installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

installer.exe
Size

51.1MB
MD5

2802aaea098b45cf8556f7883bf5e297
SHA1

0c07067e19737369610a805e2949ecdfb47f372c
SHA256

ddcf7530cdaf151092562cccd1ccdd4cfd6c3b864b48a27993fd4530bb06170f
SHA512

fab5b8bac64a864ef4c0addb9bb2bcb92e7184d8492bf4d79ba099964b081be1ac67037fb7b0e83c07d1bed9913924119205591d6c379ac706065d4a7adb102d
SSDEEP

786432:ohaTcPvyT2vU+uHrLsc/uZ0NpTjYvH0fDhRarSnDGJA5sjEWVU5+:oAoXyTEUJLJm6nHYf6ykDGAC7VI+

Score

1^/10

Malware Config

Signatures

Files

installer.exe
.exe windows x64

ffd0fa11d62a03aa3299c02a14b1bf77

Code Sign

15:92:a0:92:8e:1c:8d:a0:75:d0:e4:6f:70:72:7d:16
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

22/02/2021, 00:00

Not After

19/02/2022, 23:59

Subject

CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,POSTALCODE=106,STREET=198\, 8F\, Sec. 2 Tun-Hwa S. Rd.,L=Taipei City,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:ad:e4:6d:b0:2a:2f:78:46:2a:29:37:27:e8:d8:74
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/03/2021, 00:00

Not After

08/06/2024, 23:59

Subject

CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Da’an District,ST=Taipei City,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8
Signer

Actual PE Digest

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8

Digest Algorithm

sha256

PE Digest Matches

false

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8
Signer

Actual PE Digest

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SizeofResource
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

advapi32

CryptCreateHash

user32

GetSystemMetrics

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

CryptDecodeObjectEx

ws2_32

connect

bcrypt

BCryptGenRandom

oleaut32

SysFreeString

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 629KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.,.9
Size: 29.9MB - Virtual size: 29.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pOG
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.k-R
Size: 20.3MB - Virtual size: 20.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffd0fa11d62a03aa3299c02a14b1bf77

Code Sign

15:92:a0:92:8e:1c:8d:a0:75:d0:e4:6f:70:72:7d:16Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:ad:e4:6d:b0:2a:2f:78:46:2a:29:37:27:e8:d8:74Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8Signer

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

ntdll

Sections

.text Size: 629KB - Virtual size: 629KB

.rdata Size: 180KB - Virtual size: 179KB

.data Size: 5KB - Virtual size: 10KB

.pdata Size: 22KB - Virtual size: 21KB

_RDATA Size: 512B - Virtual size: 348B

.,.9 Size: 29.9MB - Virtual size: 29.9MB

.pOG Size: 3KB - Virtual size: 3KB

.k-R Size: 20.3MB - Virtual size: 20.3MB

.reloc Size: 5KB - Virtual size: 4KB

.rsrc Size: 108KB - Virtual size: 107KB

15:92:a0:92:8e:1c:8d:a0:75:d0:e4:6f:70:72:7d:16
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:ad:e4:6d:b0:2a:2f:78:46:2a:29:37:27:e8:d8:74
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8
Signer

9f:44:a1:fd:f7:a3:98:4f:14:17:ee:12:2a:f2:46:23:f0:01:07:d1:4c:35:b2:fe:b5:96:9d:95:7e:dc:11:f8
Signer

.text
Size: 629KB - Virtual size: 629KB

.rdata
Size: 180KB - Virtual size: 179KB

.data
Size: 5KB - Virtual size: 10KB

.pdata
Size: 22KB - Virtual size: 21KB

_RDATA
Size: 512B - Virtual size: 348B

.,.9
Size: 29.9MB - Virtual size: 29.9MB

.pOG
Size: 3KB - Virtual size: 3KB

.k-R
Size: 20.3MB - Virtual size: 20.3MB

.reloc
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 108KB - Virtual size: 107KB