b9ec6477806afaea919bf877e8dbda5be90500cfb38022c36cca1752254a35af

Sharing

Copy URL Twitter E-mail

General

Target

b9ec6477806afaea919bf877e8dbda5be90500cfb38022c36cca1752254a35af
Size

1.1MB
MD5

a0fbdbb1a54aa6d918063928cd4b98b2
SHA1

62d951b068ebf8a63f2d2401ab61875d923d7b44
SHA256

b9ec6477806afaea919bf877e8dbda5be90500cfb38022c36cca1752254a35af
SHA512

2a076546baf1b38662e73fd4e221154e3237579fc1a412d8093ed19b2927e61de2780255df337e39880ccf6baea498c783df15b18135b9561302c6fd6ef2bb1d
SSDEEP

24576:5+oe9APXoB+7x4n6BTYIuj/vEDf+OuCZLF4c2wf6+5k74EAiPDVAmwROkrVPhXFR:wowAAB+7x46BLUna+OuC1qgdEAcA/Nhf

Score

1^/10

Malware Config

Signatures

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

b9ec6477806afaea919bf877e8dbda5be90500cfb38022c36cca1752254a35af
.exe windows x86

cc627b667b06b61c62b1df14a48fab85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringW
LCMapStringA
CreateFileA
CompareStringA
HeapSize
RtlUnwind
SetFilePointer
VirtualQuery
VirtualProtect
VirtualAlloc
VirtualFree
HeapDestroy
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetEnvironmentVariableA
FlushFileBuffers
TlsGetValue
TlsSetValue
TlsAlloc
ReadFile
WriteFile
GetStartupInfoA
GetFileType
GetStdHandle
WideCharToMultiByte
HeapFree
CreateThread
ExitThread
GetFileAttributesA
EnterCriticalSection
ExitProcess
FindClose
GetStringTypeW
FindFirstFileA
GetExitCodeThread
FreeLibrary
GetCommandLineA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
QueryPerformanceFrequency
QueryPerformanceCounter
Sleep
MultiByteToWideChar
LeaveCriticalSection
IsDBCSLeadByteEx
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
VerifyVersionInfoA
VerSetConditionMask
SetEvent
ResetEvent
ReadDirectoryChangesW
QueueUserWorkItem
GetVolumeInformationW
GetModuleHandleA
GetLogicalDrives
GetLastError
GetFileAttributesW
GetDriveTypeW
ExpandEnvironmentStringsW
CreateFileW
CloseHandle
DisableThreadLibraryCalls
SetEndOfFile
FileTimeToLocalFileTime
GetFullPathNameA
GetCurrentDirectoryA
UnmapViewOfFile
CreateFileMappingA
GetFileAttributesExA
GetLongPathNameA
GetModuleFileNameA
MapViewOfFile
FindNextFileA

advapi32

RegOpenKeyExA
GetFileSecurityW
LookupAccountSidW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegEnumKeyA

shell32

SHFileOperationW
SHGetFileInfoW

msvcrt

strstr
strrchr
strncpy
strncmp
strlen
strtol
strchr
memmove
memchr
malloc
free
fflush
swscanf
wcscat
wcscpy
wcslen
fread
fwrite
getenv
gmtime
memcmp
atoi
fputc
localeconv
memset
perror
printf
putchar
puts
qsort
rand
realloc
rename
sprintf
sscanf
strcat
strcpy
strpbrk
time
_getch
atol
strcmp

shlwapi

AssocQueryKeyW
AssocQueryStringW

rpcrt4

RpcRaiseException

ws2_32

WSASend
WSASendTo
WSAStartup
WSAStringToAddressA
WSAWaitForMultipleEvents
accept
bind
connect
WSAEventSelect
getaddrinfo
getnameinfo
getpeername
getservbyname
getsockname
listen
recv
send
setsockopt
shutdown
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAAddressToStringA
freeaddrinfo

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc627b667b06b61c62b1df14a48fab85

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

msvcrt

shlwapi

rpcrt4

ws2_32

Sections

.text Size: 96KB - Virtual size: 92KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 84KB - Virtual size: 2.2MB

.rsrc Size: 8KB - Virtual size: 5KB

.text
Size: 96KB - Virtual size: 92KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 84KB - Virtual size: 2.2MB

.rsrc
Size: 8KB - Virtual size: 5KB