Static task
static1
Behavioral task
behavioral1
Sample
edadf30df18e6a7ea190041cf3bd4a0b.exe
Resource
win7-en-20211208
General
-
Target
2f65238e7b3a8ddd719fb19a506cd1d964fc7b5cab6f3f4e95235c235cac2190
-
Size
351KB
-
MD5
ed8a45d45c7dceb822c739ff878525e5
-
SHA1
8c62c96c46133ac71995b294cf2209d1b8a3e5a5
-
SHA256
2f65238e7b3a8ddd719fb19a506cd1d964fc7b5cab6f3f4e95235c235cac2190
-
SHA512
8cacd4759ed75a0bf04b2d5513700ea48827b9fae2028ac453603036e96928e581dcc13294fb32aee97583e77e5eed53bf4c6621d6ebde97f33d5eeb050fa1d7
-
SSDEEP
6144:lbouvObE305vEk5HZtl5xdTdIYbynL7P4LmT5nWh5jUFB2sJME1uzenot2:lboiHUt5HZf5x5O4ynn4LmT5a522saEb
Malware Config
Signatures
-
NSIS installer 2 IoCs
Processes:
resource yara_rule static1/unpack001/edadf30df18e6a7ea190041cf3bd4a0b nsis_installer_1 static1/unpack001/edadf30df18e6a7ea190041cf3bd4a0b nsis_installer_2
Files
-
2f65238e7b3a8ddd719fb19a506cd1d964fc7b5cab6f3f4e95235c235cac2190.zip
-
edadf30df18e6a7ea190041cf3bd4a0b.exe windows x86
abb85e8b889dab3b36aa68b03047e6e6
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WritePrivateProfileStringA
MoveFileA
MultiByteToWideChar
GetFileSize
GetTickCount
GetModuleFileNameA
GetCommandLineA
SetEnvironmentVariableA
SetErrorMode
GetCurrentProcess
ExitProcess
GetVersion
GetWindowsDirectoryA
lstrlenA
GetTempPathA
CopyFileA
GetDiskFreeSpaceA
GetPrivateProfileStringA
GlobalLock
GlobalUnlock
lstrcpynA
CreateDirectoryA
CreateFileA
ReadFile
RemoveDirectoryA
WriteFile
CreateProcessA
GetSystemDirectoryA
GetProcAddress
lstrcpyA
lstrcatA
GetTempFileNameA
MoveFileExA
lstrcmpiA
lstrcmpA
MulDiv
GetShortPathNameA
GlobalFree
GlobalAlloc
LoadLibraryExA
GetModuleHandleA
FreeLibrary
GetExitCodeProcess
Sleep
WaitForSingleObject
GetLastError
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesA
GetFullPathNameA
GetFileAttributesA
FindNextFileA
ExpandEnvironmentStringsA
FindFirstFileA
FindClose
DeleteFileA
CompareFileTime
SearchPathA
SetCurrentDirectoryA
CreateThread
user32
EndDialog
CheckDlgButton
IsDlgButtonChecked
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetAsyncKeyState
IsWindowEnabled
GetSystemMetrics
GetSystemMenu
CreatePopupMenu
EnableMenuItem
AppendMenuA
TrackPopupMenu
GetWindowRect
SetCursor
ScreenToClient
GetSysColor
GetWindowLongA
DialogBoxParamA
LoadBitmapA
LoadCursorA
SystemParametersInfoA
wvsprintfA
DispatchMessageA
PeekMessageA
SetDlgItemTextA
GetDlgItemTextA
CharPrevA
MessageBoxIndirectA
GetMessagePos
CharNextA
ExitWindowsEx
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
FindWindowExA
SetWindowLongA
IsWindowVisible
SetWindowPos
CreateWindowExA
GetClassInfoA
RegisterClassA
SetClassLongA
CallWindowProcA
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutA
SendMessageA
wsprintfA
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextA
DefWindowProcA
LoadImageA
gdi32
SetBkColor
GetDeviceCaps
SetTextColor
SetBkMode
SelectObject
DeleteObject
CreateFontIndirectA
CreateBrushIndirect
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
SHGetSpecialFolderLocation
advapi32
RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
SetFileSecurityA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
comctl32
ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 272KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