General

  • Target

    df0daae26fb3f58a6b9ce4d144a81b48.bin

  • Size

    82.9MB

  • MD5

    df1e41b00f84ea0c36280c7ca52bfe7c

  • SHA1

    8b1eb2381e74cc8d90ba3c07c9e6e9088172e445

  • SHA256

    50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

  • SHA512

    9b9f293f8be900119d4cd90f0413d2a65389b7eca070fb70fedc86f870f9d4b973c4b6152a8faab73d960af66b9ec9e50513f0dafc4dc60fec13a323ac8b7f84

  • SSDEEP

    1572864:Gq3aB/2hD2lqWWrUYnqnLR2GUFNaJTVc+pwC3xTlspD4:53o/2h6lT/YnqnLR2bNywCFlQ4

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • df0daae26fb3f58a6b9ce4d144a81b48.bin
    .zip

    Password: infected

  • ee9c745ec13fb4389968431701fecabaa3fd85f607e694e0d8747703a60fe0dc.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WinShell.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    a75c904bad153f5af2c37cfdf66eba5c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/app-64.7z
    .7z
  • LICENSE.electron.txt
  • LICENSES.chromium.html
  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    Password: infected

    36f6d7806085bd3a70ed8c5dcb51f6c8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    Password: infected

    6ed82d3226365ffafff2c57c1935d352


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • libEGL.dll
    .dll windows:5 windows x64 arch:x64

    585861b958c9f1fe9cc0324e1020a230


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    62b94bd6c48f8e0f6d82aa2752720dbe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • locales/am.pak
  • locales/ar.pak
  • locales/bg.pak
  • locales/bn.pak
  • locales/ca.pak
  • locales/cs.pak
  • locales/da.pak
  • locales/de.pak
  • locales/el.pak
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/es-419.pak
  • locales/es.pak
  • locales/et.pak
  • locales/fa.pak
  • locales/fi.pak
  • locales/fil.pak
  • locales/fr.pak
  • locales/gu.pak
  • locales/he.pak
  • locales/hi.pak
  • locales/hr.pak
  • locales/hu.pak
  • locales/id.pak
  • locales/it.pak
  • locales/ja.pak
  • locales/kn.pak
  • locales/ko.pak
  • locales/lt.pak
  • locales/lv.pak
  • locales/ml.pak
  • locales/mr.pak
  • locales/ms.pak
  • locales/nb.pak
  • locales/nl.pak
  • locales/pl.pak
  • locales/pt-BR.pak
  • locales/pt-PT.pak
  • locales/ro.pak
  • locales/ru.pak
  • locales/sk.pak
  • locales/sl.pak
  • locales/sr.pak
  • locales/sv.pak
  • locales/sw.pak
  • locales/ta.pak
  • locales/te.pak
  • locales/th.pak
  • locales/tr.pak
  • locales/uk.pak
  • locales/vi.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • resources.pak
  • resources/app.asar
  • resources/bin/updater.win64.exe
    .exe windows:4 windows x64 arch:x64

    80538c307e4d824fb80c39d72afa3ca9


    Code Sign

    Headers

    Imports

    Sections

  • resources/bin/updater.win64.exe.manifest
  • resources/bin/zenshot/D3Dcompiler_47.dll
    .dll windows:6 windows x86 arch:x86

    f63cad154afed6da772d0ab361f448f6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    87a63f644cb8a20014ebd30c4ceb01d5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    6d8fc7db13171b9552fbb8f312714265


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/Qt5Network.dll
    .dll windows:6 windows x86 arch:x86

    b039c588c74493feceed91f3303659a5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    5fc3777017c6df44a5f6f14c9a5906ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    2481a30a543553aa9ac49e9a3fcdcead


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/bearer/qgenericbearer.dll
    .dll windows:6 windows x86 arch:x86

    89f0e0887edb98870f4b0b7fdfb5fd60


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/iconengines/qsvgicon.dll
    .dll windows:6 windows x86 arch:x86

    4adc47823b2076e09c592a24dd45d220


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qgif.dll
    .dll windows:6 windows x86 arch:x86

    1e9dfd6c42f08b660c26451e4fce3e66


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qicns.dll
    .dll windows:6 windows x86 arch:x86

    1200837d292bb12aeb1c631db8daaec2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    53ad58237fca15c88c16c13eda178993


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qjpeg.dll
    .dll windows:6 windows x86 arch:x86

    330ecc2baa47f45da7b453f74d654d9d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qsvg.dll
    .dll windows:6 windows x86 arch:x86

    c305525150d66eb3a243650f168bb66d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qtga.dll
    .dll windows:6 windows x86 arch:x86

    ff792799361d2a04a2c9fba30a1da2fe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qtiff.dll
    .dll windows:6 windows x86 arch:x86

