2ed3b7df43bc0b380a96bdbfbf6d7137af14fd712a604b361a8c01675c0c0149

Sharing

Copy URL Twitter E-mail

General

Target
2ed3b7df43bc0b380a96bdbfbf6d7137af14fd712a604b361a8c01675c0c0149
Size 11.6MB
Sample221126-e5mw3sca72
SHA256 2ed3b7df43bc0b380a96bdbfbf6d7137af14fd712a604b361a8c01675c0c0149
MD5 048caeafe3f00631dec0928e3f486e84
SHA1 c562f85e166e2db155c80cda7d18c766b74cec38
SHA512 995e08d4828b896c99ade5718e6a19841a41a29c381f6a19df801d7a44f6cb8e97cfd91face724eda8ce4cfe40f168fe7ea9c58aad0d4f7ca0605a051a06d301
SSDEEP 196608:psLDOM/dumuQrGuMGlB2eFdjdNv0HbDtQVEJNxtuLceimLRO2T/yQXjbDong7+pA:+La0G8KeFfK3tQWJNYceJLRrug/jhrt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2ed3b7df43bc0b380a96bdbfbf6d7137af14fd712a604b361a8c01675c0c0149

.exe 11.6MB

2ed3b7df43bc0b380a96bdbfbf6d7137af14fd712a604b361a8c01675c0c0149

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 2ed3b7df43bc0b380a96bdbfbf6d7137af14fd712a604b361a8c01675c0c0149
MD5 048caeafe3f00631dec0928e3f486e84
SHA1 c562f85e166e2db155c80cda7d18c766b74cec38
SHA512 995e08d4828b896c99ade5718e6a19841a41a29c381f6a19df801d7a44f6cb8e97cfd91face724eda8ce4cfe40f168fe7ea9c58aad0d4f7ca0605a051a06d301
SSDEEP 196608:psLDOM/dumuQrGuMGlB2eFdjdNv0HbDtQVEJNxtuLceimLRO2T/yQXjbDong7+pA:+La0G8KeFfK3tQWJNYceJLRrug/jhrt
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

3a:86:8f:d5:87:79:ad:ee:40:9f:2a:78:88:7f:42:16:b6:90:80:e8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

16685

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

8KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE