General

  • Target

    fd03caa5aa9ee7e28bcb2652383286f780b376bea7e59e3d7494c8c86dfa8b96

  • Size

    15.8MB

  • MD5

    a5f3762d8af4f6505e4e0f860f80e2fd

  • SHA1

    6f76d3f3d30bfd3b89d7b0edf27560e6c32db884

  • SHA256

    fd03caa5aa9ee7e28bcb2652383286f780b376bea7e59e3d7494c8c86dfa8b96

  • SHA512

    00d8b86bfc2b4b46954f7d527f6c520f14725f87cc198190b2067298dd13077db27d7464b7d50ec7141c253ebfb9cd2b6e8977ac42012742375e8ab55f1fecd6

  • SSDEEP

    393216:MSm8lkFA6qgKTav8SqpRYpIfphLfQQRDKat:MSllk1K9YSnLfQ0

Score
3/10

Malware Config

Signatures

  • Unsigned PE 55 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • fd03caa5aa9ee7e28bcb2652383286f780b376bea7e59e3d7494c8c86dfa8b96
    .exe windows:4 windows x86 arch:x86

    cad4c96e19ec6e52560b9ccb84edddb4


    Headers

    Imports

    Sections

  • $PLUGINSDIR/BgWorker.dll
    .dll windows:4 windows x86 arch:x86

    db2755f409b81c4dbfc04f648cfb80b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    8df26927f8978d4eb40ff179c0aa961b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinBtn.dll
    .dll windows:4 windows x86 arch:x86

    baf2d405231cd43dae48df474a521d01


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinProgress.dll
    .dll windows:4 windows x86 arch:x86

    df38729be926f91d3390389029adf53b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    aaa34d9251e34ceebd6bf5066471d799


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WebCtrl.dll
    .dll windows:4 windows x86 arch:x86

    edf01e434638f2238a21d45d26ed9a7d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WndProc.dll
    .dll windows:4 windows x86 arch:x86

    b3f659d7637a91b4fec12ff9b930080d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bg.bmp
  • $PLUGINSDIR/btn_agreement1.bmp
  • $PLUGINSDIR/btn_agreement2.bmp
  • $PLUGINSDIR/btn_cancel.bmp
  • $PLUGINSDIR/btn_change.bmp
  • $PLUGINSDIR/btn_close.bmp
  • $PLUGINSDIR/btn_complete.bmp
  • $PLUGINSDIR/btn_install.bmp
  • $PLUGINSDIR/btn_next.bmp
  • $PLUGINSDIR/btn_quit.bmp
  • $PLUGINSDIR/checkbox1.bmp
  • $PLUGINSDIR/checkbox2.bmp
  • $PLUGINSDIR/index.htm
    .html .js polyglot
  • $PLUGINSDIR/installation.bmp
  • $PLUGINSDIR/license.rtf
    .rtf
  • $PLUGINSDIR/loading1.bmp
  • $PLUGINSDIR/loading2.bmp
  • $PLUGINSDIR/loading_pic1.bmp
  • $PLUGINSDIR/loading_pic2.bmp
  • $PLUGINSDIR/loading_pic3.bmp
  • $PLUGINSDIR/loading_pic4.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    736ca3dd90e5c9ec98156c9f341764fe


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsWindows$_37_.dll
    .dll windows:4 windows x86 arch:x86

    8baa37b4b9803e205026a5e2d38eebac


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/quit.bmp
  • $PLUGINSDIR/select.bmp
  • $PLUGINSDIR/success.bmp
  • $PLUGINSDIR/welcome.bmp
  • MSVCR80.dll
    .dll windows:4 windows x86 arch:x86

    7fecbc4a16a5dc85a5394a1df6217680


    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC80.CRT.manifest
    .xml
  • SharpCompress.3.5.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System.Data.SQLite.dll
    .dll windows:5 windows x86 arch:x86

    2eb25e53c06c81f6dbba492e20f41fbf


    Headers

    Imports

    Exports

    Sections

  • ccLoLSkin.exe
    .exe windows:4 windows x86 arch:x86

    925b5b6ab55c2b01631127097a6fbabd


    Headers

    Imports

    Sections

  • ccLoLSkin.rsm
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ccLoLSkinUpdater.exe
    .exe windows:4 windows x86 arch:x86

    925b5b6ab55c2b01631127097a6fbabd


    Headers

    Imports

    Sections

  • ccLoLSkinUpdater.rsm
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • gdiplus.dll
    .dll windows:6 windows x86 arch:x86

    2f8788153edc3bff3c95610aae8c96d5


    Headers

    Imports

    Exports

    Sections

  • mdeploy.registry
  • mscoree.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    cf7cefc63a5d10cae2438336176a185e


    Headers

    Imports

    Exports

    Sections

  • msvcm80.dll
    .dll windows:4 windows x86 arch:x86

    83e6ecedcb8a69cca8d85e1481140fa0


    Headers

    Imports

    Exports

    Sections

  • msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    6488997e312be12f8300ea7b1c34d497


    Headers

    Imports

    Exports

    Sections

  • ndphlpr.vxd
  • rsdeploy.dll
    .dll windows:4 windows x86 arch:x86

    3343c25995e0429ad9387536c10f7ac8


    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/CONFIG/machine.config
    .xml
  • v2.0.50727/Culture.dll
    .dll windows:5 windows x86 arch:x86

