Main_Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Main_Installer.exe
Size

27.6MB
MD5

f34108afae12c6e44d86e2719a8fc6c4
SHA1

923435e3d1959be92b77b72eafa0928811658ac4
SHA256

28395b69992f847ed4a31e8ccd1def28d5eb4a42826ee7bd7a22523df583e6f7
SHA512

eb10fc57f120ec6843bc2cae65fb7ae6f35a1ad642406a884729a0351b49157271cdc44612e2d0ae9eaaa3c88747e4467aa55427f44ae90506d1702728f26f4c
SSDEEP

393216:eM9zRGHfD8JdOs9E0MFj5sTtnIGg9y+qwbjcax+m+b6QnZdmw8NeWOY4EbFow1O:eucw5Xm5atnIGg9MFfCw48Y4EpR1O

Score

1^/10

Malware Config

Signatures

Files

Main_Installer.exe
.exe windows x64

349ad6ed7592b66bc5d63a8931001fa9

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:8e:a0:8e:8c:21:87:e6:87:59:78:b8:ca:92:c9:1f
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

05/12/2022, 00:00

Not After

04/12/2025, 23:59

Subject

CN=Digital Detective Group limited,O=Digital Detective Group limited,ST=Kent,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:8e:a0:8e:8c:21:87:e6:87:59:78:b8:ca:92:c9:1f
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

05/12/2022, 00:00

Not After

04/12/2025, 23:59

Subject

CN=Digital Detective Group limited,O=Digital Detective Group limited,ST=Kent,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e6:4b:78:65:c6:e5:4f:5c:00:3e:1e:59:f3:d6:e9:0b:83:33:eb:26:78:be:40:6c:2b:47:3e:b6:8f:10:30:62
Signer

Actual PE Digest

e6:4b:78:65:c6:e5:4f:5c:00:3e:1e:59:f3:d6:e9:0b:83:33:eb:26:78:be:40:6c:2b:47:3e:b6:8f:10:30:62

Digest Algorithm

sha256

PE Digest Matches

false

ea:d6:df:f2:d8:52:b3:56:18:b7:de:0b:b5:87:e0:92:d1:28:df:25
Signer

Actual PE Digest

ea:d6:df:f2:d8:52:b3:56:18:b7:de:0b:b5:87:e0:92:d1:28:df:25

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

msvcrt

__getmainargs

ntdll

NtCancelIoFileEx
NtCreateFile

advapi32

AllocateAndInitializeSid

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore

iphlpapi

FreeMibTable

netapi32

NetApiBufferFree

ole32

CoCreateInstance

oleaut32

GetErrorInfo

pdh

PdhAddEnglishCounterW

powrprof

CallNtPowerInformation

secur32

AcceptSecurityContext

shell32

CommandLineToArgvW

user32

MessageBoxW

ws2_32

WSACleanup

psapi

GetModuleFileNameExW

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 736B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orta0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.orta1
Size: - Virtual size: 16.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orta2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orta3
Size: 27.6MB - Virtual size: 27.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

349ad6ed7592b66bc5d63a8931001fa9

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e0:8e:a0:8e:8c:21:87:e6:87:59:78:b8:ca:92:c9:1fCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e0:8e:a0:8e:8c:21:87:e6:87:59:78:b8:ca:92:c9:1fCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e6:4b:78:65:c6:e5:4f:5c:00:3e:1e:59:f3:d6:e9:0b:83:33:eb:26:78:be:40:6c:2b:47:3e:b6:8f:10:30:62Signer

ea:d6:df:f2:d8:52:b3:56:18:b7:de:0b:b5:87:e0:92:d1:28:df:25Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

advapi32

bcrypt

crypt32

iphlpapi

netapi32

ole32

oleaut32

pdh

powrprof

secur32

shell32

user32

ws2_32

psapi

Sections

.text Size: - Virtual size: 1.0MB

.data Size: - Virtual size: 624B

.rdata Size: - Virtual size: 407KB

.pdata Size: - Virtual size: 29KB

.xdata Size: - Virtual size: 35KB

.bss Size: - Virtual size: 736B

.idata Size: - Virtual size: 9KB

.CRT Size: - Virtual size: 112B

.tls Size: - Virtual size: 16B

.orta0 Size: - Virtual size: 24KB

.orta1 Size: - Virtual size: 16.3MB

.orta2 Size: 4KB - Virtual size: 3KB

.orta3 Size: 27.6MB - Virtual size: 27.6MB

.reloc Size: 512B - Virtual size: 252B

.rsrc Size: 24KB - Virtual size: 24KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e0:8e:a0:8e:8c:21:87:e6:87:59:78:b8:ca:92:c9:1f
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e0:8e:a0:8e:8c:21:87:e6:87:59:78:b8:ca:92:c9:1f
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e6:4b:78:65:c6:e5:4f:5c:00:3e:1e:59:f3:d6:e9:0b:83:33:eb:26:78:be:40:6c:2b:47:3e:b6:8f:10:30:62
Signer

ea:d6:df:f2:d8:52:b3:56:18:b7:de:0b:b5:87:e0:92:d1:28:df:25
Signer

.text
Size: - Virtual size: 1.0MB

.data
Size: - Virtual size: 624B

.rdata
Size: - Virtual size: 407KB

.pdata
Size: - Virtual size: 29KB

.xdata
Size: - Virtual size: 35KB

.bss
Size: - Virtual size: 736B

.idata
Size: - Virtual size: 9KB

.CRT
Size: - Virtual size: 112B

.tls
Size: - Virtual size: 16B

.orta0
Size: - Virtual size: 24KB

.orta1
Size: - Virtual size: 16.3MB

.orta2
Size: 4KB - Virtual size: 3KB

.orta3
Size: 27.6MB - Virtual size: 27.6MB

.reloc
Size: 512B - Virtual size: 252B

.rsrc
Size: 24KB - Virtual size: 24KB