    9a0a81d50421590819f855e163f3e961


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qwbmp.dll
    .dll windows:6 windows x86 arch:x86

    2943b243e4a1ddbd3fe7fca51d739142


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/imageformats/qwebp.dll
    .dll windows:6 windows x86 arch:x86

    b14b0f58f573a5a65ca530bc71aa83e5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/libEGL.dll
    .dll windows:6 windows x86 arch:x86

    c3cfadbb3d67583cba230c6d9df9b410


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/libGLESv2.dll
    .dll windows:6 windows x86 arch:x86

    3cca5c694452a82db2a7e5f53fc73748


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/libcrypto-1_1.dll
    .dll windows:5 windows x86 arch:x86

    1a4728323839926a0cea4a4ffbbfc558


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/libssl-1_1.dll
    .dll windows:5 windows x86 arch:x86

    fed3413a3019f260632acc9760eb8c69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    6042f1676a7711e459589ef169a5b501


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/opengl32sw.dll
    .dll windows:6 windows x86 arch:x86

    96787902f59fced940d332fc8148bd5c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    9cde3d090a1490a102d172df2764077d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/styles/qwindowsvistastyle.dll
    .dll windows:6 windows x86 arch:x86

    652e121b441bed1a658fee0944fee99b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/translations/qt_ar.qm
  • resources/bin/zenshot/translations/qt_bg.qm
  • resources/bin/zenshot/translations/qt_ca.qm
  • resources/bin/zenshot/translations/qt_cs.qm
  • resources/bin/zenshot/translations/qt_da.qm
  • resources/bin/zenshot/translations/qt_de.qm
  • resources/bin/zenshot/translations/qt_en.qm
  • resources/bin/zenshot/translations/qt_es.qm
  • resources/bin/zenshot/translations/qt_fi.qm
  • resources/bin/zenshot/translations/qt_fr.qm
  • resources/bin/zenshot/translations/qt_gd.qm
  • resources/bin/zenshot/translations/qt_he.qm
  • resources/bin/zenshot/translations/qt_hu.qm
  • resources/bin/zenshot/translations/qt_it.qm
  • resources/bin/zenshot/translations/qt_ja.qm
  • resources/bin/zenshot/translations/qt_ko.qm
  • resources/bin/zenshot/translations/qt_lv.qm
  • resources/bin/zenshot/translations/qt_pl.qm
  • resources/bin/zenshot/translations/qt_ru.qm
  • resources/bin/zenshot/translations/qt_sk.qm
  • resources/bin/zenshot/translations/qt_uk.qm
  • resources/bin/zenshot/translations/qt_zh_TW.qm
  • resources/bin/zenshot/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    b06d4116da69a513992d529f84731e6f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/bin/zenshot/zenshot.exe
    .exe windows:6 windows x86 arch:x86

    91cab574f717720b67a4a74b4b3c6127


    Code Sign

    Headers

    Imports

    Sections

  • resources/build-in/api.json
  • resources/build-in/easysoft-themes/package.json
  • resources/build-in/easysoft-themes/themes/dark.css
  • resources/build-in/easysoft-themes/themes/green.css
  • resources/build-in/easysoft-themes/themes/highlightjs.css
  • resources/build-in/easysoft-themes/themes/pink.css
  • resources/build-in/easysoft-themes/themes/red.css
  • resources/build-in/easysoft-themes/themes/wisteria.css
  • resources/build-in/easysoft-themes/themes/zentao.css
  • resources/build-in/extensions.json
  • resources/build-in/ts-icons/icons.png
    .png
  • resources/build-in/ts-icons/[email protected]
    .png
  • resources/build-in/ts-icons/style.css
  • resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Code Sign

    Headers

    Imports

    Sections

  • resources/lang/en.json
  • resources/lang/ja.json
  • resources/lang/vi.json
  • resources/lang/zh-cn.json
  • resources/lang/zh-tw.json
  • snapshot_blob.bin
  • swiftshader/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    67db432914b7baa0738050364c019173


    Headers

    Imports

    Exports

    Sections

  • swiftshader/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    8b4ec8564c21d6087c06b61d3d5ffbbd


    Headers

    Imports

    Exports

    Sections

  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    a7af8f48f1e806eeea04222091fce342


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    21c5b88eff7d67aaad312ae7a9ae2733


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zentaoclient.exe
    .exe windows:5 windows x64 arch:x64

    75804bffe12a995934f63205428ac121


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d31c5eb927119d00232e4d4b0e32fcdb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    2656ea25cde98f31a490513c2db04ae8


    Headers

    Imports

    Exports

    Sections

  • Uninstall zentaoclient.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections