Resubmissions

27/11/2024, 20:39

241127-zfpdtszjes6

27/11/2024, 20:33

241127-zbwbksvqhl6

26/11/2024, 16:40

241126-t6j9xawkbk

25/11/2024, 22:14

241125-15w1mswlcp6

25/11/2024, 20:57

241125-zryrmswke16

25/11/2024, 20:51

241125-znc1rsvrgv

28/09/2024, 18:21

240928-wzje5ssdlc10

General

  • Target
    Terabox_1.32.0.1.exe
  • Size 85.5MB
  • Sample241126-t6j9xawkbk
  • SHA256 9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10

Malware Config

Signatures

  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Terabox_1.32.0.1.exe
    .exe 85.5MB
  • $PLUGINSDIR/NsisInstallUI.dll
    .dll 1.8MB
  • $PLUGINSDIR/SetupCfg.ini
    75B
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/VersionInfo.xml
    .xml 90B
  • $PLUGINSDIR/nsProcessW.dll
    .dll 4KB
  • $TEMP/kernel.dll
    .dll 7.5MB
  • AppProperty.xml
    50B
  • AppUtil.dll
    .dll 1.5MB
  • AutoUpdate/AutoUpdateUtil.dll
    .dll 198KB
  • AutoUpdate/Autoupdate.exe
    .exe 2.8MB
  • AutoUpdate/VersionInfo.xml
    .xml 91B
  • AutoUpdate/config.ini
    52B
  • BugReport.exe
    .exe 1.4MB
  • Bull140U.dll
    .dll 3.2MB
  • CEF license.txt
    1KB
  • ChromeManifest.json
    237B
  • ChromeNativeMessagingHost.exe
    .exe 126KB
  • DuiEngine license.txt
    1KB
  • HelpUtility.exe
    .exe 148KB
  • TeraBox.exe
    .exe 6.3MB
  • TeraBoxHost.exe
    .exe 379KB
  • TeraBoxRender.exe
    .exe 737KB
  • TeraBoxTorrentFile.ico
    67KB
  • TeraBoxWebService.exe
    .exe 1.1MB
  • VersionInfo
    192B
  • VersionInfo2
    192B
  • YunDb.dll
    .dll 777KB
  • YunDls.dll
    .dll 2.1MB
  • YunLogic.dll
    .dll 6.3MB
  • YunOfficeAddin.dll
    .dll 378KB
  • YunOfficeAddin64.dll
    .dll 491KB
  • YunShellExt.dll
    .dll 783KB
  • YunShellExt64.dll
    .dll 1011KB
  • YunUtilityService.exe
    .exe 111KB
  • api-ms-win-core-console-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-datetime-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-debug-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-errorhandling-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-file-l1-1-0.dll
    .dll 14KB
  • api-ms-win-core-file-l1-2-0.dll
    .dll 11KB
  • api-ms-win-core-file-l2-1-0.dll
    .dll 11KB
  • api-ms-win-core-handle-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-heap-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-interlocked-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-libraryloader-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-localization-l1-2-0.dll
    .dll 13KB
  • api-ms-win-core-memory-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-namedpipe-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-processenvironment-l1-1-0.dll
    .dll 12KB
  • api-ms-win-core-processthreads-l1-1-0.dll
    .dll 13KB
  • api-ms-win-core-processthreads-l1-1-1.dll
    .dll 11KB
  • api-ms-win-core-profile-l1-1-0.dll
    .dll 10KB
  • api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 10KB
  • api-ms-win-core-string-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-synch-l1-1-0.dll
    .dll 13KB
  • api-ms-win-core-synch-l1-2-0.dll
    .dll 11KB
  • api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 12KB
  • api-ms-win-core-timezone-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-util-l1-1-0.dll
    .dll 11KB
  • api-ms-win-crt-conio-l1-1-0.dll
    .dll 12KB
  • api-ms-win-crt-convert-l1-1-0.dll
    .dll 15KB
  • api-ms-win-crt-environment-l1-1-0.dll
    .dll 11KB
  • api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 13KB
  • api-ms-win-crt-heap-l1-1-0.dll
    .dll 12KB
  • api-ms-win-crt-locale-l1-1-0.dll
    .dll 11KB
  • api-ms-win-crt-math-l1-1-0.dll
    .dll 21KB
  • api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 19KB
  • api-ms-win-crt-private-l1-1-0.dll
    .dll 62KB
  • api-ms-win-crt-process-l1-1-0.dll
    .dll 12KB
  • api-ms-win-crt-runtime-l1-1-0.dll
    .dll 15KB
  • api-ms-win-crt-stdio-l1-1-0.dll
    .dll 17KB
  • api-ms-win-crt-string-l1-1-0.dll
    .dll 17KB
  • api-ms-win-crt-time-l1-1-0.dll
    .dll 13KB
  • api-ms-win-crt-utility-l1-1-0.dll
    .dll 11KB
  • autobackup.ico
    36KB
  • browserres/cef.pak
    1.9MB
  • browserres/cef_100_percent.pak
    200KB
  • browserres/cef_200_percent.pak
    274KB
  • browserres/cef_extensions.pak
    1.2MB
  • browserres/devtools_resources.pak
    1.7MB
  • browserres/locales/en-US.pak
    233KB
  • browserres/locales/zh-CN.pak
    236KB
  • cacert.pem
    205KB
  • cefbrowser.dll
    .dll 415KB
  • chrome_elf.dll
    .dll 845KB
  • concrt140.dll
    .dll 237KB
  • d3dcompiler_47.dll
    .dll 3.5MB
  • icudtl.dat
    10.0MB
  • kernel.dll
    .dll 7.5MB
  • kernelUpdate.exe
    .exe 2.4MB
  • libEGL.dll
    .dll 338KB
  • libGLESv2.dll
    .dll 5.2MB
  • libcef.dll
    .dll 113.1MB
  • minosagent.dll
    .dll 2.9MB
  • module/TeraBoxModuleList.db
    16KB
  • module/VastPlayer/VastPlayer.dll
    .dll 15.3MB
  • module/VastPlayer/d3dx9_43.dll
    .dll 1.9MB
  • msvcp140.dll
    .dll 429KB
  • resource.db
    52KB
  • skin/skin.zip
    .zip 5.5MB
  • snapshot_blob.bin
    49KB
  • sounds/1.wav
    38KB
  • sounds/2.wav
    377KB
  • sounds/3.wav
    126KB
  • sounds/4.wav
    123KB
  • terabox_ext_chrome.crx
    .zip 169KB
  • terabox_license.pdf
    .pdf 131KB
  • terabox_logo.ico
    106KB
  • ucrtbase.dll
    .dll 863KB
  • uninst.exe
    .exe 697KB
  • updateagent.dll
    .dll 1.1MB
  • v8_context_snapshot.bin
    167KB
  • vcruntime140.dll
    .dll 83KB
  • xImage.dll
    .dll 1.1MB

Terabox_1.32.0.1.exe

  • IMPHASH 70ba7b98f15c35ada8b905dc41d081a2
  • SHA256 9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511
  • MD5 SHA1 SHA512 SSDEEP
Password
asdfghjkl
Digest
08:b4:2a:36:67:3f:06:91:b8:48:b3:47:87:04:ae:2b:db:94:fc:1a:68:81:a7:95:d7:2e:aa:79:f1:53:54:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Digest
fc:7e:41:25:c6:2a:0a:17:28:49:4b:4b:d4:34:db:a5:dc:c2:0b:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
4
Entry point
14736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths