Hostile 92% windows Download

Unity.TuanjieHub

Signed legitimate NSIS installer

Elevated NSIS loader with reboot and clipboard accessEncrypted payload concealed in oversized reloc
SHA-2568b3191b2403e41e859d6c6fd0026bc6150603271fc2bb08e93de6bd0e3c24ffb
URLhttps://public-cdn.tuanjie.cn/hub/prod/TuanjieHubSetup.exe
MaleculeO₄(AsCEr₂I)H₇(CmDbDsF₉Os₇Po₃U)Md₅(Bi₈BkPaSi₂)

Evidence

Cleartext http:// URL 0x89b0–0x8ba0
⋯7 more rows
0x8a2061006c006c0065007200000000000000a.l.l.e.r.......
0x8a3049006e007300740061006c006c006500I.n.s.t.a.l.l.e.
0x8a407200200069006e007400650067007200r. .i.n.t.e.g.r.
0x8a5069007400790020006300680065006300i.t.y. .c.h.e.c.
0x8a606b002000680061007300200066006100k. .h.a.s. .f.a.
0x8a7069006c00650064002e00200043006f00i.l.e.d... .C.o.
0x8a806d006d006f006e002000630061007500m.m.o.n. .c.a.u.
0x8a90730065007300200069006e0063006c00s.e.s. .i.n.c.l.
0x8aa07500640065000a0069006e0063006f00u.d.e...i.n.c.o.
0x8ab06d0070006c0065007400650020006400m.p.l.e.t.e. .d.
0x8ac06f0077006e006c006f00610064002000o.w.n.l.o.a.d. .
0x8ad061006e0064002000640061006d006100a.n.d. .d.a.m.a.
0x8ae067006500640020006d00650064006900g.e.d. .m.e.d.i.
0x8af061002e00200043006f006e0074006100a... .C.o.n.t.a.
0x8b006300740020007400680065000a006900c.t. .t.h.e...i.
⋯10 more rows
NSIS runtime error title in rdata 0x8c84–0x8da4
⋯3 more rows
0x8cb46c00690064002e000000000000000000l.i.d...........
0x8cc44e005300490053002000450072007200N.S.I.S. .E.r.r.
0x8cd46f007200000000005c00540065006d00o.r.....\.T.e.m.
0x8ce4700000004c006f007700000054004500p...L.o.w...T.E.
0x8cf44d0050000000000054004d0050000000M.P.....T.M.P...
0x8d047e006e00730075000000000041000000~.n.s.u.....A...
0x8d142e0074006d0070000000000053006500..t.m.p.....S.e.
0x8d24530068007500740064006f0077006e00S.h.u.t.d.o.w.n.
0x8d34500072006900760069006c0065006700P.r.i.v.i.l.e.g.
⋯7 more rows
AdjustTokenPrivileges API symbol 0x8fc4–0x92b4
⋯3 more rows
0x8ff47a65570047657446696c655665727369zeW.GetFileVersi
0x90046f6e496e666f57005665725175657279onInfoW.VerQuery
0x901456616c756557000000000000fffe0000ValueW..........
0x902425006400000000000000000053006f00%.d.........S.o.
0x90346600740077006100720065005c004d00f.t.w.a.r.e.\.M.
0x90446900630072006f0073006f0066007400i.c.r.o.s.o.f.t.
0x90545c00570069006e0064006f0077007300\.W.i.n.d.o.w.s.
0x90645c00430075007200720065006e007400\.C.u.r.r.e.n.t.
0x9074560065007200730069006f006e000000V.e.r.s.i.o.n...
0x9084000000005c004d006900630072006f00....\.M.i.c.r.o.
0x909473006f00660074005c0049006e007400s.o.f.t.\.I.n.t.
0x90a4650072006e0065007400200045007800e.r.n.e.t. .E.x.
0x90b470006c006f007200650072005c005100p.l.o.r.e.r.\.Q.
0x90c47500690063006b0020004c0061007500u.i.c.k. .L.a.u.
0x90d46e006300680000000200340002000000n.c.h.....4.....
0x90e400031800000000100102000000000005................
0x90f420000000200200000003140041001300 ... .......A...
0x91040101000000000001000000005c002a00............\.*.
0x91142e002a0000000000440065006c006500..*.....D.e.l.e.
0x9124740065003a002000440065006c006500t.e.:. .D.e.l.e.
0x913474006500460069006c00650028002200t.e.F.i.l.e.(.".
0x914425007300220029000000000044006500%.s.".).....D.e.
0x91546c006500740065003a00200044006500l.e.t.e.:. .D.e.
0x91646c00650074006500460069006c006500l.e.t.e.F.i.l.e.
0x917420006f006e0020005200650062006f00 .o.n. .R.e.b.o.
0x91846f007400280022002500730022002900o.t.(.".%.s.".).
0x919400000000440065006c00650074006500....D.e.l.e.t.e.
0x91a43a002000440065006c00650074006500:. .D.e.l.e.t.e.
0x91b4460069006c0065002000660061006900F.i.l.e. .f.a.i.
0x91c46c006500640028002200250073002200l.e.d.(.".%.s.".
⋯3 more rows
0x9204200069006e00760061006c0069006400 .i.n.v.a.l.i.d.
0x9214200069006e0070007500740028002200 .i.n.p.u.t.(.".
0x922425007300220029000000000052004d00%.s.".).....R.M.
0x92344400690072003a002000520065006d00D.i.r.:. .R.e.m.
⋯8 more rows
Places data onto the Windows clipboard 0x9fd2–0xa172
⋯12 more rows
0xa09274746f6e00002c024973446c67427574tton..,.IsDlgBut
0xa0a2746f6e436865636b6564000097024f70tonChecked....Op
0xa0b2656e436c6970626f617264004f00436cenClipboard.O.Cl
0xa0c26f7365436c6970626f61726400001b03oseClipboard....
0xa0d2536574436c6970626f61726444617461SetClipboardData
0xa0e20000e800456d707479436c6970626f61....EmptyClipboa
0xa0f27264000021014765744173796e634b65rd..!.GetAsyncKe
0xa10279537461746500004302497357696e64yState..C.IsWind
⋯7 more rows
Large PE contains raw admin-manifest literal 0x26654–0x26804
⋯7 more rows
0x266c4657374656450726976696c656765733eestedPrivileges>
0x266d43c726571756573746564457865637574<requestedExecut
0x266e4696f6e4c6576656c206c6576656c3d22ionLevel level="
0x266f47265717569726541646d696e69737472requireAdministr
0x2670461746f72222075694163636573733d22ator" uiAccess="
0x2671466616c7365222f3e3c2f726571756573false"/></reques
⋯15 more rows
Cleartext http:// URL TuanjieHubSetup.exe · 0x89b0–0x8ba0
⋯7 more rows
0x8a2061006c006c0065007200000000000000a.l.l.e.r.......
0x8a3049006e007300740061006c006c006500I.n.s.t.a.l.l.e.
0x8a407200200069006e007400650067007200r. .i.n.t.e.g.r.
0x8a5069007400790020006300680065006300i.t.y. .c.h.e.c.
0x8a606b002000680061007300200066006100k. .h.a.s. .f.a.
0x8a7069006c00650064002e00200043006f00i.l.e.d... .C.o.
0x8a806d006d006f006e002000630061007500m.m.o.n. .c.a.u.
0x8a90730065007300200069006e0063006c00s.e.s. .i.n.c.l.
0x8aa07500640065000a0069006e0063006f00u.d.e...i.n.c.o.
0x8ab06d0070006c0065007400650020006400m.p.l.e.t.e. .d.
0x8ac06f0077006e006c006f00610064002000o.w.n.l.o.a.d. .
0x8ad061006e0064002000640061006d006100a.n.d. .d.a.m.a.
0x8ae067006500640020006d00650064006900g.e.d. .m.e.d.i.
0x8af061002e00200043006f006e0074006100a... .C.o.n.t.a.
0x8b006300740020007400680065000a006900c.t. .t.h.e...i.
⋯10 more rows
AdjustTokenPrivileges API symbol TuanjieHubSetup.exe · 0x8fc4–0x92b4
⋯3 more rows
0x8ff47a65570047657446696c655665727369zeW.GetFileVersi
0x90046f6e496e666f57005665725175657279onInfoW.VerQuery
0x901456616c756557000000000000fffe0000ValueW..........
0x902425006400000000000000000053006f00%.d.........S.o.
0x90346600740077006100720065005c004d00f.t.w.a.r.e.\.M.
0x90446900630072006f0073006f0066007400i.c.r.o.s.o.f.t.
0x90545c00570069006e0064006f0077007300\.W.i.n.d.o.w.s.
0x90645c00430075007200720065006e007400\.C.u.r.r.e.n.t.
0x9074560065007200730069006f006e000000V.e.r.s.i.o.n...
0x9084000000005c004d006900630072006f00....\.M.i.c.r.o.
0x909473006f00660074005c0049006e007400s.o.f.t.\.I.n.t.
0x90a4650072006e0065007400200045007800e.r.n.e.t. .E.x.
0x90b470006c006f007200650072005c005100p.l.o.r.e.r.\.Q.
0x90c47500690063006b0020004c0061007500u.i.c.k. .L.a.u.
0x90d46e006300680000000200340002000000n.c.h.....4.....
0x90e400031800000000100102000000000005................
0x90f420000000200200000003140041001300 ... .......A...
0x91040101000000000001000000005c002a00............\.*.
0x91142e002a0000000000440065006c006500..*.....D.e.l.e.
0x9124740065003a002000440065006c006500t.e.:. .D.e.l.e.
0x913474006500460069006c00650028002200t.e.F.i.l.e.(.".
0x914425007300220029000000000044006500%.s.".).....D.e.
0x91546c006500740065003a00200044006500l.e.t.e.:. .D.e.
0x91646c00650074006500460069006c006500l.e.t.e.F.i.l.e.
0x917420006f006e0020005200650062006f00 .o.n. .R.e.b.o.
0x91846f007400280022002500730022002900o.t.(.".%.s.".).
0x919400000000440065006c00650074006500....D.e.l.e.t.e.
0x91a43a002000440065006c00650074006500:. .D.e.l.e.t.e.
0x91b4460069006c0065002000660061006900F.i.l.e. .f.a.i.
0x91c46c006500640028002200250073002200l.e.d.(.".%.s.".
⋯3 more rows
0x9204200069006e00760061006c0069006400 .i.n.v.a.l.i.d.
0x9214200069006e0070007500740028002200 .i.n.p.u.t.(.".
0x922425007300220029000000000052004d00%.s.".).....R.M.
0x92344400690072003a002000520065006d00D.i.r.:. .R.e.m.
⋯8 more rows
Places data onto the Windows clipboard TuanjieHubSetup.exe · 0x9fd2–0xa172
⋯12 more rows
0xa09274746f6e00002c024973446c67427574tton..,.IsDlgBut
0xa0a2746f6e436865636b6564000097024f70tonChecked....Op
0xa0b2656e436c6970626f617264004f00436cenClipboard.O.Cl
0xa0c26f7365436c6970626f61726400001b03oseClipboard....
0xa0d2536574436c6970626f61726444617461SetClipboardData
0xa0e20000e800456d707479436c6970626f61....EmptyClipboa
0xa0f27264000021014765744173796e634b65rd..!.GetAsyncKe
0xa10279537461746500004302497357696e64yState..C.IsWind
⋯7 more rows
Large PE contains raw admin-manifest literal TuanjieHubSetup.exe · 0x26654–0x26804
⋯7 more rows
0x266c4657374656450726976696c656765733eestedPrivileges>
0x266d43c726571756573746564457865637574<requestedExecut
0x266e4696f6e4c6576656c206c6576656c3d22ionLevel level="
0x266f47265717569726541646d696e69737472requireAdministr
0x2670461746f72222075694163636573733d22ator" uiAccess="
0x2671466616c7365222f3e3c2f726571756573false"/></reques
⋯15 more rows
High entropy .reloc section embedded:pe@0x224d50f · 0x21380–0x21510
⋯7 more rows
0x213f0fbf8cf7e1086fae5c071c5192c521fac...~.....q..,R..
0x21400be8657d27979546c883d23bc2ce7a5a0..W.yyTl.=#.,...
0x214106af29b68427617878e3bc8190b884864j..hBv...;....Hd
0x21420395affa0865345fa6f3454ea0fcc6c359Z...SE.o4T...l5
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.