General

  • Target

    f8a5d77ad0d658d37d3949db60314c6ee7d3c5f46ea20f238cac76a8e24de53a

  • Size

    6.1MB

  • MD5

    34c9f46882ea933a5bd092a43e2a127b

  • SHA1

    26d2e647399115015217c14859fca13216d780d7

  • SHA256

    f8a5d77ad0d658d37d3949db60314c6ee7d3c5f46ea20f238cac76a8e24de53a

  • SHA512

    97101a3a8e0622f85d285a75e3416ba16f00367c49c7dd3bd79c386934115c49cd863bed6e71e244d6af7669ad92ac753c23a1e2ed3eece551e19c37b9719feb

  • SSDEEP

    196608:gCZe4e09W0LL/StD9j9wN8BQbwDD4aa1xr103Bd:LZw0gYyD9j9MgQMDD4agN103j

Score
3/10

Malware Config

Signatures

  • Unsigned PE 35 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • f8a5d77ad0d658d37d3949db60314c6ee7d3c5f46ea20f238cac76a8e24de53a
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcirt.dll
    .dll windows:5 windows x86 arch:x86

    bf152c50ea35e44b4cbf1a8f2c4055cb


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp60.dll
    .dll windows:4 windows x86 arch:x86

    c428a646f4c250be02cf420ab15d34b4


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/NSISHelper.dll
    .dll windows:5 windows x86 arch:x86

    8bba1b97c8000d746758d1d280beca6c


    Headers

    Imports

    Exports

    Sections

  • AyuConfig.exe
    .exe windows:4 windows x86 arch:x86

    19f5a27cbf1c6c17de3d1816e6c5d3e2


    Headers

    Imports

    Sections

  • ComDlls/BHOInstall.exe
    .exe windows:4 windows x86 arch:x86

    1f137be9a1e4c115c72e64ed2fb834e6


    Code Sign

    Headers

    Imports

    Sections

  • ComDlls/FirefoxPatch.exe
    .exe windows:4 windows x86 arch:x86

    3de6766df67e7f95850d55746644b7fc


    Code Sign

    Headers

    Imports

    Sections

  • ComDlls/FirefoxPatch/chrome.manifest
  • ComDlls/FirefoxPatch/chrome/thunder.jar
    .zip
  • content/contents.rdf
    .xml
  • content/download.gif
    .gif
  • content/download.js
    .js
  • content/downloadall.gif
    .gif
  • content/icon.bmp
  • content/main.js
    .js
  • content/main.xul
  • content/menu.css
  • content/product.js
    .js
  • content/public.js
    .js
  • locale/en-US/contents.rdf
    .xml
  • locale/en-US/thunder.dtd
  • locale/zh-CN/contents.rdf
    .xml
  • locale/zh-CN/thunder.dtd
  • ComDlls/FirefoxPatch/components/ThunderComponent.dll
    .dll windows:4 windows x86 arch:x86

    613fa8ea77492ae7e36694dfd1dfe8b8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/FirefoxPatch/install.rdf
    .xml
  • ComDlls/ThunderAgent.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    92a0fe00d6aaf425d01d972d868ec3b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/ThunderAgent7.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8b5cfe88925cf654b9f916f41f98b34c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/UriX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fd3088ae7b8dce6625ebd8297398f94c


    Headers

    Imports

    Exports

    Sections

  • ComDlls/XLNonIESvr.exe
    .exe windows:4 windows x86 arch:x86

    1f137be9a1e4c115c72e64ed2fb834e6


    Code Sign

    Headers

    Imports

    Sections

  • ComDlls/XunLeiBHO.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    e8ec7fefe8197449b14775289cf9076b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/getAllurl.htm
    .html .vbs polyglot
  • ComDlls/geturl.htm
    .html .js polyglot
  • ComDlls/image/waiting/001.bmp
  • ComDlls/image/waiting/002.bmp
  • ComDlls/image/waiting/003.bmp
  • ComDlls/image/waiting/004.bmp
  • ComDlls/image/waiting/005.bmp
  • ComDlls/image/waiting/007.bmp
  • ComDlls/libexpat.dll
    .dll windows:4 windows x86 arch:x86

    16adaa296932ee15ea6dacef0485a6a3


    Headers

    Imports

    Exports

    Sections

  • ComDlls/npxunlei.dll
    .dll windows:4 windows x86 arch:x86

    9290dca8117c7c3c34f238e585fb7a40


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/thunder.xpi
    .zip
  • chrome.manifest
  • chrome/thunder.jar
    .zip
  • content/contents.rdf
    .xml
  • content/download.gif
    .gif
  • content/download.js
    .js
  • content/downloadall.gif
    .gif
  • content/icon.bmp
  • content/main.js
    .js
  • content/main.xul
  • content/menu.css
  • content/product.js
    .js
  • content/public.js
    .js
  • locale/en-US/contents.rdf
    .xml
  • locale/en-US/thunder.dtd
  • locale/zh-CN/contents.rdf
    .xml
  • locale/zh-CN/thunder.dtd
  • components/ThunderComponent.dll
    .dll windows:4 windows x86 arch:x86

    613fa8ea77492ae7e36694dfd1dfe8b8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • install.rdf
    .xml
  • ComDlls/xl_plugin_chrome.crx
    .zip
  • _locales/zh_CN/messages.json
  • _locales/zh_TW/messages.json
  • background.html
  • background.js
    .js
  • images/extension_logo.png
    .png
  • images/install_logo.png
    .png
  • images/menu_logo.png
    .png
  • js/xl.js
    .js
  • manifest.json
  • xl_chrome.dll
    .dll windows:4 windows x86 arch:x86

    a504d050ba27c706e2db8734e53c47a6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/xl_plugin_chrome_17.crx
    .zip
  • _locales/zh_CN/messages.json
  • _locales/zh_TW/messages.json
  • background.html
    .js
  • images/extension_logo.png
    .png
  • images/install_logo.png
    .png
  • images/menu_logo.png
    .png
  • js/xl.js
    .js
  • manifest.json
  • xl_chrome.dll
    .dll windows:4 windows x86 arch:x86

    a504d050ba27c706e2db8734e53c47a6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ComDlls/xl_plugin_chrome_5.crx
    .zip
  • _locales/zh_CN/messages.json
  • _locales/zh_TW/messages.json
  • background.html
    .js
  • images/extension_logo.png
    .png
  • images/install_logo.png
    .png
  • js/xl.js
    .js
  • manifest.json
  • xl_chrome.dll
    .dll windows:4 windows x86 arch:x86

    a504d050ba27c706e2db8734e53c47a6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Components/Community/CommunityProgramConfig.txt
  • Components/Community/VipResource.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Components/Community/XLBlog.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cacb39b275a508b4e99f80939b56a450


    Headers

    Imports

    Exports

    Sections

  • Components/Community/XLCP.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ecdf5bb44c841f289418786771110e33


    Headers

    Imports

    Exports

    Sections

  • Components/Community/XLCP_PLUGIN.xml
  • Components/Community/XLCommunity.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    e7f10044d631db8a550842b9947484dd


    Headers

    Imports

    Exports

    Sections

  • Components/Community/XLUser.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    da59fea294beef0eb0094cfd39c01d15


