ProInstaller_0001[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ProInstaller_0001.exe
Size

36.7MB
MD5

5069bc5e8d91b6873f95df192b733841
SHA1

2bd67f32d56d1876264f549b57bad631e44a3f71
SHA256

a7a57c218b206308e4614a1026c224b48f3fd407f12f594661b932c8df75c4b6
SHA512

bc626435d078dbbb2b4504c424e7303efa4d1426bebe5ca231f8b00da007244717b5f784c50c0794ed020a72532be4e33b30870550ffbc9888d429883f4387a1
SSDEEP

786432:dLTwht+he09FQupb9cVRN3rbGZO6EHJQkK8tImPsUAbb88GtN0ABpuT0E:QRN3WZ3EpQkK8tpK/8BaqpuTZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProInstaller_0001.exe

Files

ProInstaller_0001.exe
.exe windows:6 windows x86

74a67995a00368577571949e3dd9274c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibraryAndExitThread
CloseHandle
SleepEx
LCMapStringEx
CreateFileW
GetProcessAffinityMask
VerSetConditionMask
SetEvent
QueryPerformanceFrequency
FindFirstFileW
WriteFile
CreateDirectoryW
CreateSemaphoreA
GetFileAttributesW
Sleep
GetCurrentThreadId
IsDebuggerPresent
FindNextFileA
GetProcAddress
CreateDirectoryA
MoveFileW
GetStdHandle
GetLogicalDriveStringsW
FormatMessageA
IsValidCodePage
FindFirstFileA
ReleaseSemaphore
FileTimeToSystemTime
WaitForSingleObject
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleExW
GlobalAlloc
GetEnvironmentStringsW
SetPriorityClass
GetFileType
FreeLibrary
DeleteFileA
ExitProcess
GlobalUnlock
GetFileSizeEx
GetModuleHandleA
ExitThread
FindClose
GetCurrentProcessId
lstrcatA
ReadConsoleW
WaitForSingleObjectEx
GetFileAttributesExW
GetStringTypeW
GetEnvironmentVariableA
lstrcatW
HeapReAlloc
lstrlenA
GetDriveTypeW
VirtualAlloc
GetUserDefaultLCID
TlsAlloc
GetConsoleOutputCP
IsProcessorFeaturePresent
TerminateProcess
SetEndOfFile
ResetEvent
LeaveCriticalSection
HeapSize
GetLogicalDriveStringsA
SetFileAttributesA
SetLastError
FormatMessageW
TlsFree
InitializeSListHead
LoadLibraryExW
GetFileSize
GetCurrentThread
SetUnhandledExceptionFilter
VerifyVersionInfoW
DeleteFileW
EnumSystemLocalesW
CompareFileTime
ReleaseSRWLockExclusive
LoadLibraryW
CreateFileA
GetACP
GetSystemTimeAsFileTime
EncodePointer
SetFilePointerEx
LCMapStringW
GetSystemDirectoryW
lstrlenW
GetTimeFormatW
GetFileInformationByHandle
SetStdHandle
GetTickCount64
SystemTimeToTzSpecificLocalTime
FreeEnvironmentStringsW
EnterCriticalSection
DecodePointer
GetCPInfo
GetModuleHandleW
RtlUnwind
DeleteCriticalSection
GetCommandLineW
MultiByteToWideChar
FlushFileBuffers
RemoveDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
GetProcessHeap
GetModuleFileNameA
CompareStringW
AreFileApisANSI
SetFileTime
TlsSetValue
InitializeCriticalSectionAndSpinCount
PeekNamedPipe
LoadLibraryA
GlobalLock
FileTimeToLocalFileTime
SetFilePointer
GetOEMCP
GetFullPathNameW
InitializeCriticalSection
GetFileAttributesA
RemoveDirectoryA
GlobalMemoryStatus
InitializeCriticalSectionEx
CreateThread
HeapAlloc
GetLastError
GetLocaleInfoW
QueryPerformanceCounter
ReadFile
HeapFree
UnhandledExceptionFilter
LocalFree
IsValidLocale
GetCurrentDirectoryA
GetCommandLineA
RaiseException
GetVersionExA
WideCharToMultiByte
GetStartupInfoW
GetCurrentDirectoryW
WriteConsoleW
AcquireSRWLockExclusive
FindNextFileW
WaitForMultipleObjects
VirtualFree
GetSystemInfo
MoveFileExW
TlsGetValue
GetTimeZoneInformation
GlobalFree
CreateEventA
GetTickCount
FindFirstFileExW
MoveFileA
GetDateFormatW
GetCurrentProcess
GetConsoleMode

user32

SetWindowLongA
SetWindowTextA
CloseClipboard
MessageBoxA
OpenClipboard
SetCursor
ShowWindow
GetMonitorInfoA
LoadCursorA
CheckDlgButton
GetKeyState
CharUpperA
GetWindowTextW
MoveWindow
CharUpperW
SetClipboardData
MonitorFromWindow
EndDialog
LoadStringA
ScreenToClient
DialogBoxParamA
EnableWindow
GetWindowTextA
KillTimer
MapDialogRect
InvalidateRect
GetWindowTextLengthA
SetFocus
GetWindowRect
GetWindowLongA
SendMessageA
GetFocus
DialogBoxParamW
SendMessageW
MessageBoxW
SystemParametersInfoA
SetTimer
SetWindowTextW
GetWindowTextLengthW
wsprintfA
IsDlgButtonChecked
LoadStringW
GetParent
GetDlgItem
PostMessageA
EmptyClipboard
LoadIconA

advapi32

RegCreateKeyExW
CryptReleaseContext
CryptGetHashParam
RegCloseKey
CryptDestroyHash
CryptCreateHash
CryptEncrypt
RegOpenKeyExW
CryptAcquireContextW
CryptDestroyKey
RegSetValueExW
CryptHashData
CryptImportKey

shell32

SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize
OleInitialize

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain
CryptDecodeObjectEx
CertCloseStore
CertGetNameStringW
CertAddCertificateContextToStore
CertFreeCertificateContext
PFXImportCertStore
CertFindCertificateInStore
CryptQueryObject
CertOpenStore
CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptStringToBinaryW
CertEnumCertificatesInStore
CertFindExtension

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ord27

ws2_32

getpeername
sendto
recvfrom
getaddrinfo
socket
ioctlsocket
gethostname
getsockopt
send
WSAIoctl
WSAWaitForMultipleEvents
WSACreateEvent
WSAResetEvent
WSACloseEvent
WSAEventSelect
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
freeaddrinfo
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSAEnumNetworkEvents

Sections

.text
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74a67995a00368577571949e3dd9274c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.4MB - Virtual size: 6.4MB

.rdata Size: 230KB - Virtual size: 230KB

.data Size: 8KB - Virtual size: 28KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 78KB - Virtual size: 78KB

.text
Size: 6.4MB - Virtual size: 6.4MB

.rdata
Size: 230KB - Virtual size: 230KB

.data
Size: 8KB - Virtual size: 28KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 78KB - Virtual size: 78KB