13528a3095d0d16150d2c88a67cda332

Sharing

Copy URL Twitter E-mail

General

Target

13528a3095d0d16150d2c88a67cda332
Size

3.4MB
MD5

13528a3095d0d16150d2c88a67cda332
SHA1

e53942d1d266a50c5c1c3cfe21aac0c5ea44c9c1
SHA256

e5a4bf44d8bfd902a9f8c1cfbf375d6a790dc3fb932cff4af5ce2155f2da2b2a
SHA512

ea2ef45e2f6d6668cbf5133eaa0ec8630a88dc09297c2715fb983b5436da076d5346ddd1df63fcf5972a21555ab32c2c97b098221e7df251f1b247f7b36c9a06
SSDEEP

98304:QiS/OWK4e9VYAtZqGJaUx9O8W5zsBbp5:nSmN9aAmGFxWdsBN5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13528a3095d0d16150d2c88a67cda332

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

13528a3095d0d16150d2c88a67cda332
.exe windows:5 windows x86 arch:x86

492a58c8f9bc11f2b066a0b43afcfa94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
GetProcAddress
CreateProcessA
FindResourceA
LoadResource
Process32First
SizeofResource
GetTempPathA
GetTempFileNameA
DeleteFileA
CreateMutexA
GetLastError
CreateToolhelp32Snapshot
LockResource
GetVolumeInformationA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DecodePointer
EncodePointer
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
CloseHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
LoadLibraryW
CreateFileA
WriteConsoleW
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
LCMapStringW
GetStringTypeW
HeapReAlloc
SetEndOfFile
GetProcessHeap
ReadFile
CreateFileW

advapi32

RegOpenKeyExA
RegQueryValueExA

shlwapi

PathFileExistsA
SHSetValueA

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

492a58c8f9bc11f2b066a0b43afcfa94

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shlwapi

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 14KB - Virtual size: 13KB