Install[.]exe | Triage

Resubmissions

21-01-2023 16:42

230121-t7mfnaeh8z 10

21-01-2023 16:00

230121-tfy1dada75 10

21-01-2023 15:57

230121-td759sda69 10

Sharing

Copy URL

Twitter E-mail

General

Target

Install.exe
Size

4.2MB
MD5

1d3cf58f93934855a05a2388a9f46188
SHA1

b20fe8c0e418f5ed18bbac16fffd66ec202d514a
SHA256

20cf945541d245468ff9f86e3339a5ce537e33ed06951f3f2dcc6acdcf90a31e
SHA512

f8dd1cec6cdd8f5b2493d5ddccd514e17302ff132754d73a58e55b31378487ef97e237dbf0156ac4a7cfb5f0f12a5d5de0d9700cf899d9dca4a0324d42050eed
SSDEEP

98304:1jCTlw6nmA0frFSoP9LAH+Jlt7D1QHGylt4iw+:ywTXZxLAH+j91QHLtrw+

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

Install.exe
.exe windows x86

b0a438491df559e2ae875aca71787ff8

Code Sign

30:53:fb:c3:22:9a:9e:ad:47:c1:25:8a:04:a0:09:c8
Certificate

Issuer

CN=Toshiba MQ01ABMxx 2.5 MQ01ABD060

Not Before

07-10-2022 20:43

Not After

08-10-2032 20:43

Subject

CN=Toshiba MQ01ABMxx 2.5 MQ01ABD060

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:7e:ab:6e:9d:3f:c3:d8:6d:10:67:2e:4a:9c:b9:53:10:37:02:2b:1a:a8:fb:50:66:ad:c4:db:94:43:cb:9a
Signer

Actual PE Digest

51:7e:ab:6e:9d:3f:c3:d8:6d:10:67:2e:4a:9c:b9:53:10:37:02:2b:1a:a8:fb:50:66:ad:c4:db:94:43:cb:9a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Toshiba MQ01ABMxx 2.5 MQ01ABD060

20-01-2023 15:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionEx
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharNextA
GetProcessWindowStation
GetUserObjectInformationW

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance

Sections

.text
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 232KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

b0a438491df559e2ae875aca71787ff8

Code Sign

30:53:fb:c3:22:9a:9e:ad:47:c1:25:8a:04:a0:09:c8Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

51:7e:ab:6e:9d:3f:c3:d8:6d:10:67:2e:4a:9c:b9:53:10:37:02:2b:1a:a8:fb:50:66:ad:c4:db:94:43:cb:9aSigner

Signature Validations

Verification

20-01-2023 15:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: - Virtual size: 2.0MB

.rdata Size: - Virtual size: 168KB

.data Size: - Virtual size: 34KB

.vmp0 Size: - Virtual size: 1.6MB

.vmp1 Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 232KB - Virtual size: 301KB

30:53:fb:c3:22:9a:9e:ad:47:c1:25:8a:04:a0:09:c8
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

51:7e:ab:6e:9d:3f:c3:d8:6d:10:67:2e:4a:9c:b9:53:10:37:02:2b:1a:a8:fb:50:66:ad:c4:db:94:43:cb:9a
Signer

20-01-2023 15:39
Valid: false

.text
Size: - Virtual size: 2.0MB

.rdata
Size: - Virtual size: 168KB

.data
Size: - Virtual size: 34KB

.vmp0
Size: - Virtual size: 1.6MB

.vmp1
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 232KB - Virtual size: 301KB