General

  • Target

    WeChatSetup_x86.exe

  • Size

    167.2MB

  • MD5

    7f03e054b7b5a16e7ce0b76b271e052b

  • SHA1

    c1c8bd6b1f75c76531d5feaaa52af4ebbb870256

  • SHA256

    53f49d3eebb00b177f4934678220c79a26febe3aea88dd8ba02ca40c6ff8e7dc

  • SHA512

    d413e7430e60c582b5fc6247b72ae3b259100a8968313e429b098be2e17f76c5a426bd174f96beee09cd846239fff51388a9d06eb172697ff34002273ec62894

  • SSDEEP

    3145728:qCgjuYqEY5i5fgHvpOYvpY/vHetJGsxlO1kjI8oJtls:RgK125IOupK9118ozls

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • WeChatSetup_x86.exe
    .exe windows:4 windows x86 arch:x86

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    5ebb000a52998bb996312557ab4e30f5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll windows:6 windows x86 arch:x86

    0cb359fcb818665c19a48f4087753f55


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsInstallAssist.dll
    .dll windows:4 windows x86 arch:x86

    98bd347be99c6ea9d34c4596ddd7ed77


    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    5ebb000a52998bb996312557ab4e30f5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll windows:6 windows x86 arch:x86

    5995151564a62f9c309819723f006513


    Headers

    Imports

    Exports

    Sections

  • WeChat.exe
    .exe windows:6 windows x86 arch:x86

    ae5f146ec42057cadf8014d89ea67430


    Code Sign

    Headers

    Imports

    Sections

  • WechatAppLauncher.exe
    .exe windows:5 windows x86 arch:x86

    373e31b0791057247a341163861d6fe2


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.9.34]/ConfSdk.dll
    .dll windows:6 windows x86 arch:x86

    c84de5c44f66e87934c6b0a74b29b97a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/RadiumWMPF.bin
    .zip
  • file_component.xml
  • host/wmpf_host_export.dll
    .dll windows:5 windows x86 arch:x86

    fde08cf2d88900f638d9456b355f27f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • host/wmpf_host_export_x64.dll
    .dll windows:5 windows x64 arch:x64

    5d4083348d3a763e61eeebefcc984346


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/ComponentVerification.dll
    .dll windows:6 windows x86 arch:x86

    a7f7f953f3e35055da39fb5a974f5004


    Code Sign

    Headers

    Imports

    Sections

  • runtime/ConfSdk.dll
    .dll windows:6 windows x86 arch:x86

    7caef47fa0b78be545f2e55388821184


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/LiteAvAudioHook.dll
    .dll windows:6 windows x86 arch:x86

    d621747e3320e177fa3578860e38e292


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/VoipEngine.dll
    .dll windows:6 windows x86 arch:x86

    99e9fe412915dc2379006d727c0254d3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/WXAMSDK.dll
    .dll windows:6 windows x86 arch:x86

    64aa624a199e371953ea512913c7a1d8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/WeChatAppEx.exe
    .exe windows:5 windows x86 arch:x86

    459f63289a723c7a3117c0955070d26b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/d3dcompiler_47.dll
    .dll windows:10 windows x86 arch:x86

    7f269ea2d96d8d376f2c7642ddadc7bc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/dbghelp.dll
    .dll windows:6 windows x86 arch:x86

    3f5a00ef2a36f3cd8924690a5a1d6f3c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/ffmpeg.dll
    .dll windows:5 windows x86 arch:x86

    c7497313062f9c96c83518b36f70731f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/icudtl.dat
  • runtime/ilink2.dll
    .dll windows:6 windows x86 arch:x86

    08b7e6f139b1465276b3fc035142f05a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/ilink_network.dll
    .dll windows:5 windows x86 arch:x86

    c972f54dc4c9031b02ff6e7f2afb6843


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/libEGL.dll
    .dll windows:5 windows x86 arch:x86

    14cd5ffd5d2a5e20eb8ffa21377b813a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/libGLESv2.dll
    .dll windows:5 windows x86 arch:x86

    b30b9c8cc35fba1b1d1b357c770d7174


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/liteav.dll
    .dll windows:5 windows x86 arch:x86

    f22696a6a09b54bb51d7ce406b1f5bbf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/locales/en-US.pak
  • runtime/locales/zh-CN.pak
  • runtime/owl.dll
    .dll windows:6 windows x86 arch:x86

    89e7596dca73e7182294f284cd491875


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/snapshot_blob.bin
  • runtime/txffmpeg.dll
    .dll windows:5 windows x86 arch:x86

    24da18df13cc4e06b423709a65e4a43e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/txsoundtouch.dll
    .dll windows:5 windows x86 arch:x86

    1364bf47bfd9b6872aa631b3faa827ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/v8_context_snapshot.bin
  • runtime/vk_swiftshader.dll
    .dll windows:5 windows x86 arch:x86

    61c1fc84bd6a0a986db616adecc29dd3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/vk_swiftshader_icd.json
  • runtime/vulkan-1.dll
    .dll windows:5 windows x86 arch:x86

    0c3e803dd8e326c1278d7872e609b579


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/wmpf_100_percent.pak
  • runtime/wmpf_200_percent.pak
  • runtime/wmpf_resources.pak
  • runtime/xweb_elf.dll
    .dll windows:5 windows x86 arch:x86

    a94a126f82ed5a9df1b2a0f0be4184ec


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x86.config
  • [3.9.9.34]/SDL License.txt
  • [3.9.9.34]/SPEEX LICENSE.txt
  • [3.9.9.34]/SQLCipher LICENSE.txt
  • [3.9.9.34]/Skia LICENSE.txt
  • [3.9.9.34]/ThumbPlayer.bin
    .zip
  • D3DX9_43.dll
    .dll windows:6 windows x86 arch:x86

    5fb75b2a87c1fa7cc3d7904a0b97084a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TPCommon.dll
    .dll windows:5 windows x86 arch:x86

    a41894ad12be223f2e0d5071bfe4e57f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TPCore.dll
    .dll windows:5 windows x86 arch:x86

    a5db08a39676717a4fb6427f2ff06708


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TPDX11Renderer.dll
    .dll windows:6 windows x86 arch:x86

    922bd4c9d271b6dd2d4a369c89112689


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TPMultiProcess.dll
    .dll windows:5 windows x86 arch:x86

    2e8a22e53919770ae72a621c2d4fe81c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TPThumbPlayer.dll
    .dll windows:5 windows x86 arch:x86

    c5e62cf8e3caf905fd5a14fbfd1105d2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TVKDownloadProxy.dll
    .dll windows:5 windows x86 arch:x86

    0ba893b52c8c05f3eebbd48996289f6b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TxBugReport.exe
    .exe windows:6 windows x86 arch:x86

    4055118ddc08f2f5bc622c918de11eb6


    Code Sign

    Headers

    Imports

    Sections

  • WeChatPlayer.exe
    .exe windows:6 windows x86 arch:x86

    23ead81e4797a925707e1c3f866746e5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avcodec-58.dll
    .dll windows:6 windows x86 arch:x86

    3b3df8cdd2154fa769583ec1cfb42645


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avdevice-58.dll
    .dll windows:6 windows x86 arch:x86

    f7b80e9ee3a00bdc98e16ef8db0dff63


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avfilter-7.dll
    .dll windows:6 windows x86 arch:x86

    5b22c5f7105c3fb7716f7aace48d5902


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avformat-58.dll
    .dll windows:6 windows x86 arch:x86

    6a5ea670223561c1fe530b3f3efff9dc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • avutil-56.dll
    .dll windows:6 windows x86 arch:x86

    1b3b48b33ba7f79f168768a332232fa2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • d3dx11_43.dll
    .dll windows:6 windows x86 arch:x86

    a21b4a7ea49a55d76ec8ead5ff32f73d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • file_component.xml
  • pthread.dll
    .dll windows:5 windows x86 arch:x86

    cbd0272b55ac78655f070c402ca5804e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • swresample-3.dll
    .dll windows:6 windows x86 arch:x86

    f5464df7fa0a15cdcd0da9227849aea2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • swscale-5.dll
    .dll windows:6 windows x86 arch:x86

    d2a7743fb9920e0a17f8c48e05f5affd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • tinyxml.dll
    .dll windows:6 windows x86 arch:x86

    e3ebd824cd49f92f03ba3fdcf41b9df4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x86.config
  • [3.9.9.34]/Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    5ebb000a52998bb996312557ab4e30f5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll windows:6 windows x86 arch:x86

    5995151564a62f9c309819723f006513


    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/VoipEngine.dll
    .dll windows:6 windows x86 arch:x86

    1fbf03caec175c275b675a1a06d268ff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/WeChat.exe
    .exe windows:6 windows x86 arch:x86

    ae5f146ec42057cadf8014d89ea67430


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.9.34]/WeChatExt.exe
    .exe windows:5 windows x86 arch:x86

    17de35bd7cf43148433d7f0082ed6b61


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.9.34]/WeChatResource.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • [3.9.9.34]/WeChatSpt.exe
    .exe windows:5 windows x86 arch:x86

    1a08a855b673c49f0929c8ef45dc36d3


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.9.34]/WeChatUpdate.bin
    .zip
  • WeChatUpdate.exe
    .exe windows:6 windows x86 arch:x86

    fcb7832b325a76914e1d1ba6d1c28afc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • dbghelp.dll
    .dll windows:6 windows x86 arch:x86

    3f5a00ef2a36f3cd8924690a5a1d6f3c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • file_component.xml
  • x86.config
  • [3.9.9.34]/WeChatUpdate.exe
    .exe windows:6 windows x86 arch:x86

    fcb7832b325a76914e1d1ba6d1c28afc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/WeChatUtility.bin
    .zip
  • DeepSR_REPSR_R_M4C16_Flip_ep24.xnet
  • OCRDetFP32.xnet.nas
  • OCRRecogFP32V1.1.0.26.xnet
  • QBarDetV1.1.0.26.xnet
  • QBarSegV1.1.0.26.xnet
  • TxBugReport.exe
    .exe windows:6 windows x86 arch:x86

    4055118ddc08f2f5bc622c918de11eb6


    Code Sign

    Headers

    Imports

    Sections

  • WeChatUtility.exe
    .exe windows:6 windows x86 arch:x86

    6c706f73c088ee5eb89de4f07112554c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • file_component.xml
  • sohu_simp.txt
  • tinyxml.dll
    .dll windows:6 windows x86 arch:x86

    e3ebd824cd49f92f03ba3fdcf41b9df4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x86.config
  • [3.9.9.34]/WeChatWin.dll
    .dll windows:6 windows x86 arch:x86

    5e916668bfdb00eaca1c13f30df595a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/WeUIResource.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • [3.9.9.34]/WechatAppLauncher.exe
    .exe windows:5 windows x86 arch:x86

    373e31b0791057247a341163861d6fe2


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.9.34]/WechatCodec.exe
    .exe windows:6 windows x86 arch:x86

    6eed87a66e0baad4dd4d279765a687b5


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.9.34]/WetypeInstaller.exe
    .exe windows:6 windows x64 arch:x64

    7a00c2529869d8bc5993444f150e9989


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/andromeda.dll
    .dll windows:6 windows x86 arch:x86

    ee5aefd82af604088173c9a2460201ef


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/cldnn_ns_16k.bin
  • [3.9.9.34]/dbghelp.dll
    .dll windows:6 windows x86 arch:x86

    3f5a00ef2a36f3cd8924690a5a1d6f3c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/directui license.txt
  • [3.9.9.34]/duilib license.txt
  • [3.9.9.34]/ilink2.dll
    .dll windows:6 windows x86 arch:x86

    8a27175a4565b8e35ad40c8525f47743


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/libEGL.dll
    .dll windows:5 windows x86 arch:x86

    671e9b94c17af069171fc66ac98b577e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/libFFmpeg.dll
    .dll windows:6 windows x86 arch:x86

    3102f16fe4bb0f846c6ba0c7e912a346


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/libGLESv2.dll
    .dll windows:5 windows x86 arch:x86

    f57b063473f1876c9b4683fa8f92be4b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/mmcrashpad_client32.dll
    .dll windows:5 windows x86 arch:x86

    f2a000e3abeb631f0285d4a6cf8ad197


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/mmcrashpad_handler32.exe
    .exe windows:5 windows x86 arch:x86

    4c8db46f2a2a839a2d738605487c6400


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/mmmojo.dll
    .dll windows:5 windows x86 arch:x86

    2382b373f5946e01b6074f6002346d72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/mmmojo_64.dll
    .dll windows:5 windows x64 arch:x64

    01ae9b0bd2188b2447de6df79374af05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/mmtcmalloc.dll
    .dll windows:6 windows x86 arch:x86

    f12f3af986510a7af6c66c94f6a4bc68


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/owl.dll
    .dll windows:6 windows x86 arch:x86

    5fa613ca45d0c5342ffe217796b7834c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/pagengine.dll
    .dll windows:6 windows x86 arch:x86

    895c66f548fd8bfcb4530706bd735dfe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.9.34]/plugin_info.ini
  • [3.9.9.34]/protobuf-lite LICENSE.txt
  • [3.9.9.34]/rqt.dat
    .png
  • [3.9.9.34]/sae.dat
  • [3.9.9.34]/sperqt.dat
    .png
  • [3.9.9.34]/wcprobe.dll
    .dll windows:6 windows x86 arch:x86

    40794298473e602b79193d0061e0daa2


    Code Sign

    Headers

    Imports

    Sections