installer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

installer.exe
Size

7.2MB
MD5

2809917a65e95c620b4ae0a1cd306cc9
SHA1

a890e6d7fe46b6814cb2f3999da140376e93bcee
SHA256

1434de7307519e2732e1acc5649bfca0f6e01e08b608729d32d25bd422477260
SHA512

e7701d273b59402d7efb76cc091d9fe37637d45ad1e7e024538d50077cfd4477d0c7398dad8837d3f8709625ecc7765bc5db0d9ed0ed92c6fe9c51fe25a13cef
SSDEEP

196608:bDzAHx2j0drDiW5aLPvc2Eea/fjOwVuCsjcmb5pb77y5/2u22Lxibh713c27Nnns:bDzAHx2j0drDiW5aLPvvEea/fjOwVuCv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
installer.exe

Files

installer.exe
.exe windows:6 windows x86

b67375c88f9ba57913df589c3f54308c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
TryAcquireSRWLockExclusive
GetTempPathW
GetSystemTimeAsFileTime
TlsFree
lstrlenW
InitOnceComplete
TlsAlloc
InitOnceBeginInitialize
CreateThread
ReadConsoleW
WideCharToMultiByte
MultiByteToWideChar
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFullPathNameW
ExitProcess
GetConsoleMode
CreateEventW
CopyFileExW
GetFinalPathNameByHandleW
RemoveDirectoryW
MoveFileExW
DeleteFileW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
FindNextFileW
CreateMutexA
WaitForSingleObjectEx
HeapReAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
WaitNamedPipeW
CreateFileW
LoadLibraryExW
DisconnectNamedPipe
FreeLibrary
GetEnvironmentVariableW
CreateNamedPipeW
ConnectNamedPipe
WakeConditionVariable
GetProcessHeap
HeapFree
WakeAllConditionVariable
TerminateProcess
ReadFileEx
FormatMessageW
GetUserDefaultLocaleName
WaitForSingleObject
SleepEx
HeapAlloc
Sleep
ReleaseSRWLockShared
GetFileInformationByHandle
WriteFileEx
GetStdHandle
GetTickCount64
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
SetFilePointerEx
GetProcessTimes
GetExitCodeProcess
DuplicateHandle
GetCurrentProcessId
LoadLibraryA
SetFileInformationByHandle
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetLogicalDrives
FlushFileBuffers
WriteFile
ReadFile
GetNamedPipeServerProcessId
GetNamedPipeClientProcessId
GetProcAddress
GetSystemInfo
GetLastError
GetCurrentDirectoryW
SetLastError
RtlCaptureContext
GetCurrentThread
SwitchToThread
OpenProcess
SetThreadStackGuarantee
GetSystemTimes
GetProcessIoCounters
AddVectoredExceptionHandler
CompareStringOrdinal
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
FindClose
ReleaseMutex
FreeEnvironmentStringsW
SetFileCompletionNotificationModes
SleepConditionVariableSRW
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetHandleInformation
Process32Next
Process32First
AcquireSRWLockShared
CreateToolhelp32Snapshot
TlsSetValue
TlsGetValue
GetUserDefaultUILanguage
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LCIDToLocaleName
SetEvent
LoadLibraryW
IsProcessorFeaturePresent
RtlUnwind
RaiseException
GetModuleHandleW
GetCurrentProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WriteConsoleW
CloseHandle
EncodePointer

advapi32

RegCreateKeyExW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegCloseKey
RegQueryValueExW
LookupAccountSidW
CopySid
GetLengthSid
EventRegister
RegOpenKeyExW
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
SystemFunction036
IsValidSid

user32

RegisterTouchWindow
CreateAcceleratorTableW
ToUnicodeEx
PostQuitMessage
AppendMenuW
CreateMenu
CheckMenuItem
SetMenuItemInfoW
CreateIcon
IsWindowVisible
AdjustWindowRectEx
DestroyAcceleratorTable
GetKeyboardLayout
GetRawInputData
VkKeyScanW
SetWindowPos
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
GetKeyboardState
GetMenu
InvalidateRgn
SystemParametersInfoA
PostMessageW
DestroyIcon
IsProcessDPIAware
GetDC
DestroyWindow
RedrawWindow
ShowCursor
ValidateRect
GetMessageA
GetClipCursor
PostThreadMessageW
SendMessageW
GetSystemMetrics
EnableMenuItem
PeekMessageW
GetSystemMenu
GetUpdateRect
MapVirtualKeyW
GetMessageW
ShowWindow
GetAncestor
TranslateAcceleratorW
DispatchMessageA
TranslateMessage
GetWindowRect
DispatchMessageW
DefWindowProcW
FlashWindowEx
MonitorFromRect
IsWindow
TrackMouseEvent
GetWindowLongW
GetClientRect
ClientToScreen
GetTouchInputInfo
ScreenToClient
SetWindowDisplayAffinity
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
MonitorFromPoint
EnumDisplayMonitors
SetCapture
SetWindowLongW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterClassExW
RegisterWindowMessageA
CloseTouchInputHandle
CreateWindowExW
EnumChildWindows
MessageBoxW
GetCursorPos
ClipCursor
SetForegroundWindow
SendInput
AllowSetForegroundWindow
GetForegroundWindow
GetActiveWindow
SetCursorPos
ReleaseCapture
IsIconic
SetMenu
LoadCursorW
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
GetMonitorInfoW
SetCursor
MonitorFromWindow

gdi32

GetDeviceCaps
CreateRectRgn
DeleteObject

dwmapi

DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
DwmEnableBlurBehindWindow

ole32

CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
RevokeDragDrop
RegisterDragDrop
CoInitializeEx
CoCreateInstance
OleInitialize
CoSetProxyBlanket
CoInitializeSecurity

comctl32

RemoveWindowSubclass
SetWindowSubclass
DefSubclassProc

shell32

DragQueryFileW
SHAppBarMessage
DragFinish
ShellExecuteW
SHGetKnownFolderPath

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

oleaut32

SetErrorInfo
SysAllocString
VariantClear
SysStringLen
GetErrorInfo
SysFreeString

pdh

PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryA
PdhGetFormattedCounterValue
PdhAddEnglishCounterW

ntdll

NtCreateFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtWriteFile
NtQuerySystemInformation
NtReadFile

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2
GetAdaptersAddresses

powrprof

CallNtPowerInformation

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum

secur32

FreeContextBuffer
LsaFreeReturnBuffer
ApplyControlToken
InitializeSecurityContextW
DeleteSecurityContext
QueryContextAttributesW
FreeCredentialsHandle
EncryptMessage
AcquireCredentialsHandleA
LsaGetLogonSessionData
LsaEnumerateLogonSessions
DecryptMessage
AcceptSecurityContext

ws2_32

ioctlsocket
getsockopt
shutdown
getsockname
recv
bind
WSASocketW
send
WSASend
setsockopt
connect
WSAIoctl
WSAGetLastError
closesocket
freeaddrinfo
getaddrinfo
WSAStartup
WSACleanup
getpeername

crypt32

CertDuplicateStore
CertDuplicateCertificateChain
CertCloseStore
CertFreeCertificateContext
CertOpenStore
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertGetCertificateChain
CertFreeCertificateChain

psapi

GetModuleFileNameExW
GetPerformanceInfo

api-ms-win-crt-math-l1-1-0

pow
round
trunc
floor
log
__setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen
strcpy_s
_wcsicmp
wcsncmp

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
malloc
free
calloc
realloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_controlfp_s
_set_app_type
_register_thread_local_exe_atexit_callback
terminate
_cexit
__p___argv
__p___argc
_configure_narrow_argv
abort
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_c_exit
_crt_atexit
_exit
exit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b67375c88f9ba57913df589c3f54308c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

gdi32

dwmapi

ole32

comctl32

shell32

uxtheme

bcrypt

oleaut32

pdh

ntdll

iphlpapi

powrprof

netapi32

secur32

ws2_32

crypt32

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 7KB - Virtual size: 9KB

.rsrc Size: 46KB - Virtual size: 45KB

.reloc Size: 194KB - Virtual size: 194KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 7KB - Virtual size: 9KB

.rsrc
Size: 46KB - Virtual size: 45KB

.reloc
Size: 194KB - Virtual size: 194KB