General

  • Target
    WeChatSetup.exe
  • Size 245.2MB
  • Sample240710-gad2sszarn
  • SHA256 243f3743b7c0353104dffd185aa6d754407e7b31c3840e30fdc5ec66d7f1c11b
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • WeChatSetup.exe
    .exe 245.2MB
  • $PLUGINSDIR/FindProcDLL.dll
    .dll 492KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll 3.6MB
  • $PLUGINSDIR/nsInstallAssist.dll
    .dll 192KB
  • Uninstall.exe
    .exe 1.7MB
  • $PLUGINSDIR/FindProcDLL.dll
    .dll 492KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll 3.6MB
  • WeChat.exe
    .exe 644KB
  • WechatAppLauncher.exe
    .exe 612KB
  • [3.9.11.19]/ConfSdk.dll
    .dll 1.4MB
  • [3.9.11.19]/RadiumWMPF.bin
    .zip 352.5MB
  • file_component.xml
    9KB
  • host/wmpf_host_export.dll
    .dll 1.8MB
  • host/wmpf_host_export_x64.dll
    .dll 2.2MB
  • runtime/ComponentVerification.dll
    .dll 177KB
  • runtime/ConfSdk.dll
    .dll 1.2MB
  • runtime/VoipEngine.dll
    .dll 14.6MB
  • runtime/WXAMSDK.dll
    .dll 10.5MB
  • runtime/WeChatAppEx.exe
    .exe 176.1MB
  • runtime/d3dcompiler_47.dll
    .dll 4.7MB
  • runtime/ffmpeg.dll
    .dll 2.8MB
  • runtime/icudtl.dat
    10.1MB
  • runtime/ilink2.dll
    .dll 6.2MB
  • runtime/ilink_network.dll
    .dll 6.0MB
  • runtime/libEGL.dll
    .dll 477KB
  • runtime/libGLESv2.dll
    .dll 7.1MB
  • runtime/liteav.dll
    .dll 11.9MB
  • runtime/locales/en-US.pak
    178KB
  • runtime/locales/zh-CN.pak
    179KB
  • runtime/owl.dll
    .dll 1.1MB
  • runtime/snapshot_blob.bin
    262KB
  • runtime/txffmpeg.dll
    .dll 6.2MB
  • runtime/txsoundtouch.dll
    .dll 136KB
  • runtime/v8_context_snapshot.bin
    582KB
  • runtime/vk_swiftshader.dll
    .dll 4.7MB
  • runtime/vk_swiftshader_icd.json
    106B
  • runtime/vulkan-1.dll
    .dll 924KB
  • runtime/wmpf_100_percent.pak
    1.3MB
  • runtime/wmpf_200_percent.pak
    1.5MB
  • runtime/wmpf_resources.pak
    15.3MB
  • runtime/xfile/api-ms-win-core-console-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-console-l1-2-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-datetime-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-debug-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-errorhandling-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-fibers-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-file-l1-1-0.dll
    .dll 25KB
  • runtime/xfile/api-ms-win-core-file-l1-2-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-file-l2-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-handle-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-heap-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-interlocked-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-libraryloader-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-localization-l1-2-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-memory-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-namedpipe-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-processenvironment-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-processthreads-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-profile-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-string-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-synch-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-synch-l1-2-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-timezone-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-core-util-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-conio-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-convert-l1-1-0.dll
    .dll 25KB
  • runtime/xfile/api-ms-win-crt-environment-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-heap-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-locale-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-math-l1-1-0.dll
    .dll 29KB
  • runtime/xfile/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 29KB