    Headers

    Imports

    Exports

    Sections

  • Components/Community/local/404.html
    .html
  • Components/Community/local/css/css.css
  • Components/Community/local/default.html
    .html
  • Components/Community/local/img/404.png
    .png
  • Components/Community/local/img/background.jpg
    .jpg
  • Components/Community/local/img/dot.gif
    .gif
  • Components/Community/local/img/lbg.gif
    .gif
  • Components/Community/local/img/loading.gif
    .gif
  • Components/Community/local/img/mini_bg.png
    .png
  • Components/Community/local/img/rbg.gif
    .gif
  • Components/Community/local/loading.html
    .html
  • Components/Community/publish.htm
    .html .js polyglot
  • Languages/zh_cn/Community.ini
  • Languages/zh_cn/Community.xml
    .xml
  • Languages/zh_cn/Connection.ini
  • Languages/zh_cn/FloatBar1.bmp
  • Languages/zh_cn/FloatBar2.bmp
  • Languages/zh_cn/FloatBar3.bmp
  • Languages/zh_cn/FtpGlance.ini
  • Languages/zh_cn/GouGouTop.ini
  • Languages/zh_cn/InMedia.ini
  • Languages/zh_cn/Language.ini
  • Languages/zh_cn/LiveUpdate.ini
  • Languages/zh_cn/NetGame.ini
  • Languages/zh_cn/P4PClient.ini
  • Languages/zh_cn/Thunder.ini
  • Languages/zh_cn/XLSearch.ini
  • Languages/zh_cn/dynamichelp.xml
    .xml
  • Languages/zh_cn/vipcommunity.xml
  • Languages/zh_tw/Community.ini
  • Languages/zh_tw/Community.xml
    .xml
  • Languages/zh_tw/Connection.ini
  • Languages/zh_tw/FloatBar1.bmp
  • Languages/zh_tw/FloatBar2.bmp
  • Languages/zh_tw/FloatBar3.bmp
  • Languages/zh_tw/FtpGlance.ini
  • Languages/zh_tw/GouGouTop.ini
  • Languages/zh_tw/InMedia.ini
  • Languages/zh_tw/Language.INI
  • Languages/zh_tw/LiveUpdate.ini
  • Languages/zh_tw/NetGame.ini
  • Languages/zh_tw/P4PClient.ini
  • Languages/zh_tw/Thunder.ini
  • Languages/zh_tw/XLSearch.ini
  • Languages/zh_tw/dynamichelp.xml
    .xml
  • Languages/zh_tw/vipcommunity.xml
  • Profiles/AyuConfig.ini
  • Profiles/UserConfig.ini
  • Program/BHOStub.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6bacd70cc0a66e41e4985b3324bf10e3


    Headers

    Imports

    Exports

    Sections

  • Program/BugReport.dll
    .dll windows:4 windows x86 arch:x86

    f139ffab97585ec0d0f1c93750c2f2fb


    Headers

    Imports

    Exports

    Sections

  • Program/BugReport.exe
    .exe windows:4 windows x86 arch:x86

    7fc56897586cc418869b1b5dda0ba1dd


    Code Sign

    Headers

    Imports

    Sections

  • Program/FloatBar.dll
    .dll windows:4 windows x86 arch:x86

    1a9f9416e8c41b9c2595ebe96dc61782


    Headers

    Imports

    Exports

    Sections

  • Program/FtpExplorer.exe
    .exe windows:4 windows x86 arch:x86

    9fb200a815276748a11b0bc50fbbfa6d


    Code Sign

    Headers

    Imports

    Sections

  • Program/LanguageSetter.exe
    .exe windows:4 windows x86 arch:x86

    22d6c73b090c314bb850d30243f48134


    Headers

    Imports

    Sections

  • Program/MagnetEx.exe
    .exe windows:5 windows x86 arch:x86

    e7f865fadd058c9331e98e4e06695eb1


    Headers

    Imports

    Sections

  • Program/RegLicense.txt
  • Program/RegLicenseE.txt
  • Program/RegisterDll.dll
    .dll windows:4 windows x86 arch:x86

    206297af3ee4c4b103d86bc06c874a10


    Headers

    Imports

    Exports

    Sections

  • Program/SCID.dat
  • Program/SpecialSite.ini
  • Program/TaskManager.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    08a37334cb0de48fc10a4b1858ea0c71


    Headers

    Imports

    Exports

    Sections

  • Program/Thunder5.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Program/ThunderEx.dll
    .dll windows:4 windows x86 arch:x86

    c1116a1ec001f56f5aab34fd11f39ec9


    Headers

    Imports

    Exports

    Sections

  • Program/ThunderPlatform.exe
    .exe windows:4 windows x86 arch:x86

    836334145ff47a5355d586c00cceb6a2


    Code Sign

    Headers

    Imports

    Sections

  • Program/Thunder_cfg.ini
  • Program/UACTool.dll
    .dll windows:4 windows x86 arch:x86

    80602813e88379342331b281ba0235f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/Whatsnew.txt
  • Program/XLBugHandler.dll
    .dll windows:4 windows x86 arch:x86

