Installe[.]exe[.]vir

Sharing

Copy URL

Twitter E-mail

General

Target

Installe.exe.vir
Size

1.0MB
MD5

9652452e6863bfcb4fb2c1c20702ca7f
SHA1

698dce4f4d06fafa486a0ac8c4d3913c249e429c
SHA256

84cc4306c04df6e4d2f0431f538e6612c2bf72ee57d0bac23ed3a19936b3ed73
SHA512

94c2e873e8c41ce73de756be3354db4bb1bbf615b4a331afa592332f5ef1f4b38d033840558ebc3f2551e7535238fdf71bede61df61a0e604a8ee75f4895a916
SSDEEP

24576:trVMSqfnuFiD4GQg2JmTedvip7V+3bNmgKtoKm6v0G1a:trVxsnm3+SAsN/BJka

Score

1^/10

Malware Config

Signatures

Files

Installe.exe.vir
.exe windows x64

17f1c6a7e23412a1437c57618bb9a6ad

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:82:04:4c:a4:01:e9:3e:dd:4c:5b:52:b1:cd:f6:8b
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

24-08-2021 00:00

Not After

29-08-2023 23:59

Subject

CN=漳州大盛软件有限公司,O=漳州大盛软件有限公司,L=漳州市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

98:27:f1:47:d1:87:e0:78:85:20:0c:fe:4d:dd:55:f6:82:ad:38:bc
Signer

Actual PE Digest

98:27:f1:47:d1:87:e0:78:85:20:0c:fe:4d:dd:55:f6:82:ad:38:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetACP
VerSetConditionMask
FreeLibrary
GetModuleHandleExW
LoadLibraryA
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetThreadExecutionState
SetEndOfFile
HeapSize
ReadConsoleW
ReadFile
FlushFileBuffers
CreateFileW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileType
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
HeapAlloc
HeapFree
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
RtlUnwind
LoadLibraryExW
SetLastError
RtlUnwindEx
RaiseException
RtlPcToFileHeader
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
InitializeCriticalSectionAndSpinCount
CloseHandle
GetCPInfo
GetStringTypeW
LCMapStringEx
WriteConsoleW
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetVersionExA
SetProcessMitigationPolicy
CreateProcessA
GetCurrentProcess
GetLastError
FindNextFileW
FindFirstFileW
FindClose
CreateFileA
CreateDirectoryA

user32

GetRawInputDeviceInfoA
GetRawInputDeviceList
RegisterRawInputDevices
GetRawInputData
MessageBoxA
MonitorFromWindow
LoadImageW
DestroyIcon
LoadCursorW
GetWindowLongW
PtInRect
SetRect
ClipCursor
WindowFromPoint
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetClientRect
RemovePropW
GetPropW
ReleaseCapture
SetCapture
GetKeyState
SetWindowLongW
SetWindowPos
RegisterClassExW
UnregisterClassW
DefWindowProcW
GetMessageTime
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
SystemParametersInfoW
MapVirtualKeyW
ToUnicode
ShowWindow
DestroyWindow
CreateWindowExW
UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
DispatchMessageW
TranslateMessage

gdi32

CreateRectRgn
SetDeviceGammaRamp
GetDeviceCaps
DeleteDC
CreateDCW
DeleteObject

shell32

DragFinish
DragQueryPoint
DragQueryFileW
SHGetKnownFolderPath

ole32

CoTaskMemFree

Sections

.text
Size: 411KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 613KB - Virtual size: 613KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17f1c6a7e23412a1437c57618bb9a6ad

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:82:04:4c:a4:01:e9:3e:dd:4c:5b:52:b1:cd:f6:8bCertificate

Extended Key Usages

Key Usages

98:27:f1:47:d1:87:e0:78:85:20:0c:fe:4d:dd:55:f6:82:ad:38:bcSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

Sections

.text Size: 411KB - Virtual size: 410KB

.rdata Size: 613KB - Virtual size: 613KB

.data Size: 8KB - Virtual size: 25KB

.pdata Size: 10KB - Virtual size: 10KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 3KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:82:04:4c:a4:01:e9:3e:dd:4c:5b:52:b1:cd:f6:8b
Certificate

98:27:f1:47:d1:87:e0:78:85:20:0c:fe:4d:dd:55:f6:82:ad:38:bc
Signer

.text
Size: 411KB - Virtual size: 410KB

.rdata
Size: 613KB - Virtual size: 613KB

.data
Size: 8KB - Virtual size: 25KB

.pdata
Size: 10KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 3KB