General

  • Target

    d79ddad8eab98406617375520d434091

  • Size

    3.3MB

  • MD5

    d79ddad8eab98406617375520d434091

  • SHA1

    148d61529ca6deb7e5feaec8b79e0c235b0189c9

  • SHA256

    6527981a69366bb51b35d5bbd81bbd4646d80c6fc436d4933484a9bd1ca7ba3d

  • SHA512

    f92d373164dfa1a67834577a2ece0be5b987fcb935126600dd9e640bb0dd8989e91df910eabad3c97d933e75090cbd26899873106dbadba1aee6c8799407af40

  • SSDEEP

    49152:R/+4alTccYEpHdpsjG48qkYObfFfQ+sPeR+KAd9DIop+8MUTeffpshCqaWxG3Lt:BzGTtj0h8Q+sWcl9DIZdhshCq16t

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • d79ddad8eab98406617375520d434091
    .rar
  • download1.9.231.201.exe
    .exe windows:4 windows x86 arch:x86

    34070d2f388106597eee704668840d03


    Code Sign

    Headers

    Imports

    Sections

  • $OUTDIR/Browser/Firefox/IQQDownloadFFH.xpt
  • $OUTDIR/Browser/Firefox/QQDownloadFFH.dll
    .dll windows:4 windows x86 arch:x86

    c4a0e5c5c0184df369ca351cf3bd2f47


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/Browser/Firefox/qqdownload.xpi
    .zip
  • chrome/qqdownload.jar
    .zip
  • content/contents.rdf
    .xml
  • content/icon.bmp
  • content/qqdownloadclick.js
    .js
  • content/qqdownloadclick.xul
    .xml
  • content/qqdownloadcommon.js
    .js
  • content/qqdownloadmenu.js
    .js
  • content/qqdownloadmenu.xul
  • install.rdf
    .xml
  • $OUTDIR/Browser/Maxthon/MaxthonHelper01.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3412f6574b4bb673ade6f41be7f52f94


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/Browser/Maxthon/plugin.ini
  • $OUTDIR/MaxthonHelper02.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3412f6574b4bb673ade6f41be7f52f94


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/QQDeskUpdateNew.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $OUTDIR/QQDownload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0065bf5f476c53df1480dbb24db530b8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/QQIEHelper02.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5a00f4880d48aa0ca9289007400bd816


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/TNProxy.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5b6be223aae9558de13dd3a8d5d553f3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/bt/Microsoft.VC80.ATL.manifest
    .xml
  • $OUTDIR/bt/Microsoft.VC80.CRT.manifest
    .xml
  • $OUTDIR/bt/Microsoft.VC80.MFC.manifest
    .xml
  • $OUTDIR/bt/atl80.dll
    .dll windows:4 windows x86 arch:x86

    00c6e566e88c3d07ddc376fe4ce83c5f


    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/bt/msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    9fb682fe34f5d965faf4cf424fa6c000


    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/bt/msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    8eb98c77a1ada89df5027bd5bf01c2f6


    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/emule/Microsoft.VC80.ATL.manifest
    .xml
  • $OUTDIR/emule/Microsoft.VC80.CRT.manifest
    .xml
  • $OUTDIR/emule/Microsoft.VC80.MFC.manifest
    .xml
  • $OUTDIR/emule/atl80.dll
    .dll windows:4 windows x86 arch:x86

    00c6e566e88c3d07ddc376fe4ce83c5f


    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/emule/msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    9fb682fe34f5d965faf4cf424fa6c000


    Headers

    Imports

    Exports

    Sections

  • $OUTDIR/emule/msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    8eb98c77a1ada89df5027bd5bf01c2f6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    3764e6c387ce3c76b39936a24d523dce


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/QQDownHelper.dll
    .dll windows:4 windows x86 arch:x86

    77b6a634c46cc37e70afafa29b00612f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    445ca064c668ebcb89957d525a8bef23


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/VistaHelper.dll
    .dll windows:4 windows x86 arch:x86

    291d9542573bba4f2c66d59ec2297cae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/iotemp.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $_13_/Setting/UserConfig.ini
  • $_13_/Setting/btres.ini
  • $_13_/Setting/host.dat
  • $_13_/Setting/kvcfg.ini
  • $_13_/eMuleConfig/CatInit.ini
  • $_13_/eMuleConfig/nodes.dat
  • $_13_/eMuleConfig/preferences.ini
  • $_13_/eMuleConfig/server.met
  • $_22_/plugin/QQDownload/plugin.ini
  • $_28_/IQQDownloadFFH.xpt
  • $_28_/QQDownloadFFH.dll
    .dll windows:4 windows x86 arch:x86

    c4a0e5c5c0184df369ca351cf3bd2f47


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_28_/qqdownload.xpi
    .zip
  • chrome/qqdownload.jar
    .zip
  • content/contents.rdf
    .xml
  • content/icon.bmp
  • content/qqdownloadclick.js
    .js
  • content/qqdownloadclick.xul
    .xml
  • content/qqdownloadcommon.js
    .js
  • content/qqdownloadmenu.js
    .js
  • content/qqdownloadmenu.xul
  • install.rdf
    .xml
  • 1.bmp
  • 10.bmp
  • 100.bmp
  • 101.bmp
  • 102.bmp
  • 103.bmp
  • 104.bmp
  • 105.bmp
  • 106.bmp
  • 107.bmp
  • 108.bmp
  • 109.bmp
  • 11.bmp
  • 110.bmp
  • 111.bmp
  • 112.bmp
  • 113.bmp
  • 114.bmp
  • 115.bmp
  • 116.bmp
  • 117.bmp
  • 12.bmp
  • 13.bmp
  • 14.bmp
  • 15.bmp
  • 16.bmp
  • 17.bmp
  • 18.bmp
  • 19.bmp
  • 2.bmp
  • 20.bmp
  • 21.bmp
  • 22.bmp
  • 23.bmp
  • 24.bmp
  • 25.bmp
  • 26.bmp
  • 27.bmp
  • 28.bmp
  • 29.bmp
  • 3.bmp
  • 30.bmp
  • 31.bmp
  • 32.bmp
  • 33.bmp
  • 34.bmp
  • 35.bmp
  • 36.bmp
  • 37.bmp
  • 38.bmp
  • 39.bmp
  • 4.bmp
  • 40.bmp
  • 41.bmp
  • 42.bmp
  • 43.bmp
  • 44.bmp
  • 45.bmp
  • 46.bmp
  • 47.bmp
  • 48.bmp
  • 49.bmp
  • 5.bmp
  • 50.bmp
  • 51.bmp
  • 52.bmp
  • 53.bmp
  • 54.bmp
  • 55.bmp
  • 56.bmp
  • 57.bmp
  • 58.bmp
  • 59.bmp
  • 6.bmp
  • 60.bmp
  • 61.bmp
  • 62.bmp
  • 63.bmp
  • 64.bmp
  • 65.bmp
  • 66.bmp
  • 67.bmp
  • 68.bmp
  • 69.bmp
  • 7.bmp
  • 70.bmp
  • 71.bmp
  • 72.bmp
  • 73.bmp
  • 74.bmp
  • 75.bmp
  • 76.bmp
  • 77.bmp
  • 78.bmp
  • 79.bmp
  • 8.bmp
  • 80.bmp
  • 81.bmp
  • 82.bmp
  • 83.bmp
  • 84.bmp
  • 85.bmp
  • 86.bmp
  • 87.bmp
  • 88.bmp
  • 89.bmp
  • 9.bmp
  • 90.bmp
  • 91.bmp
  • 92.bmp
  • 93.bmp
  • 94.bmp
  • 95.bmp
  • 96.bmp
  • 97.bmp
  • 98.bmp
  • 99.bmp
  • AnalyseSite.ini
  • BTDownload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b7b8ee7de0c0d7ace4bc855ad40111b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MaxthonHelper01.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3412f6574b4bb673ade6f41be7f52f94


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MediaFilter.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9a5951ee6fe58ef4dd7b505abbca6574


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC80.ATL.manifest
    .xml
  • Microsoft.VC80.CRT.manifest
    .xml
  • Microsoft.VC80.MFC.manifest
    .xml
  • QDAutoUpdate.exe
    .exe windows:4 windows x86 arch:x86

    8a1ed34680175652d29ee15b26ad307a


    Headers

    Imports

    Sections

  • QQDownload.exe
    .exe windows:4 windows x86 arch:x86

    066c99cec3a5d3216b68f41bff831d35


    Code Sign

    Headers

    Imports

    Sections

  • QQIEHelper01.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5a00f4880d48aa0ca9289007400bd816


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ResError.html
    .html
  • Thumbs.db
  • XPBUTTON_FOCUSED.bmp
  • XPBUTTON_FOCUSED1.bmp
  • XPBUTTON_HOT.bmp
  • XPBUTTON_HOT1.bmp
  • XPBUTTON_NORMAL.bmp
  • XPBUTTON_NORMAL1.bmp
  • XPBUTTON_PRESSED.bmp
  • XPBUTTON_PRESSED1.bmp
  • atl80.dll
    .dll windows:4 windows x86 arch:x86

    00c6e566e88c3d07ddc376fe4ce83c5f


    Headers

    Imports

    Exports

    Sections

  • downinfo_button_down.bmp
  • downinfo_button_hover.bmp
  • downinfo_button_normal.bmp
  • downinfo_status.bmp
  • eMuleDownload.dll
    .dll windows:4 windows x86 arch:x86

    ce4b5b895522ee00a04ad0bc08b74b40


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • es_ES_T.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • fresh.bmp
  • getAllurl.htm
    .html .vbs polyglot
  • geturl.htm
    .html .js polyglot
  • license.txt
  • list.gif
    .gif
  • msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    9fb682fe34f5d965faf4cf424fa6c000


    Headers

    Imports

    Exports

    Sections

  • msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    8eb98c77a1ada89df5027bd5bf01c2f6


    Headers

    Imports

    Exports

    Sections

  • resouce_mgr_tree_imagelist.bmp
  • tasklist_head_bg.bmp
  • tasklist_task_status.bmp
  • tb_button_down.bmp
  • tb_button_hover.bmp
  • tb_disable.bmp
  • tb_hot.bmp
  • tb_normal.bmp
  • toolbar_back.bmp
  • toolbar_down.bmp
  • uninst.exe.nsis
  • version.dat
  • whatsnew.txt
  • xcore.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5b6be223aae9558de13dd3a8d5d553f3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xmain.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0065bf5f476c53df1480dbb24db530b8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zh_CN.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • 新云软件.url
    .url