  • runtime/xfile/api-ms-win-crt-private-l1-1-0.dll
    .dll 73KB
  • runtime/xfile/api-ms-win-crt-process-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-runtime-l1-1-0.dll
    .dll 25KB
  • runtime/xfile/api-ms-win-crt-stdio-l1-1-0.dll
    .dll 25KB
  • runtime/xfile/api-ms-win-crt-string-l1-1-0.dll
    .dll 25KB
  • runtime/xfile/api-ms-win-crt-time-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/api-ms-win-crt-utility-l1-1-0.dll
    .dll 21KB
  • runtime/xfile/concrt140.dll
    .dll 301KB
  • runtime/xfile/mmpdfium.dll
    .dll 5.4MB
  • runtime/xfile/msvcp140.dll
    .dll 550KB
  • runtime/xfile/msvcp140_1.dll
    .dll 23KB
  • runtime/xfile/msvcp140_codecvt_ids.dll
    .dll 19KB
  • runtime/xfile/ucrtbase.dll
    .dll 1.1MB
  • runtime/xfile/vcruntime140.dll
    .dll 93KB
  • runtime/xfile/vcruntime140_1.dll
    .dll 35KB
  • runtime/xfile/xfile.dll
    .dll 1018KB
  • runtime/xfile/xfile_commandbuffer.dll
    .dll 282KB
  • runtime/xfile/xfile_module.node
    .dll 1.2MB
  • runtime/xfile/xfile_parse.dll
    .dll 40.6MB
  • runtime/xfile/xfile_pdf_module.node
    .dll 720KB
  • runtime/xfile/xfile_render.dll
    .dll 1.4MB
  • runtime/xfile/xfile_skia.dll
    .dll 7.2MB
  • runtime/xfile/xfile_tools.dll
    .dll 2.2MB
  • runtime/xweb_elf.dll
    .dll 1.3MB
  • x64.config
    3B
  • [3.9.11.19]/SDL License.txt
    433B
  • [3.9.11.19]/SPEEX LICENSE.txt
    1KB
  • [3.9.11.19]/SQLCipher LICENSE.txt
    1KB
  • [3.9.11.19]/Skia LICENSE.txt
    1KB
  • [3.9.11.19]/ThumbPlayer.bin
    .zip 45.0MB
  • D3DX9_43.dll
    .dll 2.3MB
  • TPCommon.dll
    .dll 570KB
  • TPCore.dll
    .dll 4.9MB
  • TPDX11Renderer.dll
    .dll 488KB
  • TPMultiProcess.dll
    .dll 1.0MB
  • TPThumbPlayer.dll
    .dll 1.2MB
  • TVKDownloadProxy.dll
    .dll 5.0MB
  • TxBugReport.exe
    .exe 537KB
  • WeChatPlayer.exe
    .exe 3.2MB
  • avcodec-58.dll
    .dll 14.2MB
  • avdevice-58.dll
    .dll 738KB
  • avfilter-7.dll
    .dll 3.4MB
  • avformat-58.dll
    .dll 3.1MB
  • avutil-56.dll
    .dll 1.1MB
  • d3dx11_43.dll
    .dll 270KB
  • file_component.xml
    2KB
  • pthread.dll
    .dll 438KB
  • swresample-3.dll
    .dll 642KB
  • swscale-5.dll
    .dll 1.1MB
  • tinyxml.dll
    .dll 872KB
  • x64.config
    3B
  • [3.9.11.19]/Uninstall.exe
    .exe 1.7MB
  • $PLUGINSDIR/FindProcDLL.dll
    .dll 492KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll 3.6MB
  • [3.9.11.19]/VoipEngine.dll
    .dll 15.0MB
  • [3.9.11.19]/WeChat.exe
    .exe 644KB
  • [3.9.11.19]/WeChatExt.exe
    .exe 264KB
  • [3.9.11.19]/WeChatOCR.bin
    .zip 60.0MB
  • Model/FPOCRRecog.xnet
    9.1MB
  • Model/OCRDetFP32.xnet.nas
    1.5MB
  • Model/OCRParaDetV1.1.0.26.xnet
    2.7MB
  • Model/OCRRecogFP32V1.1.0.26.xnet
    7.3MB
  • Model/RecDict
    46KB
  • Model/sohu_simp.txt
    19KB
  • TxBugReport.exe
    .exe 537KB
  • WeChatOCR.exe
    .exe 34.9MB
  • api-ms-win-core-console-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-console-l1-2-0.dll
    .dll 20KB
  • api-ms-win-core-datetime-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-debug-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-errorhandling-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-fibers-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-file-l1-1-0.dll
    .dll 24KB
  • api-ms-win-core-file-l1-2-0.dll
    .dll 20KB
  • api-ms-win-core-file-l2-1-0.dll
    .dll 20KB
  • api-ms-win-core-handle-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-heap-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-interlocked-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-libraryloader-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-localization-l1-2-0.dll
    .dll 20KB
  • api-ms-win-core-memory-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-namedpipe-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-processenvironment-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-processthreads-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-processthreads-l1-1-1.dll
