InstallAgentUserBroker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

InstallAgentUserBroker.exe
Size

218KB
MD5

9c534ad5262c08f6295d0b19193b694b
SHA1

ff3c0eefd816c269e7ebe81154d39c6ed4d1f0ff
SHA256

5164b671c40566dfb2e364fff0e1b6ee9cc91c6fd38a9d7c1ab02417aea47e4f
SHA512

df225575dbd5d7b7936f108f5accac591e26aa852742b8839e1a4f570cdc572e174858302822a867cc64c5ec552a6c237410965c0597ac20f16b61bd9434de2f
SSDEEP

6144:oQOQ2CNrifqc/rZXIllDvOEp6/xN8zAjet0JKwq9aJFF:FNriSoOOEp6p+AjeuJKwq9al

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallAgentUserBroker.exe

Files

InstallAgentUserBroker.exe
.exe windows x86

6bb61886cc6809aaaf4d110ced85bade

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
__CxxFrameHandler3
?terminate@@YAXXZ
__setusermatherr
_controlfp
_except_handler4_common
_lock
_unlock
_initterm
memcmp
_ftol2
wcschr
wcstoul
__p__fmode
_cexit
_onexit
__dllonexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_callnewh
rand
time
srand
sprintf_s
strrchr
wcstombs
_XcptFilter
_wcmdln
_vsnwprintf
_wcsdup
malloc
strncpy_s
_errno
strtol
_set_errno
strchr
_purecall
memmove_s
realloc
memcpy_s
mbstowcs
memset

cryptsp

CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerSetRequest
PowerClearRequest

api-ms-win-core-misc-l1-1-0

FormatMessageW
Sleep
LocalAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventActivityIdControl
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
CreateMutexW
ReleaseMutex
WaitForSingleObjectEx
InitOnceExecuteOnce
CreateEventW
SetEvent
AcquireSRWLockExclusive
CreateEventExW
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapSetInformation

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
GetStartupInfoW
GetCurrentThread
SetThreadToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetVersionExA

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegOpenCurrentUser
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-file-l1-2-1

CreateFileW
WriteFile

api-ms-win-security-base-l1-2-0

RevertToSelf

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-localization-l1-2-1

LCMapStringEx

ntdll

vDbgPrintEx
EtwEventWrite
RtlFreeHeap
RtlAllocateHeap
ZwClose
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
ZwAlpcConnectPort
RtlWaitOnAddress
RtlInitUnicodeString
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlConvertDeviceFamilyInfoToString
RtlGetDeviceFamilyInfoEnum

api-ms-win-appmodel-runtime-l1-1-0

PackageNameAndPublisherIdFromFamilyName

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bb61886cc6809aaaf4d110ced85bade

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

cryptsp

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-misc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-localization-l1-2-1

ntdll

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 195KB - Virtual size: 195KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 248B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 195KB - Virtual size: 195KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 248B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB