General

  • Target
    IROK_Setup_v2.6.0.1_online.exe
  • Size 122.6MB
  • Sample260907-ec7qsaee87
  • SHA256 c3845b004e2accb7a5768118380f52ba0a3173031b72434496b43e7317720829
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Insecure Codesign Algorithm 4 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • IROK_Setup_v2.6.0.1_online.exe
    .exe 122.6MB
  • $PLUGINSDIR/nsProcess.dll
    .dll 4KB
  • $_3_/apps/driver_service/driver.service.exe
    .exe 8.5MB
  • IROK.exe
    .exe 14.7MB
  • browser/LICENSE.electron.txt
    1KB
  • browser/LICENSES.chromium.html
    8.7MB
  • browser/chrome_100_percent.pak
    148KB
  • browser/chrome_200_percent.pak
    223KB
  • browser/d3dcompiler_47.dll
    .dll 4.7MB
  • browser/ffmpeg.dll
    .dll 2.8MB
  • browser/icudtl.dat
    10.0MB
  • browser/irok_ast_embed.exe
    .exe 180.3MB
  • browser/libEGL.dll
    .dll 481KB
  • browser/libGLESv2.dll
    .dll 8.0MB
  • browser/locales/af.pak
    520KB
  • browser/locales/am.pak
    840KB
  • browser/locales/ar.pak
    921KB
  • browser/locales/bg.pak
    959KB
  • browser/locales/bn.pak
    1.2MB
  • browser/locales/ca.pak
    584KB
  • browser/locales/cs.pak
    602KB
  • browser/locales/da.pak
    545KB
  • browser/locales/de.pak
    582KB
  • browser/locales/el.pak
    1.0MB
  • browser/locales/en-GB.pak
    474KB
  • browser/locales/en-US.pak
    478KB
  • browser/locales/es-419.pak
    575KB
  • browser/locales/es.pak
    575KB
  • browser/locales/et.pak
    523KB
  • browser/locales/fa.pak
    855KB
  • browser/locales/fi.pak
    534KB
  • browser/locales/fil.pak
    604KB
  • browser/locales/fr.pak
    622KB
  • browser/locales/gu.pak
    1.2MB
  • browser/locales/he.pak
    751KB
  • browser/locales/hi.pak
    1.3MB
  • browser/locales/hr.pak
    581KB
  • browser/locales/hu.pak
    625KB
  • browser/locales/id.pak
    516KB
  • browser/locales/it.pak
    567KB
  • browser/locales/ja.pak
    691KB
  • browser/locales/kn.pak
    1.4MB
  • browser/locales/ko.pak
    585KB
  • browser/locales/lt.pak
    629KB
  • browser/locales/lv.pak
    628KB
  • browser/locales/ml.pak
    1.4MB
  • browser/locales/mr.pak
    1.2MB
  • browser/locales/ms.pak
    541KB
  • browser/locales/nb.pak
    525KB
  • browser/locales/nl.pak
    543KB
  • browser/locales/pl.pak
    604KB
  • browser/locales/pt-BR.pak
    567KB
  • browser/locales/pt-PT.pak
    571KB
  • browser/locales/ro.pak
    592KB
  • browser/locales/ru.pak
    972KB
  • browser/locales/sk.pak
    611KB
  • browser/locales/sl.pak
    587KB
  • browser/locales/sr.pak
    903KB
  • browser/locales/sv.pak
    528KB
  • browser/locales/sw.pak
    557KB
  • browser/locales/ta.pak
    1.4MB
  • browser/locales/te.pak
    1.3MB
  • browser/locales/th.pak
    1.1MB
  • browser/locales/tr.pak
    567KB
  • browser/locales/uk.pak
    972KB
  • browser/locales/ur.pak
    850KB
  • browser/locales/vi.pak
    673KB
  • browser/locales/zh-CN.pak
    484KB
  • browser/locales/zh-TW.pak
    479KB
  • browser/resources.pak
    5.5MB
  • browser/resources/app.asar
    1.8MB
  • browser/resources/app.asar.unpacked/node_modules/@yuuang/ffi-rs-win32-ia32-msvc/ffi-rs.win32-ia32-msvc.node
    .dll 620KB
  • browser/resources/app.asar.unpacked/node_modules/@yuuang/ffi-rs-win32-ia32-msvc/package.json
    335B
  • browser/resources/app.asar.unpacked/node_modules/@yuuang/ffi-rs-win32-x64-msvc/ffi-rs.win32-x64-msvc.node
    .dll 736KB
  • browser/resources/app.asar.unpacked/node_modules/@yuuang/ffi-rs-win32-x64-msvc/package.json
    271B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/LICENSE
    1KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.exp
    1KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.iobj
    30KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.ipdb
    8KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.lib
    2KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.node
    .dll 147KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.node.recipe
    343B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/CL.command.1.tlog
    5KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/CL.read.1.tlog
    18KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/CL.write.1.tlog
    868B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/Cl.items.tlog
    429B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/bufferutil.lastbuildstate
    233B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.command.1.tlog
    2KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.read.1.tlog
    4KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.secondary.1.tlog
    651B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.write.1.tlog
    898B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/vcpkg.applocal.log
    5B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/bufferutil.vcxproj
    .xml 11KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/build/bufferutil.vcxproj.filters
    .xml 2KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/fallback.js
    899B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/index.js
    .js 136B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/package.json
    563B
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/darwin-x64+arm64/bufferutil.node
    .bundle 65KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/linux-x64/bufferutil.node
    .elf 14KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-ia32/bufferutil.node
    .dll 124KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-x64/bufferutil.node
    .dll 150KB
  • browser/resources/app.asar.unpacked/node_modules/bufferutil/src/bufferutil.c
    3KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/LICENSE
    1KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/fallback.js
    .js 1KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/index.js
    .js 136B
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/package.json
    591B
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/darwin-x64+arm64/node.napi.node
    .bundle 113KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/linux-x64/node.napi.node
    .elf 6KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/win32-ia32/node.napi.node
    .dll 119KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/win32-x64/node.napi.node
    .dll 147KB
  • browser/resources/app.asar.unpacked/node_modules/utf-8-validate/src/validation.c
    2KB
  • browser/resources/elevate.exe
    .exe 105KB
  • browser/snapshot_blob.bin
    309KB
  • browser/v8_context_snapshot.bin
    671KB
  • browser/vk_swiftshader.dll
    .dll 5.3MB
  • browser/vk_swiftshader_icd.json
    106B
  • browser/vulkan-1.dll
    .dll 874KB
  • uninstall.exe.nsis
    4KB

IROK_Setup_v2.6.0.1_online.exe

  • IMPHASH f4639a0b3116c2cfc71144b88a929cfd
  • SHA256 c3845b004e2accb7a5768118380f52ba0a3173031b72434496b43e7317720829
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Insecure Codesign Algorithm

    File was codesigned using an insecure algorithm.

Digest
bd:c5:45:63:5b:ec:71:59:c5:ac:42:33:80:80:e8:fe:02:39:40:b0:8d:30:8e:fd:4b:a4:fc:02:ad:fb:92:ac:3b:44:fa:fa:e8:df:48:39:28:07:af:01:63:58:0f:a3
Digest Algorithm
sha384
PE Digests Matches
Trusted
Signing Certificate
CN=北京爵维科技股份有限公司,O=北京爵维科技股份有限公司,ST=北京市,C=CN
Minor OS version
0
Major OS version
4
Entry point
13618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths