99d5f12b36359ad030f44ed4f55df611002a5253149322bf0d84f03850dc258a

Sharing

Copy URL Twitter E-mail

General

Target

99d5f12b36359ad030f44ed4f55df611002a5253149322bf0d84f03850dc258a
Size

1.9MB
MD5

ac8d00b1eefd3eae2769f96d751f1298
SHA1

26ada7c3765e44eae889824e8985fb90808ff714
SHA256

99d5f12b36359ad030f44ed4f55df611002a5253149322bf0d84f03850dc258a
SHA512

4a6c0f06c90bdd37c872791d91300779d3e8185a23212a956d631e851916f5477343fec2da9ebd189bf536462578c502b75342dd54fe4fa1a03a0fb32b5896ce
SSDEEP

49152:nXRx0d5brOy8+HlTZKoP2JpXGhes4m4GW1ut+i9+C4:XRCAgTsC2p2Es4aWrxC4

Score

1^/10

Malware Config

Signatures

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

99d5f12b36359ad030f44ed4f55df611002a5253149322bf0d84f03850dc258a
.exe windows x86

e8f5903bd09793141b12abe25de98c7b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
UnhookWindowsHookEx
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
EnableWindow
SetCursor
SendMessageA
PostQuitMessage
wsprintfA
MessageBoxA
GetSystemMetrics
PostMessageA
UnregisterClassA

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
DeleteFileA
Sleep
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
GetModuleFileNameA
GetCommandLineW
WideCharToMultiByte
LocalFree
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
SetStdHandle
ExitProcess
GetModuleHandleA
GetProcessHeap
IsWow64Process
GetSystemInfo
GetVersionExA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetCommandLineA
GetOEMCP
GetCPInfo
FlushFileBuffers
SetFilePointer
GetCurrentProcess
SetErrorMode
GetProcessVersion
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
MultiByteToWideChar
InterlockedIncrement
lstrcpyA
lstrcatA
WritePrivateProfileStringA
InterlockedDecrement
GlobalFlags
lstrlenA
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId

gdi32

GetObjectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
CreateBitmap
DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectObject
GetStockObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegOpenKeyA

shell32

CommandLineToArgvW

comctl32

ord17

Sections

.text
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8f5903bd09793141b12abe25de98c7b

Headers

File Characteristics

Imports

user32

kernel32

gdi32

winspool.drv

advapi32

shell32

comctl32

Sections

.text Size: 84KB - Virtual size: 80KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 1.8MB - Virtual size: 1.9MB

.rsrc Size: 4KB - Virtual size: 700B

.text
Size: 84KB - Virtual size: 80KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 1.8MB - Virtual size: 1.9MB

.rsrc
Size: 4KB - Virtual size: 700B