    647d79641084bbef269ca8f1c4281ceb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/XLBugReport.exe
    .exe windows:4 windows x86 arch:x86

    f1d0dbe0b960f31a14c845963640bdae


    Code Sign

    Headers

    Imports

    Sections

  • Program/XLCrypto.dll
    .dll windows:4 windows x86 arch:x86

    4a01333d1673a520341f5d0fb358b573


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/al.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3af84108801d67c65ff06de02aa2097a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/asyn_frame.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5c6891d83c42ea9ef200bb7cdb27601b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • Program/backend_agent.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fab533503233133c78808b703395ef39


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/bt_kernel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fa94285f88783f0ac703907d557e6f9b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/bt_shell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8d6b43e73d147c6c366c125e7e12e64b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/bt_shell.ini
  • Program/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2827932cca8caf8a10f65e148687b7a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/dl_uac_tool.dll
    .dll windows:4 windows x86 arch:x86

    27d1a01b7249657f88ae724fdb9e000a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/down_dispatcher.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    40a0269a8d29590eb7434def6dc37d14


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/download_engine.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ae5b87eb2a62b085d04ef8e93c40fead


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/download_interface.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4099353a23d4ce2ad2c8ec20084f22af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/download_interface_new.dll
    .dll windows:4 windows x86 arch:x86

    e235a4d031e16ec13fea372759057626


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/emule_kernel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4c42bc3b18db34d254a1882a3e9ae50d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/emule_shell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f0ef6d76ae0e766940c674840055a834


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/emule_shell.ini
  • Program/fs.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8da6fa7185bb08c2e73982273c79dce0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/libexpat.dll
    .dll windows:4 windows x86 arch:x86

    16adaa296932ee15ea6dacef0485a6a3


    Headers

    Imports

    Exports

    Sections

  • Program/media_data.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    784ee7cb2f1455f3e53ee9b3837acbe2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/mini_unzip_dll.dll
    .dll windows:4 windows x86 arch:x86

    75dd547330e8f24ff6ed8a3e6e7a5efc


    Headers

    Imports

    Exports

    Sections

  • Program/minizip.dll
    .dll windows:4 windows x86 arch:x86

    9c862a2747086ed03721c3c4ea849b10


    Headers

    Imports

    Exports

    Sections

  • Program/mp.dll
    .dll windows:4 windows x86 arch:x86

    5eb73d86204ca34865ffbbadc69bd66a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/msvcirt.dll
    .dll windows:5 windows x86 arch:x86

    bf152c50ea35e44b4cbf1a8f2c4055cb


    Headers

    Imports

    Exports

    Sections

  • Program/msvcp60.dll
    .dll windows:4 windows x86 arch:x86

    c428a646f4c250be02cf420ab15d34b4


    Headers

    Imports

    Exports

    Sections

  • Program/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • Program/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • Program/p2p.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0abe1205d84c2ae77a69aa111f2ab226


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/p2p_local_res.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    26590f09bf2ee0bd3145fade62976092


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/p2p_upload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    153b3cfc562a062647340cd50b666cd1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/p2sp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b4798260ec6f0c157ca41a537137cc7d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/ptl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ea96bf129494c1b2a27a541b8a4afc62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/stream.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5d1e7c8ab88602ec8ffb6c2775f90f6a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/tp_proxy.dll
    .dll windows:4 windows x86 arch:x86

    ba7f4e67e8757da1f0a83cced8c7f557


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/ts.dll
    .dll windows:4 windows x86 arch:x86

    8dee92151fc27b6d2df0740764c57178


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/udt.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    af10a3975b9274872cbae434f59ea900


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/upnp.exe
    .exe windows:4 windows x86 arch:x86

    75cfe3ad857c17f0b51c6076988bab31


    Code Sign

    Headers

    Imports

    Sections

  • Program/xl_client.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c9d4daaf3ed5b24c3f2514f28a2fd9be


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/xl_data.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    7bac82b95dd657a8c1391013d7867044


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Program/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Headers

    Imports

    Exports

    Sections

  • TSearch.exe
    .exe windows:5 windows x86 arch:x86

    91d0d8864c6a4412aad40ffff09132d6


    Headers

    Imports

    Sections

  • Thunder.exe
    .exe windows:4 windows x86 arch:x86

    54d02f7794be67367010a712f11f0300


    Code Sign

    Headers

    Imports

    Sections