    .dll 20KB
  • api-ms-win-core-profile-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-string-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-synch-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-synch-l1-2-0.dll
    .dll 20KB
  • api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-timezone-l1-1-0.dll
    .dll 20KB
  • api-ms-win-core-util-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-conio-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-convert-l1-1-0.dll
    .dll 24KB
  • api-ms-win-crt-environment-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-heap-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-locale-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-math-l1-1-0.dll
    .dll 28KB
  • api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 28KB
  • api-ms-win-crt-private-l1-1-0.dll
    .dll 72KB
  • api-ms-win-crt-process-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-runtime-l1-1-0.dll
    .dll 24KB
  • api-ms-win-crt-stdio-l1-1-0.dll
    .dll 24KB
  • api-ms-win-crt-string-l1-1-0.dll
    .dll 24KB
  • api-ms-win-crt-time-l1-1-0.dll
    .dll 20KB
  • api-ms-win-crt-utility-l1-1-0.dll
    .dll 20KB
  • concrt140.dll
    .dll 309KB
  • file_component.xml
    6KB
  • msvcp140.dll
    .dll 557KB
  • msvcp140_1.dll
    .dll 24KB
  • msvcp140_codecvt_ids.dll
    .dll 20KB
  • tinyxml.dll
    .dll 872KB
  • ucrtbase.dll
    .dll 1.1MB
  • vcruntime140.dll
    .dll 96KB
  • vcruntime140_1.dll
    .dll 37KB
  • x64.config
    3B
  • [3.9.11.19]/WeChatResource.dll
    .dll 34.7MB
  • [3.9.11.19]/WeChatSpt.exe
    .exe 382KB
  • [3.9.11.19]/WeChatUpdate.bin
    .zip 3.5MB
  • WeChatUpdate.exe
    .exe 2.4MB
  • dbghelp.dll
    .dll 1.0MB
  • file_component.xml
    622B
  • x86.config
    3B
  • [3.9.11.19]/WeChatUpdate.exe
    .exe 2.4MB
  • [3.9.11.19]/WeChatUtility.bin
    .zip 48.9MB
  • DeepSR_REPSR_R_M4C16_Flip_ep24.xnet
    44KB
  • OCRDetFP32.xnet.nas
    1.5MB
  • OCRRecogFP32V1.1.0.26.xnet
    7.3MB
  • QBarDetV1.1.0.26.xnet
    397KB
  • QBarSegV1.1.0.26.xnet
    219KB
  • TxBugReport.exe
    .exe 537KB
  • WeChatUtility.exe
    .exe 38.0MB
  • file_component.xml
    1KB
  • sohu_simp.txt
    24KB
  • tinyxml.dll
    .dll 872KB
  • x64.config
    3B
  • [3.9.11.19]/WeChatWin.dll
    .dll 95.7MB
  • [3.9.11.19]/WeUIResource.dll
    .dll 168KB
  • [3.9.11.19]/WechatAppLauncher.exe
    .exe 612KB
  • [3.9.11.19]/WechatCodec.exe
    .exe 7.3MB
  • [3.9.11.19]/WetypeInstaller.exe
    .exe 6.2MB
  • [3.9.11.19]/andromeda.dll
    .dll 6.9MB
  • [3.9.11.19]/cldnn_ns_16k.bin
    2.4MB
  • [3.9.11.19]/directui license.txt
    593B
  • [3.9.11.19]/duilib license.txt
    1KB
  • [3.9.11.19]/ilink2.dll
    .dll 8.9MB
  • [3.9.11.19]/libEGL.dll
    .dll 417KB
  • [3.9.11.19]/libFFmpeg.dll
    .dll 17.3MB
  • [3.9.11.19]/libGLESv2.dll
    .dll 6.0MB
  • [3.9.11.19]/libwxcodec.dll
    .dll 7.5MB
  • [3.9.11.19]/mmcrashpad_client64.dll
    .dll 1.1MB
  • [3.9.11.19]/mmcrashpad_handler64.exe
    .exe 2.1MB
  • [3.9.11.19]/mmmojo.dll
    .dll 2.0MB
  • [3.9.11.19]/mmmojo_64.dll
    .dll 2.4MB
  • [3.9.11.19]/owl.dll
    .dll 1.3MB
  • [3.9.11.19]/pagengine.dll
    .dll 7.7MB
  • [3.9.11.19]/plugin_info.ini
    120B
  • [3.9.11.19]/protobuf-lite LICENSE.txt
    1KB
  • [3.9.11.19]/rqt.dat
    .png 8KB
  • [3.9.11.19]/sae.dat
    256KB
  • [3.9.11.19]/sperqt.dat
    .png 12KB
  • [3.9.11.19]/wcprobe.dll
    .dll 6.1MB

WeChatSetup.exe

  • IMPHASH e221f4f7d36469d53810a4b5f9fc8966
  • SHA256 243f3743b7c0353104dffd185aa6d754407e7b31c3840e30fdc5ec66d7f1c11b
  • MD5 SHA1 SHA512 SSDEEP
Digest
6c:fa:5f:77:3d:28:26:09:f0:49:30:32:28:95:21:98:88:8d:4e:02:ba:d5:41:7b:dd:df:0d:1c:95:3e:ca:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Minor OS version
0
Major OS version
4
Entry point
13146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths