General

  • Target

    wechat.zip

  • Size

    270.3MB

  • MD5

    07ee249681798ace54bf1fc2b650956d

  • SHA1

    1194dfc76e79c0d306ec373a7436e72b749d5676

  • SHA256

    fd546b36104ef4fd3a089bad1a91c0ec89abe71de6b79b46c1af085abcb4e32f

  • SHA512

    3fe2476b61a7e5a904e2c47299c8eb5be2e00d33e6c2614367f14fbbe2728674961d34709f7af26367cffccaf928c12e1c7c7e9c1636c4a80c5f6b455a436b9b

  • SSDEEP

    6291456:topQ9AE2jnxyMdP0oURgLk7wX5SSJTKCgLUlOjdj0a3C4sDYFj:GpW2jx3P0RU3Xk7CTlOjJtsDC

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • wechat.zip
    .zip

    Password: infected

  • 04a668ea0d36cd8963acc2b9c0f0aff0c0a7c73f46127863ea1f90e942664171
    .exe windows:4 windows x86 arch:x86

    Password: infected

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    5ebb000a52998bb996312557ab4e30f5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    473a3a11d05364cd31aaa8cf3e6b4e86


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsInstallAssist.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    98bd347be99c6ea9d34c4596ddd7ed77


    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    5ebb000a52998bb996312557ab4e30f5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WeChatInstallDll.dll
    .dll windows:6 windows x86 arch:x86

    5995151564a62f9c309819723f006513


    Headers

    Imports

    Exports

    Sections

  • WeChat.exe
    .exe windows:6 windows x64 arch:x64

    a68203879d867040380668ec7a879e5c


    Code Sign

    Headers

    Imports

    Sections

  • WechatAppLauncher.exe
    .exe windows:5 windows x86 arch:x86

    373e31b0791057247a341163861d6fe2


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/ConfSdk.dll
    .dll windows:6 windows x64 arch:x64

    7b38250c5cabfd0f887d43dabc713461


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/RadiumWMPF.bin
    .zip
  • [3.9.11.25]/SDL License.txt
  • [3.9.11.25]/SPEEX LICENSE.txt
  • [3.9.11.25]/SQLCipher LICENSE.txt
  • [3.9.11.25]/Skia LICENSE.txt
  • [3.9.11.25]/ThumbPlayer.bin
    .zip
  • [3.9.11.25]/Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    e221f4f7d36469d53810a4b5f9fc8966


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/VoipEngine.dll
    .dll windows:6 windows x64 arch:x64

    b1764933ac74d0e6f29c291f25dd98c6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/WeChat.exe
    .exe windows:6 windows x64 arch:x64

    a68203879d867040380668ec7a879e5c


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/WeChatExt.exe
    .exe windows:5 windows x86 arch:x86

    17de35bd7cf43148433d7f0082ed6b61


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/WeChatOCR.bin
    .zip
  • [3.9.11.25]/WeChatResource.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • [3.9.11.25]/WeChatSpt.exe
    .exe windows:6 windows x64 arch:x64

    38d9a6485a5894cf8e8ce314dc9255be


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/WeChatUpdate.bin
    .zip
  • [3.9.11.25]/WeChatUpdate.exe
    .exe windows:6 windows x86 arch:x86

    fcb7832b325a76914e1d1ba6d1c28afc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/WeChatUtility.bin
    .zip
  • [3.9.11.25]/WeChatWin.dll
    .dll windows:6 windows x64 arch:x64

    14d83a8d8356ffbf1f76ef70c57615b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/WeUIResource.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • [3.9.11.25]/WechatAppLauncher.exe
    .exe windows:5 windows x86 arch:x86

    373e31b0791057247a341163861d6fe2


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/WechatCodec.exe
    .exe windows:6 windows x64 arch:x64

    0a23d8ef83bde42d9de27c20b558a673


    Code Sign

    Headers

    Imports

    Sections

  • [3.9.11.25]/WetypeInstaller.exe
    .exe windows:6 windows x64 arch:x64

    7a00c2529869d8bc5993444f150e9989


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/andromeda.dll
    .dll windows:6 windows x64 arch:x64

    3e31527385d53dc75970eaf7f4c75d9d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/cldnn_ns_16k.bin
  • [3.9.11.25]/directui license.txt
  • [3.9.11.25]/duilib license.txt
  • [3.9.11.25]/ilink2.dll
    .dll windows:6 windows x64 arch:x64

    96da7f837626a5b4e9c36b3026de3e70


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    403d8cc0d31f841d5bbf6b82c1ea957d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/libFFmpeg.dll
    .dll windows:6 windows x64 arch:x64

    20cb46b345a7c23ccb87756db4f44a21


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    d899245aed11af82d1f638c3132629cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/libwxcodec.dll
    .dll windows:6 windows x64 arch:x64

    86a6d41934525ea53da4f7e658fac908


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/mmcrashpad_client64.dll
    .dll windows:5 windows x64 arch:x64

    cdf2c53f936eaa12c8f98943fa69b6d7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/mmcrashpad_handler64.exe
    .exe windows:5 windows x64 arch:x64

    409cc11024427e9ccc23f4a6c70bd297


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/mmmojo.dll
    .dll windows:5 windows x86 arch:x86

    2382b373f5946e01b6074f6002346d72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/mmmojo_64.dll
    .dll windows:5 windows x64 arch:x64

    01ae9b0bd2188b2447de6df79374af05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/owl.dll
    .dll windows:6 windows x64 arch:x64

    c6b668386def86c992ef294d7df33e44


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/pagengine.dll
    .dll windows:6 windows x64 arch:x64

    8fee130e31cd360e9470c96e57c8cab1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • [3.9.11.25]/plugin_info.ini
  • [3.9.11.25]/protobuf-lite LICENSE.txt
  • [3.9.11.25]/rqt.dat
    .png
  • [3.9.11.25]/sae.dat
  • [3.9.11.25]/sperqt.dat
    .png
  • [3.9.11.25]/wcprobe.dll
    .dll windows:6 windows x64 arch:x64

    36984f0206a7b75ab485e2258d3b2d1d


    Code Sign

    Headers

    Imports

    Sections