InstallAgent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

InstallAgent.exe
Size

176KB
MD5

b1f0de61fda3999eb8a7a5c94b491d3d
SHA1

46cd87ea6886a23db0bd2d96af341595440a20af
SHA256

bc306612d18698803a2e263bd90d76a1bef678193b678eeffd5b663e32ce4ab0
SHA512

5870b660f03cf4fd04da4e6c2af156de6a4351784ce7edde792d9af07d5f787a1587a7e32da499f0a35a0543130234a04dcb11c4bb63a10816ce32a021236859
SSDEEP

3072:Pgu2jMjWcQYpoFEVQOQ2UIzI7L8f3U7glsogmfiIdvs+WJF1BjcSydGUu13Ns9:PfQOQ2+vYkwdfZd0+WdEdGZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallAgent.exe

Files

InstallAgent.exe
.exe windows x86

2ceeb7e6c995070451ba49a79402aeb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcmdln
_lock
__dllonexit
wcstoul
_onexit
_initterm
__setusermatherr
free
_ftol2
memcmp
__CxxFrameHandler3
?terminate@@YAXXZ
_controlfp
__p__fmode
_except_handler4_common
_vsnwprintf
malloc
memcpy_s
wcstombs
_errno
strtol
_set_errno
strncpy_s
strchr
sprintf_s
_wcsicmp
_purecall
memmove_s
mbstowcs
realloc
_ui64tow_s
_wtoi64
wcstok
_wtoi
_callnewh
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_unlock
memset

combase

ord154

api-ms-win-core-misc-l1-1-0

Sleep
LocalAlloc
LocalFree
FormatMessageW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventActivityIdControl
EventWrite
EventRegister
EventWriteTransfer

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

SetEvent
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateMutexW
OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
CreateMutexExW
InitOnceExecuteOnce
ReleaseSemaphore
CreateEventW
InitializeSRWLock

api-ms-win-core-heap-l1-2-0

HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
IsThreadpoolTimerSet
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameA
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegGetValueW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-file-l1-2-1

GetFileSizeEx
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
WriteFile
CreateFileW
CompareFileTime

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
FlushViewOfFile
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-security-base-l1-2-0

DuplicateToken
GetTokenInformation

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ceeb7e6c995070451ba49a79402aeb3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

combase

api-ms-win-core-misc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-registry-l1-1-1

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-security-sddl-l1-1-0

Sections

.text Size: 155KB - Virtual size: 154KB

.data Size: 2KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 216B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 155KB - Virtual size: 154KB

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB