spyInstall[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

spyInstall.exe
Size

2.0MB
MD5

76e160ed15ea4c36bb3b812d307f0f63
SHA1

b1f6b75a9373166fb55cf20dea18de0e1588bb2a
SHA256

db5c891ddcd45fd9f6c2f786ee5400fdc2c3e4d8a5526200f6789156098b2c99
SHA512

3284d1aebd4977f65967a52df1657cabd7d3113f68f05d489fec4f388bc06f036f34f8367a12e9ff77e4b232fd8bd2046ba7709d4ef4826a26fb86c8c29e25fc
SSDEEP

49152:Pn6XoDolxYmRDG2L2YZq/zGV16HjF+S7fEhQO1D:PbiymdL2YSGsjF+BD

Score

N/A

Malware Config

Signatures

Files

spyInstall.exe
.exe windows x86

c5319e076a4e8512805ca6dc9210f0f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:4b:b5:cd:41:42:e5:c9:be:ca:a2:f4:a6:7d:47:92
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

08/06/2021, 00:00

Not After

08/06/2022, 23:59

Subject

SERIALNUMBER=12K-305,CN=Spytech Software and Design\, Inc.,O=Spytech Software and Design\, Inc.,L=Red Wing,ST=Minnesota,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13094d696e6e65736f7461,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:d0:c3:02:c8:bb:f5:cb:cb:ac:4d:9a:62:80:f6:2e:3b:88:69:59:d0:76:d9:4a:5a:3e:ae:31:9c:74:34:6f
Signer

Actual PE Digest

72:d0:c3:02:c8:bb:f5:cb:cb:ac:4d:9a:62:80:f6:2e:3b:88:69:59:d0:76:d9:4a:5a:3e:ae:31:9c:74:34:6f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=12K-305,CN=Spytech Software and Design\, Inc.,O=Spytech Software and Design\, Inc.,L=Red Wing,ST=Minnesota,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13094d696e6e65736f7461,1.3.6.1.4.1.311.60.2.1.3=#13025553

13/01/2023, 12:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileA
lstrlenA
lstrcpyA
GetWindowsDirectoryA
lstrcatA
RemoveDirectoryA
FindNextFileA
DeleteFileA
lstrcmpA
SetFileAttributesA
LocalFileTimeToFileTime
DosDateTimeToFileTime
_lcreat
_lread
GetProcAddress
FreeLibrary
GetVersionExA
GetLastError
GetCurrentProcess
_llseek
GetModuleFileNameA
GetTempPathA
GlobalFree
GlobalAlloc
HeapReAlloc
VirtualAlloc
SetEnvironmentVariableA
_lopen
SetFileTime
LoadLibraryA
_lclose
_hread
_hwrite
CreateDirectoryA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
TerminateProcess
GetFullPathNameA
GetCurrentDirectoryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW

user32

ExitWindowsEx
LoadIconA
wsprintfA
MessageBoxA

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_mvdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5319e076a4e8512805ca6dc9210f0f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

b0:4b:b5:cd:41:42:e5:c9:be:ca:a2:f4:a6:7d:47:92Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

72:d0:c3:02:c8:bb:f5:cb:cb:ac:4d:9a:62:80:f6:2e:3b:88:69:59:d0:76:d9:4a:5a:3e:ae:31:9c:74:34:6fSigner

Signature Validations

Verification

13/01/2023, 12:38 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 2KB

_mvdata Size: 1.9MB - Virtual size: 1.9MB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

b0:4b:b5:cd:41:42:e5:c9:be:ca:a2:f4:a6:7d:47:92
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

72:d0:c3:02:c8:bb:f5:cb:cb:ac:4d:9a:62:80:f6:2e:3b:88:69:59:d0:76:d9:4a:5a:3e:ae:31:9c:74:34:6f
Signer

13/01/2023, 12:38
Valid: false

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 2KB

_mvdata
Size: 1.9MB - Virtual size: 1.9MB