158b93438a8d54328fef3c117bb59ef7

Sharing

Copy URL

Twitter E-mail

General

Target

158b93438a8d54328fef3c117bb59ef7
Size

5.5MB
MD5

158b93438a8d54328fef3c117bb59ef7
SHA1

aa24e314910adf064dff33b5106a6dd009e90c45
SHA256

179b4678a221ac2bb5059260512515eec9dd7a825287d3f71376b67371fa367b
SHA512

30b016d84ff1be67fd15a4cd66b2dec24713507f197a6e0b93dad5c9ff13be6701d4d46162cd0c085e641b5b2a83e42901bd907304fcb4f60bc96465a5c86360
SSDEEP

98304:prCupviDxaPqmbS5jR5sG6wKEU/1QoNMvCvzCC2bd6vO6W0GUEcqmdw8yPITd50I:prFpaEPdAN5UpFtlNMv22CCdJEEcqZ8P

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

158b93438a8d54328fef3c117bb59ef7
.exe windows:5 windows x86 arch:x86

9d548587322094d0e87b2c91202a14ff

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03-02-2015 00:00

Not After

03-03-2026 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:b3:dd:99:26:ca:1c:40:82:3e:38:31:cf:65:94:4d
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

31-07-2015 00:00

Not After

30-07-2016 23:59

Subject

CN=sirwilfridlauriertechnology.com,O=sirwilfridlauriertechnology.com,L=Montreal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

89:5d:25:81:95:32:1a:68:f9:5e:2c:f4:72:f0:db:45:46:cd:b8:2a
Signer

Actual PE Digest

89:5d:25:81:95:32:1a:68:f9:5e:2c:f4:72:f0:db:45:46:cd:b8:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

MultiByteToWideChar
GetShortPathNameA
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetLastError
lstrcmpiA
GetProcAddress
SearchPathA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MoveFileA
FindNextFileA
GetModuleHandleA
LoadLibraryExA
CloseHandle
DeleteFileA
GetFileSize
GetTickCount
GetModuleFileNameA
ExitProcess
SetErrorMode
GetCurrentProcess
GetWindowsDirectoryA
GetCommandLineA
CopyFileA
GetTempPathA
lstrcpynA
GlobalLock
GlobalUnlock
LoadLibraryA
GetDiskFreeSpaceA
CreateThread
CreateFileA
lstrlenA
CreateProcessA
GetSystemDirectoryA
lstrcatA
RemoveDirectoryA
GetTempFileNameA
GetVersion
SetStdHandle
WaitForSingleObject
IsProcessorFeaturePresent
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
ReadFile
LCMapStringW
HeapSize
RtlUnwind
HeapFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
EncodePointer
HeapCreate
GetModuleFileNameW
GetStdHandle
DecodePointer
GetModuleHandleW
GetStartupInfoW
HeapSetInformation
HeapAlloc
CompareFileTime
FreeLibrary
SetFilePointer
lstrcmpA
GetFullPathNameA
CreateFileW
MulDiv
GetExitCodeProcess
GetFileAttributesA
Sleep
GlobalAlloc
WriteFile
SetFileTime
GetStringTypeW
ExpandEnvironmentStringsA
WriteConsoleW

user32

SetCursor
DispatchMessageA
wvsprintfA
PeekMessageA
CharPrevA
MessageBoxIndirectA
SetDlgItemTextA
GetDlgItemTextA
DefWindowProcA
BeginPaint
GetClientRect
DrawTextA
FillRect
CloseClipboard
GetSystemMenu
ScreenToClient
GetWindowRect
TrackPopupMenu
LoadBitmapA
IsWindowEnabled
GetAsyncKeyState
GetWindowLongA
CreateWindowExA
EnableMenuItem
EmptyClipboard
SetClassLongA
EndDialog
SetWindowPos
CheckDlgButton
CreatePopupMenu
IsDlgButtonChecked
GetClassInfoA
AppendMenuA
OpenClipboard
SystemParametersInfoA
GetSystemMetrics
IsWindowVisible
SetClipboardData
CallWindowProcA
LoadCursorA
DialogBoxParamA
GetMessagePos
RegisterClassA
CharNextA
ExitWindowsEx
DestroyWindow
SetTimer
CreateDialogParamA
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
FindWindowExA
SendMessageA
GetDC
SetWindowLongA
InvalidateRect
GetDlgItem
SendMessageTimeoutA
ShowWindow
IsWindow
LoadImageA
EnableWindow
EndPaint
GetSysColor

gdi32

GetDeviceCaps
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
SelectObject
CreateBrushIndirect
SetBkColor

advapi32

RegSetValueExA
RegCloseKey
RegEnumKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
SHGetSpecialFolderLocation

ole32

OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 936KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d548587322094d0e87b2c91202a14ff

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

01:b3:dd:99:26:ca:1c:40:82:3e:38:31:cf:65:94:4dCertificate

Extended Key Usages

Key Usages

89:5d:25:81:95:32:1a:68:f9:5e:2c:f4:72:f0:db:45:46:cd:b8:2aSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 162KB

.ndata Size: - Virtual size: 936KB

.rsrc Size: 16KB - Virtual size: 15KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

01:b3:dd:99:26:ca:1c:40:82:3e:38:31:cf:65:94:4d
Certificate

89:5d:25:81:95:32:1a:68:f9:5e:2c:f4:72:f0:db:45:46:cd:b8:2a
Signer

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 162KB

.ndata
Size: - Virtual size: 936KB

.rsrc
Size: 16KB - Virtual size: 15KB