General

  • Target

    2485fcf6efb6e77d8a3c00e51e3b298e.bin

  • Size

    81.9MB

  • MD5

    99230f843dcee29aecb001ab8c20a6aa

  • SHA1

    72b39004e035feeee0022db1b8fc406e858c6151

  • SHA256

    a75fbdc9981ab2ca48390c38c8447c0245ff265b4a51a0dddbe2f563e6edf214

  • SHA512

    9783b362de9008761782953da06648e7a517f78d7eccab634c5ed4a42f184499df5214b6c5c844cb6b69aef472baeb24756a0a1b15c91c005c8bef04c2daf4f6

  • SSDEEP

    1572864:bUmUMfCeRXCVyqqKM762RktqKiqtTVfhMCW1ZScjXJg0NhZRooWXOdi:omUMfCeRSVnJM76uoDBBW1ZSoXJLIlX1

Score
3/10

Malware Config

Signatures

  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

Files

  • 2485fcf6efb6e77d8a3c00e51e3b298e.bin
    .zip

    Password: infected

  • 3225e0494bede3a150a89583c9a10545a4b21c304dad620e9659708b5162b730.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    b34f154ec913d2d2c435cbd644e91687


    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WinShell.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    a75c904bad153f5af2c37cfdf66eba5c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/app-64.7z
    .7z
  • LICENSE.electron.txt
  • LICENSES.chromium.html
  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    Password: infected

    36f6d7806085bd3a70ed8c5dcb51f6c8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    Password: infected

    6ed82d3226365ffafff2c57c1935d352


    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • libEGL.dll
    .dll windows:5 windows x64 arch:x64

    abb71fd922a5b9384920738f22362738


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    5072e294a7ed6cbb594519a4e43461d4


    Headers

    Imports

    Exports

    Sections

  • locales/am.pak
  • locales/ar.pak
  • locales/bg.pak
  • locales/bn.pak
  • locales/ca.pak
  • locales/cs.pak
  • locales/da.pak
  • locales/de.pak
  • locales/el.pak
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/es-419.pak
  • locales/es.pak
  • locales/et.pak
  • locales/fa.pak
  • locales/fi.pak
  • locales/fil.pak
  • locales/fr.pak
  • locales/gu.pak
  • locales/he.pak
  • locales/hi.pak
  • locales/hr.pak
  • locales/hu.pak
  • locales/id.pak
  • locales/it.pak
  • locales/ja.pak
  • locales/kn.pak
  • locales/ko.pak
  • locales/lt.pak
  • locales/lv.pak
  • locales/ml.pak
  • locales/mr.pak
  • locales/ms.pak
  • locales/nb.pak
  • locales/nl.pak
  • locales/pl.pak
  • locales/pt-BR.pak
  • locales/pt-PT.pak
  • locales/ro.pak
  • locales/ru.pak
  • locales/sk.pak
  • locales/sl.pak
  • locales/sr.pak
  • locales/sv.pak
  • locales/sw.pak
  • locales/ta.pak
  • locales/te.pak
  • locales/th.pak
  • locales/tr.pak
  • locales/uk.pak
  • locales/vi.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • resources.pak
  • resources/app.asar
  • resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Headers

    Imports

    Sections

  • resources/static/files/default/Country.mmdb
  • resources/static/files/win/common/EnableLoopback.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • resources/static/files/win/common/sysproxy.exe
    .exe windows:6 windows x86 arch:x86

    5f196900fae78a500f50ce95bb3b9a27


    Headers

    Imports

    Sections

  • resources/static/files/win/x64/clash-win64.exe
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • resources/static/files/win/x64/service/._clash-core-service.exe
  • resources/static/files/win/x64/service/clash-core-service.exe
    .exe windows:6 windows x64 arch:x64

    ff9f3a86709796c17211f9df12aae74d


    Headers

    Imports

    Sections

  • resources/static/files/win/x64/service/service.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • resources/static/files/win/x64/wintun.dll
    .dll windows:6 windows x64 arch:x64

    01ce5951b7d0dcca222159a28511a055


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/static/flags/un.png
    .png
  • resources/static/flags/中国.png
    .png
  • resources/static/flags/中非共和国.png
    .png
  • resources/static/flags/丹麦.png
    .png
  • resources/static/flags/乌克兰.png
    .png
  • resources/static/flags/乌兹别克斯坦.png
    .png
  • resources/static/flags/乌干达.png
    .png
  • resources/static/flags/乌拉圭.png
    .png
  • resources/static/flags/也门.png
    .png
  • resources/static/flags/以色列.png
    .png
  • resources/static/flags/伊拉克.png
    .png
  • resources/static/flags/伊朗.png
    .png
  • resources/static/flags/俄罗斯.png
    .png
  • resources/static/flags/保加利亚.png
    .png
  • resources/static/flags/关岛.png
    .png
  • resources/static/flags/冈比亚.png
    .png
  • resources/static/flags/冰岛.png
    .png
  • resources/static/flags/几内亚.png
    .png
  • resources/static/flags/刚果.png
    .png
  • resources/static/flags/利比亚.png
    .png
  • resources/static/flags/利比里亚.png
    .png
  • resources/static/flags/加拿大.png
    .png
  • resources/static/flags/加纳.png
    .png
  • resources/static/flags/匈牙利.png
    .png
  • resources/static/flags/南非.png
    .png
  • resources/static/flags/卡塔尔.png
    .png
  • resources/static/flags/卢森堡.png
    .png
  • resources/static/flags/印度.png
    .png
  • resources/static/flags/印度尼西亚.png
    .png
  • resources/static/flags/厄瓜多尔.png
    .png
  • resources/static/flags/叙利亚.png
    .png
  • resources/static/flags/古巴.png
    .png
  • resources/static/flags/台湾.png
    .png
  • resources/static/flags/吉尔吉斯坦.png
    .png
  • resources/static/flags/吉布提.png
    .png
  • resources/static/flags/哈萨克斯坦.png
    .png
  • resources/static/flags/哥伦比亚.png
    .png
  • resources/static/flags/哥斯达黎加.png
    .png
  • resources/static/flags/喀麦隆.png
    .png
  • resources/static/flags/土库曼斯坦.png
    .png
  • resources/static/flags/土耳其.png
    .png
  • resources/static/flags/圭亚那.png
    .png
  • resources/static/flags/坦桑尼亚.png
    .png
  • resources/static/flags/埃及.png
    .png
  • resources/static/flags/塔吉克斯坦.png
    .png
  • resources/static/flags/塞内加尔.png
    .png
  • resources/static/flags/塞拉利昂.png
    .png
  • resources/static/flags/塞舌尔.png
    .png
  • resources/static/flags/墨西哥.png
    .png
  • resources/static/flags/多哥.png
    .png
  • resources/static/flags/多米尼加共和国.png
    .png
  • resources/static/flags/奥地利.png
    .png
  • resources/static/flags/委内瑞拉.png
    .png
  • resources/static/flags/孟加拉国.png
    .png
  • resources/static/flags/安哥拉.png
    .png
  • resources/static/flags/安圭拉岛.png
    .png
  • resources/static/flags/尼日利亚.png
    .png
  • resources/static/flags/尼泊尔.png
    .png
  • resources/static/flags/巴哈马.png
    .png
  • resources/static/flags/巴基斯坦.png
    .png
  • resources/static/flags/巴巴多斯.png
    .png
  • resources/static/flags/巴拉圭.png
    .png
  • resources/static/flags/巴拿马.png
    .png
  • resources/static/flags/巴林.png
    .png
  • resources/static/flags/巴西.png
    .png
  • resources/static/flags/希腊.png
    .png
  • resources/static/flags/库克群岛.png
    .png
  • resources/static/flags/德国.png
    .png
  • resources/static/flags/意大利.png
    .png
  • resources/static/flags/所罗门群岛.png
    .png
  • resources/static/flags/挪威.png
    .png
  • resources/static/flags/捷克.png
    .png
  • resources/static/flags/摩尔多瓦.png
    .png
  • resources/static/flags/摩洛哥.png
    .png
  • resources/static/flags/摩纳哥.png
    .png
  • resources/static/flags/文莱.png
    .png
  • resources/static/flags/斐济.png
    .png
  • resources/static/flags/斯洛伐克.png
    .png
  • resources/static/flags/新加坡.png
    .png
  • resources/static/flags/新西兰.png
    .png
  • resources/static/flags/日本.png
    .png
  • resources/static/flags/智利.png
    .png
  • resources/static/flags/朝鲜.png
    .png
  • resources/static/flags/柬埔寨.png
    .png
  • resources/static/flags/格鲁吉亚.png
    .png
  • resources/static/flags/比利时.png
    .png
  • resources/static/flags/毛里求斯.png
    .png
  • resources/static/flags/沙特阿拉伯.png
    .png
  • resources/static/flags/法国.png
    .png
  • resources/static/flags/法属圭亚那.png
    .png
  • resources/static/flags/波兰.png
    .png
  • resources/static/flags/泰国.png
    .png
  • resources/static/flags/津巴布韦.png
    .png
  • resources/static/flags/洪都拉斯.png
    .png
  • resources/static/flags/海地.png
    .png
  • resources/static/flags/澳大利亚.png
    .png
  • resources/static/flags/澳门.png
    .png
  • resources/static/flags/爱尔兰.png
    .png
  • resources/static/flags/爱沙尼亚.png
    .png
  • resources/static/flags/牙买加.png
    .png
  • resources/static/flags/玻利维亚.png
    .png
  • resources/static/flags/瑙鲁.png
    .png
  • resources/static/flags/瑞典.png
    .png
  • resources/static/flags/瑞士.png
    .png
  • resources/static/flags/白俄罗斯.png
    .png
  • resources/static/flags/百慕大群岛.png
    .png
  • resources/static/flags/科威特.png
    .png
  • resources/static/flags/秘鲁.png
    .png
  • resources/static/flags/突尼斯.png
    .png
  • resources/static/flags/立陶宛.png
    .png
  • resources/static/flags/索马里.png
    .png
  • resources/static/flags/纳米比亚.png
    .png
  • resources/static/flags/罗马尼亚.png
    .png
  • resources/static/flags/美国.png
    .png
  • resources/static/flags/老挝.png
    .png
  • resources/static/flags/肯尼亚.png
    .png
  • resources/static/flags/芬兰.png
    .png
  • resources/static/flags/苏丹.png
    .png
  • resources/static/flags/苏里南.png
    .png
  • resources/static/flags/英国.png
    .png
  • resources/static/flags/荷兰.png
    .png
  • resources/static/flags/莫桑比克.png
    .png
  • resources/static/flags/菲律宾.png
    .png
  • resources/static/flags/萨尔瓦多.png
    .png
  • resources/static/flags/葡萄牙.png
    .png
  • resources/static/flags/蒙古.png
    .png
  • resources/static/flags/西班牙.png
    .png
  • resources/static/flags/赞比亚.png
    .png
  • resources/static/flags/越南.png
    .png
  • resources/static/flags/阿塞拜疆.png
    .png
  • resources/static/flags/阿富汗.png
    .png
  • resources/static/flags/阿尔及利亚.png
    .png
  • resources/static/flags/阿拉伯联合酋长国.png
    .png
  • resources/static/flags/阿曼.png
    .png
  • resources/static/flags/阿根廷.png
    .png
  • resources/static/flags/韩国.png
    .png
  • resources/static/flags/香港.png
    .png
  • resources/static/flags/马尔代夫.png
    .png
  • resources/static/flags/马来西亚.png
    .png
  • resources/static/flags/马耳他.png
    .png
  • resources/static/flags/马达加斯加.png
    .png
  • resources/static/flags/马里.png
    .png
  • resources/static/flags/黎巴嫩.png
    .png
  • snapshot_blob.bin
  • swiftshader/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    67db432914b7baa0738050364c019173


    Headers

    Imports

    Exports

    Sections

  • swiftshader/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    8b4ec8564c21d6087c06b61d3d5ffbbd


    Headers

    Imports

    Exports

    Sections

  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    4228c2edd8350bcc256d907abf9c03ec


    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    00a11204bd7ac096090b7bdfc42df6d6


    Headers

    Imports

    Exports

    Sections

  • 圆梦云加速器.exe
    .exe windows:5 windows x64 arch:x64

    bc5e8bf0e785e7db06f6245bec05e3de


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d31c5eb927119d00232e4d4b0e32fcdb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    2656ea25cde98f31a490513c2db04ae8


    Headers

    Imports

    Exports

    Sections

  • $R0/Uninstall 圆梦云加速器.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Headers

    Imports

    Sections