Finder v1[.]0[.]9[.]zip[.]7z

General

Target

Finder v1.0.9.zip.7z
Size

1.7MB
MD5

32f5c981441242aab650af07f1550225
SHA1

9ab80a94b2e6d62cf37a327abc82f393e30e6b68
SHA256

93c99c4a885aa4da27a8d27927837d7e2cde893f58ebf346e80abf8153a88140
SHA512

61c23a17d1829cc80afbafa18e097eed7a1f58ca4dc364eaff746fd8975e9b370457ef786df8f57a7d47562b32af062c9d7c5ffde4f4a5ad1fc619dc0489989c
SSDEEP

49152:s9kFEYyMdndFpqPBrYlMnYk0Ki6sJTAHBAeqE0m:6hodrqdLYTt8AM

Score

1^/10

Malware Config

Signatures

NSIS installer 1 IoCs

resource	yara_rule
static1/unpack002/Finder v1.0.9.exe	nsis_installer_2

Files

Finder v1.0.9.zip.7z
.7z

Password: infected
Finder v1.0.9.zip
.zip
Finder v1.0.9.exe
.exe windows x86

f4176f3f96ba665549c0eee28f906a64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
WaitForSingleObject
GetLastError
CloseHandle
WinExec
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentProcessId

user32

MessageBoxW

msvcr100

_cexit
_exit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__getmainargs
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_amsg_exit
system
_access
fclose
fflush
fwrite
fread
fseek
fopen
exit
malloc
printf
free
_mkdir
__setusermatherr
memset

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

f4176f3f96ba665549c0eee28f906a64

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcr100

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 904B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 1024B - Virtual size: 584B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 904B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 1024B - Virtual size: 584B