Install_01025[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Install_01025.exe
Size

22.7MB
MD5

5e5efe35eff1f27ddd3b88ca0eaa6005
SHA1

888ea9a1b92c6c66b5769312a22472e8de65cb97
SHA256

49139ed2bb4a0acc84c5465ff42691ad3e5e30065a3dd876d2a318e5e49b696a
SHA512

64d6dd469452881f8ac57ceaa4d94c8d79214baa130ab266d8ffd441317111fed620ec460b507b74677d19a3af866bfddf0d347710a528f91af5983db16bc262
SSDEEP

393216:1ZEpxEUEbkJsHHeXh5dBcGbyiH1fxqlFKCHX9I+PkmuvBPGr8MT0VRv3I1KJg4Ks:1dkJsHHeXh5dBcGbto/HXpPSBPBMT0Tl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Install_01025.exe

Files

Install_01025.exe
.exe windows x86

Password: restr

c61f65a7af6939836e7bbe4a515158f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
PathFileExistsW

kernel32

AcquireSRWLockExclusive
SetFileAttributesW
GetVersionExA
LeaveCriticalSection
FindFirstFileExW
GetFileSizeEx
lstrlenW
FreeLibrary
ResetEvent
GetSystemDirectoryW
GetModuleHandleW
VirtualFree
GetModuleFileNameW
EnterCriticalSection
FormatMessageW
HeapReAlloc
GetProcessAffinityMask
GetCurrentProcessId
TlsSetValue
GetFileInformationByHandle
GetFileAttributesA
SetFileAttributesA
TlsGetValue
CompareStringW
WaitForSingleObject
VerSetConditionMask
RaiseException
lstrlenA
SetUnhandledExceptionFilter
CreateDirectoryW
VirtualAlloc
GetDateFormatW
SleepEx
WriteConsoleW
SetEvent
GetLastError
GetCommandLineA
VerifyVersionInfoW
EnumSystemLocalesW
TlsAlloc
FindNextFileW
ReleaseSRWLockExclusive
DeleteFileW
GetProcAddress
GetFileType
InitializeCriticalSectionEx
EncodePointer
GetTimeFormatW
IsProcessorFeaturePresent
DeleteFileA
SetEnvironmentVariableW
GetFullPathNameW
HeapAlloc
IsDebuggerPresent
FormatMessageA
GetFileSize
TerminateProcess
GetFileAttributesExW
LoadLibraryW
IsValidLocale
lstrcatA
LCMapStringEx
InitializeSListHead
MoveFileExW
CreateFileW
CreateDirectoryA
GetEnvironmentStringsW
GetDriveTypeW
GetStringTypeW
LoadLibraryA
InitializeCriticalSection
LoadLibraryExW
CreateSemaphoreA
GetTempPathW
GetModuleHandleExW
SetFilePointer
FindClose
ReleaseSemaphore
GetCurrentDirectoryA
LCMapStringW
GetSystemInfo
GetConsoleOutputCP
GetLocaleInfoW
PeekNamedPipe
GetStartupInfoW
GetTimeZoneInformation
UnhandledExceptionFilter
HeapFree
RtlUnwind
TlsFree
CloseHandle
RemoveDirectoryA
GetCommandLineW
FlushFileBuffers
MultiByteToWideChar
WideCharToMultiByte
WaitForMultipleObjects
RemoveDirectoryW
QueryPerformanceFrequency
GetEnvironmentVariableA
GetSystemTimeAsFileTime
AreFileApisANSI
GetStdHandle
InitializeCriticalSectionAndSpinCount
FreeLibraryAndExitThread
LocalFree
WaitForSingleObjectEx
HeapSize
ReadConsoleW
GetProcessHeap
GetCurrentThread
GetTickCount64
SetStdHandle
GetCurrentThreadId
SetFileTime
Sleep
FindFirstFileA
FileTimeToSystemTime
GetTempPathA
CreateEventA
GetUserDefaultLCID
ReadFile
GetModuleHandleA
GlobalMemoryStatus
QueryPerformanceCounter
ExitProcess
SetFilePointerEx
GetConsoleMode
GetCurrentDirectoryW
SetEndOfFile
SetLastError
GetACP
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
lstrcatW
FreeEnvironmentStringsW
WriteFile
DeleteCriticalSection
GetModuleFileNameA
IsValidCodePage
CreateThread
GetOEMCP
CreateFileA
GetSystemWow64DirectoryW
GetCurrentProcess
DecodePointer
GetCPInfo
FindFirstFileW
ExitThread
GetTickCount
FindNextFileA

user32

MessageBoxW
GetWindowLongA
SetWindowTextW
SetWindowTextA
SetWindowLongA
MessageBoxA
LoadIconA
ShowWindow
LoadStringW
LoadStringA
DialogBoxParamA
PostMessageA
CharUpperW
SetTimer
DestroyWindow
SendMessageA
DialogBoxParamW
EndDialog
KillTimer
CharUpperA
GetDlgItem
wsprintfA

shell32

SHGetSpecialFolderPathW

oleaut32

VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextW
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptEncrypt
RegCreateKeyExW
CryptCreateHash
CryptImportKey
CryptGetHashParam
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptReleaseContext

ole32

CoInitialize
CoUninitialize
CoCreateInstance

crypt32

CertCloseStore
CertOpenStore
CertFindCertificateInStore
PFXImportCertStore
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateContext
CertGetNameStringW
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryW
CertFindExtension

wldap32

ord147
ord133
ord301
ord79
ord142
ord46
ord145
ord219
ord167
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ord27
ord127

ws2_32

recvfrom
sendto
ioctlsocket
gethostname
WSACloseEvent
bind
send
freeaddrinfo
WSAEventSelect
WSAResetEvent
WSAEnumNetworkEvents
WSAIoctl
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
WSACreateEvent
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
getaddrinfo
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: restr

c61f65a7af6939836e7bbe4a515158f8

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

oleaut32

bcrypt

advapi32

ole32

crypt32

wldap32

ws2_32

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 212KB - Virtual size: 212KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 71KB - Virtual size: 71KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 212KB - Virtual size: 212KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 71KB - Virtual size: 71KB