    104e17c81d918d1c093da532dc4f4dbe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/XPThemes.manifest
    .xml
  • v2.0.50727/aspnet_state.exe
    .exe windows:5 windows x86 arch:x86

    cdb75c28ccc393d6f776f7a7fdd66205


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/aspnet_wp.exe
    .exe windows:5 windows x86 arch:x86

    a420d7e0ba99ceb4900bedfc75869ccd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/assembly/GAC/Microsoft.DirectX.Direct3D/1.0.2902.0__31bf3856ad364e35/Microsoft.DirectX.Direct3D.dll
    .dll windows:5 windows x86 arch:x86

    cc3ca07defb48d2a38605fc9ea19b7ae


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC/Microsoft.DirectX.Direct3DX/1.0.2902.0__31bf3856ad364e35/Microsoft.DirectX.Direct3DX.dll
    .dll windows:5 windows x86 arch:x86

    4b91b76742a6ba2da063220d98a85991


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC/Microsoft.DirectX/1.0.2902.0__31bf3856ad364e35/Microsoft.DirectX.dll
    .dll windows:5 windows x86 arch:x86

    272e9f998b44bd5348f4d46d5b74bed2


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_32/CustomMarshalers/2.0.0.0__B03F5F7F11D50A3A/CustomMarshalers.dll
    .dll windows:4 windows x86 arch:x86

    6158ba7cc8abe8f855a2af17a6d4b2c0


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_32/CustomMarshalers/2.0.0.0__B03F5F7F11D50A3A/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/assembly/GAC_32/System.Data.OracleClient/2.0.0.0__b77a5c561934e089/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/assembly/GAC_32/System.Data.OracleClient/2.0.0.0__b77a5c561934e089/System.Data.OracleClient.dll
    .dll windows:5 windows x86 arch:x86

    d85ce73c1de1ead24bc94e61d8a830fd


    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/assembly/GAC_32/System.Data/2.0.0.0__b77a5c561934e089/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/assembly/GAC_32/System.Data/2.0.0.0__b77a5c561934e089/System.Data.dll
    .dll windows:5 windows x86 arch:x86

    432def252835648e0bb5a238b4ff78f1


    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/assembly/GAC_32/System.EnterpriseServices/2.0.0.0__b03f5f7f11d50a3a/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/assembly/GAC_32/System.EnterpriseServices/2.0.0.0__b03f5f7f11d50a3a/System.EnterpriseServices.Wrapper.dll
    .dll windows:4 windows x86 arch:x86

    ba6a2bdeb4b05c693ce709fd0114a489


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_32/System.EnterpriseServices/2.0.0.0__b03f5f7f11d50a3a/System.EnterpriseServices.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_32/System.Transactions/2.0.0.0__b77a5c561934e089/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/assembly/GAC_32/System.Transactions/2.0.0.0__b77a5c561934e089/System.Transactions.dll
    .dll windows:5 windows x86 arch:x86

    7469780bb6fda5f25da4408eda0b3bb8


    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/assembly/GAC_32/System.Web/2.0.0.0__b03f5f7f11d50a3a/System.Web.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/Accessibility/2.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/Microsoft.VisualC/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualC.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Configuration.Install/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.Install.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Core/3.5.0.0__b77a5c561934e089/System.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Data.SqlXml/2.0.0.0__b77a5c561934e089/System.Data.SqlXml.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Deployment/2.0.0.0__b03f5f7f11d50a3a/System.Deployment.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Design/2.0.0.0__b03f5f7f11d50a3a/System.Design.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.DirectoryServices.Protocols/2.0.0.0__b03f5f7f11d50a3a/System.DirectoryServices.Protocols.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.DirectoryServices/2.0.0.0__b03f5f7f11d50a3a/System.DirectoryServices.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Drawing.Design/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.Design.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Runtime.Serialization.Formatters.Soap/2.0.0.0__b03f5f7f11d50a3a/System.Runtime.Serialization.Formatters.Soap.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Security/2.0.0.0__b03f5f7f11d50a3a/System.Security.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.ServiceProcess/2.0.0.0__b03f5f7f11d50a3a/System.ServiceProcess.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Web.RegularExpressions/2.0.0.0__b03f5f7f11d50a3a/System.Web.RegularExpressions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Web.Services/2.0.0.0__b03f5f7f11d50a3a/System.Web.Services.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/Microsoft.VC80.CRT.manifest
    .xml
  • v2.0.50727/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/big5.nlp
  • v2.0.50727/bopomofo.nlp
  • v2.0.50727/fusion.dll
    .dll windows:5 windows x86 arch:x86

    1051efecb362e0de4aaa7e06eddb2c1e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/fusion.localgac
  • v2.0.50727/ksc.nlp
  • v2.0.50727/mscorjit.dll
    .dll windows:5 windows x86 arch:x86

    458ae5b7483d2b3344ceeb01eb67e386


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/mscorlib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • v2.0.50727/mscorpe.dll
    .dll windows:5 windows x86 arch:x86

    3a344f14752e8499197747aebebcaf95


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/mscorrc.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • v2.0.50727/mscorsec.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    07335eddf27a4231f6118462dc9d24d4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/mscorsn.dll
    .dll windows:5 windows x86 arch:x86

    a7670aa8ab20ac4171ecb19e6d4a0fa3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/mscorwks.dll
    .dll windows:5 windows x86 arch:x86

    178d7e72f91a6c5c70441b06520098c4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/normidna.nlp
  • v2.0.50727/normnfc.nlp
  • v2.0.50727/normnfd.nlp
  • v2.0.50727/normnfkc.nlp
  • v2.0.50727/normnfkd.nlp
  • v2.0.50727/perfcounter.dll
    .dll windows:5 windows x86 arch:x86

    39bba1f42319f1b5ace86f1e78e154cc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/prc.nlp
  • v2.0.50727/prcp.nlp
  • v2.0.50727/sortkey.nlp
  • v2.0.50727/sorttbls.nlp
  • v2.0.50727/webengine.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    78160a6a84b2d2de6f5d597f7ff45d8e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • v2.0.50727/xjis.nlp
  • ־.txt
  • ܳֵ⼰.txt