install[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

install.exe
Size

549KB
MD5

520a6d1cbcc9cf642c625fe814c93c58
SHA1

fb517abb38e9ccc67de411d4f18a9446c11c0923
SHA256

08966ce743aa1cbed0874933e104ef7b913188ecd8f0c679f7d8378516c51da2
SHA512

b92a32b27d6e6187c30d8018d7e0a35bde98dc524eabcd7709420b499778159e2872db04a3f2dfacf016d0e6d97b8175920e83fa28804609786828e52f058ff0
SSDEEP

12288:bpNWz8beHITmTmbA4yrRGsR5A5lcwFhpto/cT9aRzS:bpC/mbANrr5MiwFhDoET9t

Score

1^/10

Malware Config

Signatures

Files

install.exe
.exe windows x86

d6573ee33f5b2b7399ecc825eec0cd40

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:5c:4f:0d:1a:a5:22:50:57:4d:22:f5:14:aa:ff:79:2f:da:d4:4a
Signer

Actual PE Digest

92:5c:4f:0d:1a:a5:22:50:57:4d:22:f5:14:aa:ff:79:2f:da:d4:4a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

07/11/2007, 16:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
LeaveCriticalSection
UnmapViewOfFile
DeleteCriticalSection
GetTempPathW
GetCurrentProcess
GetCurrentThread
CreateDirectoryW
GetFileSize
WideCharToMultiByte
WriteFile
FlushFileBuffers
GetModuleFileNameW
GetCommandLineW
DeleteFileW
lstrlenA
MultiByteToWideChar
GetCurrentThreadId
ResetEvent
MapViewOfFile
FlushInstructionCache
WaitForMultipleObjects
FormatMessageW
MulDiv
lstrlenW
GetDriveTypeW
GlobalHandle
lstrcmpW
TerminateThread
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
lstrcmpiW
LoadLibraryExW
InterlockedExchange
HeapSetInformation
GetUserDefaultLangID
CreateFileMappingW
EnterCriticalSection
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
GetSystemDirectoryW
SetEvent
CreateThread
CreateEventW
Sleep
SetLastError
GetTickCount
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetProcAddress
GetVersionExW
LoadLibraryW
FreeLibrary
SetFilePointer
GlobalAlloc
LocalFree
LocalAlloc
GlobalUnlock
ReadFile
GlobalLock
GlobalReAlloc
GlobalFree
CloseHandle
RaiseException
CreateFileW
GetDriveTypeA
GetCurrentDirectoryA
ResumeThread
ExitThread
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleA
SetEndOfFile
FindClose
DuplicateHandle
GetSystemDefaultLCID
ReleaseMutex
IsProcessorFeaturePresent
GetProcessHeap
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
CreateFileA
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
RtlUnwind
InitializeCriticalSectionAndSpinCount
HeapSize
GetOEMCP
GetACP
HeapReAlloc
VirtualAlloc
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
ExitProcess
SetUnhandledExceptionFilter
GetLocalTime
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
LoadLibraryA

gdi32

GetStockObject
CreateSolidBrush
GetObjectW
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateFontIndirectW
GetDeviceCaps
SetBkMode
SetTextColor
SetBkColor
CreatePalette
DeleteObject
SetDIBitsToDevice
PatBlt
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateDIBitmap
RealizePalette
SelectPalette

comctl32

ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Create
InitCommonControlsEx
ImageList_Destroy

imm32

ImmGetContext
ImmAssociateContext
ImmReleaseContext

ole32

OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoUninitialize
CoInitialize
CoTaskMemRealloc

oleaut32

SysAllocStringByteLen
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysAllocStringLen
VarBstrCmp
VarUI4FromStr
SysStringByteLen

shell32

SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteW

shlwapi

PathCombineW
PathIsRootW
PathStripToRootW
PathRemoveBackslashW
PathAddBackslashW
PathRemoveBlanksW
PathCanonicalizeW

user32

PtInRect
ScreenToClient
GetActiveWindow
DialogBoxIndirectParamW
DestroyAcceleratorTable
InvalidateRgn
FillRect
ReleaseCapture
SetCapture
MoveWindow
ClientToScreen
CreateAcceleratorTableW
RedrawWindow
GetClassNameW
IsChild
EndPaint
BeginPaint
GetWindowTextLengthW
RegisterWindowMessageW
LoadImageW
DestroyIcon
SetWindowContextHelpId
MapDialogRect
UnregisterClassA
ShowWindow
SystemParametersInfoW
SetTimer
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetCursorPos
MapWindowPoints
SetWindowPos
LoadIconW
GetDesktopWindow
GetSystemMenu
EnableMenuItem
SetFocus
GetFocus
SendMessageW
DestroyWindow
DefWindowProcW
ExitWindowsEx
CharPrevW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
ReleaseDC
GetDC
PostQuitMessage
IsDlgButtonChecked
GetSysColorBrush
InvalidateRect
SetCursor
DrawFocusRect
DrawTextW
GetDlgItem
SetDlgItemTextW
SendDlgItemMessageW
SetWindowTextW
CallWindowProcW
SetWindowLongW
DialogBoxParamW
CreateDialogParamW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
MessageBoxW
IsWindow
GetWindowTextW
EnableWindow
GetCursor
EndDialog
GetSysColor
GetClientRect
KillTimer
PostMessageW
IsDialogMessageW
GetSystemMetrics

setupapi

SetupIterateCabinetW

Sections

.text
Size: 490KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6573ee33f5b2b7399ecc825eec0cd40

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:14:2c:a7:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

61:14:2c:a7:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

92:5c:4f:0d:1a:a5:22:50:57:4d:22:f5:14:aa:ff:79:2f:da:d4:4aSigner

Signature Validations

Verification

07/11/2007, 16:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

comctl32

imm32

ole32

oleaut32

shell32

shlwapi

user32

setupapi

Sections

.text Size: 490KB - Virtual size: 489KB

.data Size: 8KB - Virtual size: 30KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 38KB - Virtual size: 37KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

92:5c:4f:0d:1a:a5:22:50:57:4d:22:f5:14:aa:ff:79:2f:da:d4:4a
Signer

07/11/2007, 16:00
Valid: false

.text
Size: 490KB - Virtual size: 489KB

.data
Size: 8KB - Virtual size: 30KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 38KB - Virtual size: 37KB