InstallAgent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

InstallAgent.exe
Size

176KB
MD5

e60b4c378eedaffe66020eb0e9acb5cc
SHA1

9a9fd8a7d71882c96e91733c71278afa31642ad5
SHA256

b8c5fc97bcfa88f6cc738b37bdbdc71f861092792d97f2898e70ff52e3d3b22e
SHA512

fa91dea521e067ca5f15987d8df41550f8c31458d5c518f599c494163440da13f4d83fc9360f830550b4ddcd51b00b3d3f5053c2493935a42e14c495f1e1ae60
SSDEEP

3072:/Nu2jMjWcwYpoFESQOQ2QoGjrGofbUjgNs8En/moo1clWJFM5BjLe+ydGgug3Nqu:/rQOQ2YC0wE8/1oilW05wXdGO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallAgent.exe

Files

InstallAgent.exe
.exe windows x86

2ceeb7e6c995070451ba49a79402aeb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcmdln
_lock
__dllonexit
wcstoul
_onexit
_initterm
__setusermatherr
free
_ftol2
memcmp
__CxxFrameHandler3
?terminate@@YAXXZ
_controlfp
__p__fmode
_except_handler4_common
_vsnwprintf
malloc
memcpy_s
wcstombs
_errno
strtol
_set_errno
strncpy_s
strchr
sprintf_s
_wcsicmp
_purecall
memmove_s
mbstowcs
realloc
_ui64tow_s
_wtoi64
wcstok
_wtoi
_callnewh
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_unlock
memset

combase

ord154

api-ms-win-core-misc-l1-1-0

Sleep
LocalAlloc
LocalFree
FormatMessageW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventActivityIdControl
EventWrite
EventRegister
EventWriteTransfer

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

SetEvent
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateMutexW
OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
CreateMutexExW
InitOnceExecuteOnce
ReleaseSemaphore
CreateEventW
InitializeSRWLock

api-ms-win-core-heap-l1-2-0

HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
IsThreadpoolTimerSet
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameA
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegGetValueW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-file-l1-2-1

GetFileSizeEx
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
WriteFile
CreateFileW
CompareFileTime

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
FlushViewOfFile
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-security-base-l1-2-0

DuplicateToken
GetTokenInformation

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ceeb7e6c995070451ba49a79402aeb3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

combase

api-ms-win-core-misc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-registry-l1-1-1

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-security-sddl-l1-1-0

Sections

.text Size: 155KB - Virtual size: 154KB

.data Size: 2KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 216B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 155KB - Virtual size: 154KB

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB