General

  • Target

    b7a3c6f02691100f472b39568707016a2e68db0b117dc9d3f27692752c42d3d3

  • Size

    9.9MB

  • MD5

    21ce298d9a29b2a240a15e419ab7cd54

  • SHA1

    830c2c2be57e2d03f4f7f66ea54823c715cec9ee

  • SHA256

    b7a3c6f02691100f472b39568707016a2e68db0b117dc9d3f27692752c42d3d3

  • SHA512

    af9d4f6dabc70fa21d4a8b664b69244849ac322507b1e0c15ecbf76f3f1687465f5420c719609c552f27c1e09abae9a0387bcdf7345af06dda236a0871d47af9

  • SSDEEP

    196608:fWNI01a+gKiPj2RBzK3IK1YrR5i0NpvcVKlbMNK6N+PKAnP9hAGgRd1So+:L0KKGLQ3i0vk8baInP7A5/So+

Score
3/10

Malware Config

Signatures

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • b7a3c6f02691100f472b39568707016a2e68db0b117dc9d3f27692752c42d3d3
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Code Sign

    Headers

    Imports

    Sections

  • $LOCALAPPDATA/kingsoft/WPS Cloud Files/update/qingqt.exe
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $TEMP/qingqt/QtCore4.dll
    .dll windows:5 windows x86 arch:x86

    a7745e29cb11fe977f69331b97e79389


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/QtGui4.dll
    .dll windows:5 windows x86 arch:x86

    040e45e11cf7b54650cab46db2f4d48d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/QtNetwork4.dll
    .dll windows:5 windows x86 arch:x86

    474ffdd8afac9355d3795456cc79df7f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/QtWebKit4.dll
    .dll windows:5 windows x86 arch:x86

    7c5520180e6361aee62f1e64caf9d70c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/QtXml4.dll
    .dll windows:5 windows x86 arch:x86

    bc5948a21a895df47692be2e69db3a60


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/libeay32.dll
    .dll windows:5 windows x86 arch:x86

    fa87c4124cb0203b33b7b60c36a1b753


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/phonon4.dll
    .dll windows:5 windows x86 arch:x86

    4a2f6658cb75b6454829573e981a524c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/qt.conf
  • $TEMP/qingqt/qt/plugins/imageformats/qgif4.dll
    .dll windows:5 windows x86 arch:x86

    c790e9c510fb1fe6812ae7a34f11cf2e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/qt/plugins/imageformats/qico4.dll
    .dll windows:5 windows x86 arch:x86

    a28faf3f0481705576262d39058296f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/qt/plugins/imageformats/qjpeg4.dll
    .dll windows:5 windows x86 arch:x86

    af7684dc12f2aa03b37cbc5045a655cd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/qt/plugins/imageformats/qmng4.dll
    .dll windows:5 windows x86 arch:x86

    4021217b47b4973adbe493ae5e95b2f7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/qt/plugins/imageformats/qtiff4.dll
    .dll windows:5 windows x86 arch:x86

    7c92caa154e97dd22c89d89c93f2bf0b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/qingqt/ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    55bffa7535488b0e863c68acaff94e46


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $LOCALAPPDATA/kingsoft/WPS Cloud Files/update/upqing.exe
    .exe windows:5 windows x86 arch:x86

    9db6623dcc247d84132c86fa07df557e


    Code Sign

    Headers

    Imports

    Sections

  • $LOCALAPPDATA/kingsoft/WPS Cloud Files/update/version.ini
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • 8.1.32.1/cfgs/domain.cfg
  • 8.1.32.1/curls.dll
    .dll windows:5 windows x86 arch:x86

    d61fc892978a5d973eb131246c63efc8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 8.1.32.1/mui/de_DE/qing.qm
  • 8.1.32.1/mui/de_DE/res.rcc
  • 8.1.32.1/mui/en_US/qing.qm
  • 8.1.32.1/mui/en_US/res.rcc
  • 8.1.32.1/mui/ja_JP/qing.qm
  • 8.1.32.1/mui/ja_JP/res.rcc
  • 8.1.32.1/mui/zh_CN/qing.qm
  • 8.1.32.1/mui/zh_CN/res.rcc
  • 8.1.32.1/mui/zh_TW/qing.qm
  • 8.1.32.1/mui/zh_TW/res.rcc
  • 8.1.32.1/qingshellext.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    c0244a3c27c5beaefa8987e983e7e723


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 8.1.32.1/qingshellext64.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    2492b375589b02e0b4eb69bdbc944a10


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 8.1.32.1/wpscloud.exe
    .exe windows:5 windows x86 arch:x86

    179a6a4cf756e30872b65f8081183921


    Code Sign

    Headers

    Imports

    Sections

  • wpscloudlaunch.exe
    .exe windows:5 windows x86 arch:x86

    42c6edc1c14adb2fde672dbcda65959a


    Code Sign

    Headers

    Imports

    Sections