636cfafcdb1650d0fc4e50b256ceb30888e6dee8efbc5793b680a5a8514b1623

Sharing

Copy URL Twitter E-mail

General

Target
636cfafcdb1650d0fc4e50b256ceb30888e6dee8efbc5793b680a5a8514b1623
Size 313KB
Sample221206-w8brnafe2v
SHA256 636cfafcdb1650d0fc4e50b256ceb30888e6dee8efbc5793b680a5a8514b1623
MD5 55dfefa0734052bd2752ba62e38f99a0
SHA1 376989cb2177b1de895861520dcb9d9ec7ccde9c
SHA512 e48e224423b1851ea3c642bf50bf05e9e2594cf9e35f25a53def5657d625b9ded24988bb42e25b7dbf9f64c21a7d6301ff40ec12923c18edcecd2a8f55d95b5d
SSDEEP 6144:H+K03SwpNXT2TPGLURQN3vTLWBQ/7TzttuCMNhGK6DgsQQYb:+3Bxq7HqFvfW6jTz3uCMNQKagF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

636cfafcdb1650d0fc4e50b256ceb30888e6dee8efbc5793b680a5a8514b1623

.exe 313KB

636cfafcdb1650d0fc4e50b256ceb30888e6dee8efbc5793b680a5a8514b1623

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 636cfafcdb1650d0fc4e50b256ceb30888e6dee8efbc5793b680a5a8514b1623
MD5 55dfefa0734052bd2752ba62e38f99a0
SHA1 376989cb2177b1de895861520dcb9d9ec7ccde9c
SHA512 e48e224423b1851ea3c642bf50bf05e9e2594cf9e35f25a53def5657d625b9ded24988bb42e25b7dbf9f64c21a7d6301ff40ec12923c18edcecd2a8f55d95b5d
SSDEEP 6144:H+K03SwpNXT2TPGLURQN3vTLWBQ/7TzttuCMNhGK6DgsQQYb:+3Bxq7HqFvfW6jTz3uCMNQKagF
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

5a:6f:e6:8b:71:ec:3e:7e:78:6c:d7:45:1f:fd:e0:96:a0:1c:3f:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12508

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA