InstallAgentUserBroker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

InstallAgentUserBroker.exe
Size

218KB
MD5

3b8741f99dff1452aaa4548a36ee6a47
SHA1

f3b2d39b6b5149f6d8cb7383830ed1ca78e3f635
SHA256

f0d09606027d55e50302fc8566ef051f9be8fb84cb0d66b63851e78eb03ca34e
SHA512

c4dab344abd3d01e056ce2a23edf36628de319af10ecc510460b2b2a1dfcf5dafd43caadaa420cd9cc3c7143b6df1643031d73e23e70a72457c5eba314e4f80c
SSDEEP

6144:MTQQOQ2xTvJBcesCFUBUQZHhNbnA3nvYoUC4V/2Fl:MTGXxUBUQZB5A3ngoUC4Vq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallAgentUserBroker.exe

Files

InstallAgentUserBroker.exe
.exe windows x86

6bb61886cc6809aaaf4d110ced85bade

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
__CxxFrameHandler3
?terminate@@YAXXZ
__setusermatherr
_controlfp
_except_handler4_common
_lock
_unlock
_initterm
memcmp
_ftol2
wcschr
wcstoul
__p__fmode
_cexit
_onexit
__dllonexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_callnewh
rand
time
srand
sprintf_s
strrchr
wcstombs
_XcptFilter
_wcmdln
_vsnwprintf
_wcsdup
malloc
strncpy_s
_errno
strtol
_set_errno
strchr
_purecall
memmove_s
realloc
memcpy_s
mbstowcs
memset

cryptsp

CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerSetRequest
PowerClearRequest

api-ms-win-core-misc-l1-1-0

FormatMessageW
Sleep
LocalAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventActivityIdControl
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
CreateMutexW
ReleaseMutex
WaitForSingleObjectEx
InitOnceExecuteOnce
CreateEventW
SetEvent
AcquireSRWLockExclusive
CreateEventExW
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapSetInformation

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
GetStartupInfoW
GetCurrentThread
SetThreadToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetVersionExA

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegOpenCurrentUser
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-file-l1-2-1

CreateFileW
WriteFile

api-ms-win-security-base-l1-2-0

RevertToSelf

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-localization-l1-2-1

LCMapStringEx

ntdll

vDbgPrintEx
EtwEventWrite
RtlFreeHeap
RtlAllocateHeap
ZwClose
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
ZwAlpcConnectPort
RtlWaitOnAddress
RtlInitUnicodeString
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlConvertDeviceFamilyInfoToString
RtlGetDeviceFamilyInfoEnum

api-ms-win-appmodel-runtime-l1-1-0

PackageNameAndPublisherIdFromFamilyName

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bb61886cc6809aaaf4d110ced85bade

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

cryptsp

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-misc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-localization-l1-2-1

ntdll

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 195KB - Virtual size: 194KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 248B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 195KB - Virtual size: 194KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 248B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB