Install[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Install.exe
Size

232KB
MD5

5e059fa7f0f3188d10e5b31bdc42b4c8
SHA1

deb4fc0f008a03313e6758befcce712af6b2d10b
SHA256

fd14c14a6c778c49228161546041894814c620ce29f01572a8469085b7acda5f
SHA512

2bbb9098c37316e0f97c3dc3620f9b4d4a578aa1392663a75ccb6f99c4fbffc38986848007915c051b4758ae8aae9151defa5dceabc4fa352000aa3f6b6caa6d
SSDEEP

6144:ugdvwpewjSDRmrb4zXXTBTv9z4t3qW5G7utq:EpMRmrEjTpv9zwqW87utq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Install.exe

Files

Install.exe
.exe windows x86

d959e41e2e9dde1c3e29797cb8ad6d64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetUniversalNameW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
_lfind
iswspace
iswalpha
wcsncmp
_wmakepath
_wstati64
memmove
iswalnum
wcsstr
realloc
_wcsnicmp
towupper
free
malloc
_purecall
strcat
strchr
_vsnwprintf
_vsnprintf
wcschr
strlen
wcscmp
wcsrchr
vswprintf
_wtoi
memset
wcsncat
wcscat
wcscpy
swprintf
wcsncpy
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
memcpy
__CxxFrameHandler

kernel32

CreateProcessW
OpenProcess
InterlockedIncrement
InterlockedExchangeAdd
GetLastError
GetStartupInfoA
GetModuleHandleA
GetCurrentProcess
GetTimeZoneInformation
LCMapStringW
CompareStringW
CompareStringA
QueryDosDeviceW
GetDriveTypeW
GetFullPathNameW
GetTempFileNameW
GetTempPathW
FindNextFileW
FindFirstFileExW
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
RemoveDirectoryW
CreateDirectoryW
CopyFileW
MoveFileW
DeleteFileW
CreateFileW
FileTimeToSystemTime
SystemTimeToFileTime
GetFileTime
SetLastError
SetFileTime
SetErrorMode
SetFileValidData
SetEndOfFile
FlushFileBuffers
UnlockFileEx
UnlockFile
LockFileEx
LockFile
SetFilePointer
ReadFile
WriteFile
GetVolumeInformationW
GetLogicalDriveStringsW
GetFileInformationByHandle
GetProcAddress
LoadLibraryW
LocalFree
FormatMessageW
GetCurrentProcessId
WideCharToMultiByte
GetVersionExW
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
GetPrivateProfileStringW
Sleep
GetExitCodeProcess
CloseHandle
GetProfileIntW
InterlockedDecrement

user32

GetSystemMetrics
CharUpperW
GetDesktopWindow
LoadStringW
GetForegroundWindow
SetCursor
LoadCursorW
GetActiveWindow
SendMessageW
IsWindow
MessageBoxW

shell32

ShellExecuteExW

Exports

Exports

CommandeComposante

Sections

.text
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d959e41e2e9dde1c3e29797cb8ad6d64

Headers

File Characteristics

Imports

mpr

msvcrt

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 80KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 104KB - Virtual size: 101KB

.text
Size: 84KB - Virtual size: 80KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 104KB - Virtual size: 101KB