ca41a537137cc7d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/ptl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d6f782c4ec0a39b61971e0251a0c036e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/pub_store.dat
  • ThunderService/stream.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    82bac9dbcb8908de31c6b7b8a08bde6d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/task_report.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    433fcbbb88f384a72a51356fb6ad9a39


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/upnp.exe
    .exe windows:4 windows x86 arch:x86

    75cfe3ad857c17f0b51c6076988bab31


    Code Sign

    Headers

    Imports

    Sections

  • ThunderService/uuid
  • ThunderService/va.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    607c1230e16c3e83cb35e5578cbc3a4f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/xl_data.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2b66747b3d2de99adc0dc86f1ac13864


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/xlnet_manager.dll
    .dll windows:4 windows x86 arch:x86

    469536a4568b45f6eaaef18494ef15d9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ThunderService/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    b85767d676034e901584bb8678c6959e


    Headers

    Imports

    Exports

    Sections

  • ThunderVA.exe
    .exe windows:4 windows x86 arch:x86

    2c1a6cb45c56a25bb03935c9190798ea


    Code Sign

    Headers

    Imports

    Sections

  • VACtrl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b44a03c221e068fcc131e9d8efbe3a6f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VASetupHelper.dll
    .dll windows:4 windows x86 arch:x86

    74d85950366534c61bcf9e072a064709


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis
  • xl_client/UACTool.dll
    .dll windows:4 windows x86 arch:x86

    80602813e88379342331b281ba0235f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/asyn_frame.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fb1b8715fe73abd1d928963180cc6d81


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    108396d96cbabc39c8af3b88d71aba8e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/libexpat.dll
    .dll windows:4 windows x86 arch:x86

    69d7ecc3f9a79e86856bf1b248c86c0d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/mp.dll
    .dll windows:4 windows x86 arch:x86

    5eb73d86204ca34865ffbbadc69bd66a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/udt.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    af10a3975b9274872cbae434f59ea900


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/xl_client.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    492732f02633ae1f010d22863bc71113


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/xl_data.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2b66747b3d2de99adc0dc86f1ac13864


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_client/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Headers

    Imports

    Exports

    Sections

  • xl_skin/SkinManager.dll
    .dll windows:4 windows x86 arch:x86

    86043371d7edd0f701ca272e14bbdd12


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_skin/XLUIToolkit.dll
    .dll windows:4 windows x86 arch:x86

    3fdc8fafadc610bc5c286543f7c5bcb8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_skin/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    108396d96cbabc39c8af3b88d71aba8e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_skin/giflib4.dll
    .dll windows:4 windows x86 arch:x86

    cf288d14af28cc85eb94ff824b63e468


    Headers

    Imports

    Exports

    Sections

  • xl_skin/jscript.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    f5c2ec3f2d0669defbf38fcfa1d3e83f


    Headers

    Imports

    Exports

    Sections

  • xl_skin/libjpeg6b.dll
    .dll windows:4 windows x86 arch:x86

    80fa136c053ab59b63c469f847c6b3b3


    Headers

    Imports

    Exports

    Sections

  • xl_skin/libpng13.dll
    .dll windows:4 windows x86 arch:x86

    b5556ad19388998fa1108d4fa8ae9798


    Headers

    Imports

    Exports

    Sections

  • xl_skin/msscript.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    3793b90a92464f525c430a6b5fdf224f


    Headers

    Imports

    Exports

    Sections

  • xl_skin/xl_cximage.dll
    .dll windows:4 windows x86 arch:x86

    7ddc242921380c4c6874409db3b9afcc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xl_skin/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Headers

    Imports

    Exports

    Sections

  • 新云软件.url
    .url