General

  • Target

    01ee6aa88ccfb589bde33b360ad45300_NEAS

  • Size

    3.0MB

  • MD5

    01ee6aa88ccfb589bde33b360ad45300

  • SHA1

    a17e4ba8624559a88e8b586b2405fc2550333cb1

  • SHA256

    3f95350bec78f3895ea0c097358108f965eadfd3063d3754db8f864f3a5cbb6e

  • SHA512

    15d5e0930bbab96e0b6434fcc0a4f52adbe772988169f292b136f240cd3a6ab9fac50244f703443be06cef75f0021043bfcee481a02ef93da2316679f0643e12

  • SSDEEP

    98304:IkA6wBUw3OFfN6/4BccJJ8q6I8UImCMT+Ygwv3G53hkIs:XqfOFfU4Bc68Ui6+Yxv29s

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 01ee6aa88ccfb589bde33b360ad45300_NEAS
    .exe windows:4 windows x86 arch:x86

    7eae418c7423834ffc3d79b4300bd6fb


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • DmMain.dll
    .dll windows:6 windows x86 arch:x86

    d71d6194e0a6997b232aee39165488a9


    Headers

    Imports

    Exports

    Sections

  • cef.log
  • config.ini
  • ltzn.exe
    .exe windows:6 windows x86 arch:x86

    4ce8efd491789af600a6d8aedc9ab02e


    Code Sign

    Headers

    Imports

    Sections

  • ui/layout/dmindex.xml
  • ui/layout/xml/dui_gamewnd.xml
  • ui/layout/xml/dui_ie.xml
  • ui/layout/xml/dui_loginwnd.xml
  • ui/layout/xml/dui_popup.xml
  • ui/layout/xml/global.xml
  • ui/themes/dmindex.xml
  • ui/themes/theme0/dmindex.xml
  • ui/themes/theme0/image/anima.png
    .png
  • ui/themes/theme0/image/btn_bosskey.png
    .png
  • ui/themes/theme0/image/btn_cancel.png
    .png
  • ui/themes/theme0/image/btn_clear_cache.png
    .png
  • ui/themes/theme0/image/btn_close.png
    .png
  • ui/themes/theme0/image/btn_gonglue.png
    .png
  • ui/themes/theme0/image/btn_home.png
    .png
  • ui/themes/theme0/image/btn_kefu.png
    .png
  • ui/themes/theme0/image/btn_libao.png
    .png
  • ui/themes/theme0/image/btn_login_charge.png
    .png
  • ui/themes/theme0/image/btn_login_close.png
    .png
  • ui/themes/theme0/image/btn_login_gift.png
    .png
  • ui/themes/theme0/image/btn_login_home.png
    .png
  • ui/themes/theme0/image/btn_login_min.png
    .png
  • ui/themes/theme0/image/btn_login_service.png
    .png
  • ui/themes/theme0/image/btn_max.png
    .png
  • ui/themes/theme0/image/btn_min.png
    .png
  • ui/themes/theme0/image/btn_ok.png
    .png
  • ui/themes/theme0/image/btn_refresh.png
    .png
  • ui/themes/theme0/image/btn_restore.png
    .png
  • ui/themes/theme0/image/main.png
    .png
  • ui/themes/theme0/image/wnd_game_title.png
    .png
  • ui/themes/theme0/image/wnd_login.png
    .png
  • ui/themes/theme0/image/wnd_popup_background.png
    .png
    • http://weixin.qq.com/r/ORD17Z3EkMDvrdmO90Ur

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7eae418c7423834ffc3d79b4300bd6fb


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis