General

  • Target

    2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe

  • Size

    43.1MB

  • MD5

    c75b5515952ea615219e1991c4592236

  • SHA1

    2ade0a6c621b36f727e461059c3cdf2126d4bfca

  • SHA256

    2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584

  • SHA512

    65686328dc3ccec012871be9a1dcdc0aee0b0337ddf2ceeb689c4427a7a626091153a296a24ff4108dcca4e6247c2505e9375057172c56584f75dc82de4acb61

  • SSDEEP

    786432:fV/UMe6yXkT3cCJ8FI5G4FtOOVPILJ8G+WwwlavmeeOEcI0wP0XECxgejlot:fVsMgXB2wpO1ILCTwlavmdOTLUCxLot

Score
10/10

Malware Config

Signatures

  • Detects executables packed with Themida 5 IoCs
  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe
    .exe windows:4 windows x86 arch:x86

    ced282d9b261d1462772017fe2f6972b


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    610235b90207a63ccf481f0d4375d329


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • DRCom.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Item.ini
  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    d1eed73b2198585501688ee14b0b46d8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    acfabc1945282437fb10d1bc365ea5f7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Network.dll
    .dll windows:6 windows x86 arch:x86

    b2dcbf72d90f7001ad071bccc64feaca


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5PrintSupport.dll
    .dll windows:6 windows x86 arch:x86

    588610002930f2366bf7cb72d19fd15a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    4585dc2ef3ce6f119bb1890f7c005a07


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WebKit.dll
    .dll windows:6 windows x86 arch:x86

    7d4e962165884532fc53d08918a7200c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WebKitWidgets.dll
    .dll windows:6 windows x86 arch:x86

    d5a6437df1a302b813c013b7c8300419


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    5b920228e84b38a3f6886a6612a37408


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WinExtras.dll
    .dll windows:6 windows x86 arch:x86

    c74083bd0e5f6311e706a753391beef1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Xml.dll
    .dll windows:6 windows x86 arch:x86

    33cfc973f3baebd55d2574432266a23b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • iconengines/qsvgicon.dll
    .dll windows:6 windows x86 arch:x86

    ad0b6da46b8984fd8666b71ed53abef4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • icudt57.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • icuin57.dll
    .dll windows:6 windows x86 arch:x86

    8f50eee4b75e3c5134b9ea1e20804be2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • icuuc57.dll
    .dll windows:6 windows x86 arch:x86

    f31b08bbe6ae81560e368d022c98cd25


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qgif.dll
    .dll windows:6 windows x86 arch:x86

    cdd2ef88d41a2faf5b6451a928993c2b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qicns.dll
    .dll windows:6 windows x86 arch:x86

    443787797e31469316bc4275c1760ee1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    e5069bdae7f8ea566abf0574fcadcb9c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qjpeg.dll
    .dll windows:6 windows x86 arch:x86

    d37486f122b96b1d3e3c23eb4c4a061a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qsvg.dll
    .dll windows:6 windows x86 arch:x86

    5b971efb0512656e153f811565344733


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qtiff.dll
    .dll windows:6 windows x86 arch:x86

    cdb7fe58b2517819721c114d7947d20a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qwbmp.dll
    .dll windows:6 windows x86 arch:x86

    42e2536118764178f82828abfe4d00f5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qwdp.dll
    .dll windows:6 windows x86 arch:x86

    16a5516e927333085c3d7f49ad8155a6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qwebp.dll
    .dll windows:6 windows x86 arch:x86

    c5bc9301ccf5fc0c3954264de0604235


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • kaccountsdk_c.dll
    .dll windows:5 windows x86 arch:x86

    389bb358d759aa54aa2920c197b13c44


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • kdcsdk_remix.dll
    .dll windows:5 windows x86 arch:x86

    e4ac62d6b77c2a30fc527db3024cb94b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • kdownload.dll
    .dll windows:5 windows x86 arch:x86

    36067bd28ab62f8e9c3fbfad14a554e3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • kqingaccountsdk_qt.dll
    .dll windows:5 windows x86 arch:x86

    0521dfc1a71e5d0ac57b35009b52babf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ksodr.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • ksolite.dll
    .dll windows:5 windows x86 arch:x86

    7bdff0fceae1c742422adc506475c4db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ksolog.dll
    .dll windows:5 windows x86 arch:x86

    9af4f80b0996ad247dc35b7e9089aa6e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libcrypto-1_1.dll
    .dll windows:6 windows x86 arch:x86

    855d2e4fbd9156ee790b42bb989fa388


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libcurl.dll
    .dll windows:6 windows x86 arch:x86

    9ba8cc2d5dc44406166ab9764d99b131


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:5 windows x86 arch:x86

    fa87c4124cb0203b33b7b60c36a1b753


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libssl-1_1.dll
    .dll windows:6 windows x86 arch:x86

    3d8fa35d7037791c97ba6286d95f48ed


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    f2d585ff96afa3a77e09f5b37e7b3230


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • mui/zh_cn/kaccountsdk.qm
  • platforms/qdirect2d.dll
    .dll windows:6 windows x86 arch:x86

    96210cfe18c0f40cbd028920987ea017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    f3b10859d9c7d34b8d1391aa95eba504


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • preview.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • printsupport/windowsprintersupport.dll
    .dll windows:6 windows x86 arch:x86

    a58fecf5b393461a8bf45c16c7adc271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • reupd.exe
    .exe windows:4 windows x86 arch:x86

    2e6ea72b9edb3d8202aeb81f6b011aa2


    Code Sign

    Headers

    Imports

    Sections

  • searchfile.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    55bffa7535488b0e863c68acaff94e46


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis
  • validata.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • yanfr.dat
  • yanrs.dat