Essential Mod Installer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Essential Mod Installer.exe
Size

4.7MB
MD5

93b74906fa88b768c55a5c57270f9670
SHA1

c43bc8dec779c69d7a85a09ccefa40c79d9c5c40
SHA256

bbe0d109835abda56b734609867b6dac2af5e776dd45643f02c1670b77c68f22
SHA512

2a9449ca206966fa98bb985ccb755d9a326fdfc5a6ba052fcd443aa719bc0b223f6e59b2573b2e9e2e6dc9b1e56080632c952b01e6020dda3ecdab11cd8f0f1c
SSDEEP

49152:InJ/cj7TIBPZnI90iitgoNF9AdWoiRD1rqQEecyJ5csOoH0hZoXGFG7OfhPzveVV:GJy7TMnI9k+cDxjJys2U0AsU4PrVqPT

Score

1^/10

Malware Config

Signatures

Files

Essential Mod Installer.exe
.exe windows:6 windows x64 arch:x64

92ea423385af38258a6386ff43dc6f11

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:ad:aa:47:e6:c8:0e:1f:b3:82:7c:e7:10:2b:19:ef
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

15-08-2022 00:00

Not After

08-09-2023 23:59

Subject

CN=ModCore Inc,O=ModCore Inc,L=Mount Vernon,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:24:20:04:72:39:ff:2e:b4:b4:75:dc:a6:1b:11:6c:83:45:f5:4b
Signer

Actual PE Digest

d2:24:20:04:72:39:ff:2e:b4:b4:75:dc:a6:1b:11:6c:83:45:f5:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
NtCancelIoFileEx

kernel32

WakeAllConditionVariable
GetModuleHandleA
Sleep
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetSystemInfo
UnmapViewOfFile
SetThreadErrorMode
FreeLibrary
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
SetFilePointerEx
SwitchToThread
ReleaseSRWLockExclusive
VirtualProtect
DuplicateHandle
MapViewOfFile
CreateFileMappingW
LoadLibraryExW
AcquireSRWLockExclusive
GlobalUnlock
QueryPerformanceCounter
GlobalLock
GlobalFree
SetHandleInformation
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
FormatMessageW
GetTempPathW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
GetFullPathNameW
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
ReadFileEx
SleepEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetFileAttributesW
GetModuleFileNameW
GetWindowsDirectoryW
CreateProcessW
GetCurrentProcessId
CreateNamedPipeW
CreateThread
WriteFileEx
GetModuleHandleW
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceFrequency
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
GetCurrentThreadId
GetCurrentProcess
PostQueuedCompletionStatus
FindFirstFileW
FindClose
RemoveVectoredExceptionHandler
GetLastError
GetProcAddress
CloseHandle
GlobalSize
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
CreateEventA
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SleepConditionVariableSRW
SetUnhandledExceptionFilter
WakeConditionVariable
lstrlenW
IsProcessorFeaturePresent

user32

GetMenu
AdjustWindowRectEx
ShowCursor
ClipCursor
ToUnicodeEx
GetRawInputData
GetClipCursor
RegisterWindowMessageA
GetActiveWindow
SetWindowLongW
GetKeyState
IsProcessDPIAware
SendMessageW
GetDC
MsgWaitForMultipleObjectsEx
ChangeDisplaySettingsExW
SystemParametersInfoA
SetClipboardData
EmptyClipboard
GetClipboardData
OpenClipboard
PostMessageW
GetMonitorInfoW
RedrawWindow
RegisterClassExW
CreateWindowExW
SetWindowLongPtrW
GetMessageW
TranslateMessage
GetKeyboardLayout
ShowWindow
DispatchMessageW
GetKeyboardState
DestroyWindow
CloseClipboard
SetWindowPos
InvalidateRgn
GetClientRect
DestroyIcon
SetForegroundWindow
SendInput
MapVirtualKeyW
SetWindowTextW
GetWindowLongPtrW
MonitorFromPoint
ReleaseCapture
RegisterRawInputDevices
MonitorFromWindow
GetCursorPos
ClientToScreen
GetWindowLongW
CloseTouchInputHandle
GetTouchInputInfo
MonitorFromRect
SetCursor
LoadCursorW
MapVirtualKeyA
ScreenToClient
SetCapture
GetWindowPlacement
SetWindowPlacement
TrackMouseEvent
RegisterTouchWindow
GetSystemMetrics
GetUpdateRect
PeekMessageW
PostThreadMessageW
ValidateRect
DefWindowProcW

advapi32

RegQueryValueExW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
GetTokenInformation
SystemFunction036

ws2_32

getsockopt
WSASend
shutdown
setsockopt
bind
WSAGetLastError
freeaddrinfo
WSAStartup
WSACleanup
recv
send
getpeername
getsockname
connect
ioctlsocket
WSASocketW
getaddrinfo
closesocket
WSAIoctl

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoCreateInstance
RegisterDragDrop
OleInitialize
RevokeDragDrop
CoInitializeEx
CoUninitialize

secur32

ApplyControlToken
FreeContextBuffer
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
EncryptMessage
AcquireCredentialsHandleA
QueryContextAttributesW
DeleteSecurityContext
FreeCredentialsHandle

crypt32

CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateStore
CertOpenStore

d3dcompiler_47

D3DCompile

uxtheme

SetWindowTheme

winmm

timeEndPeriod
timeBeginPeriod
timeGetDevCaps

shell32

DragFinish
DragQueryFileW

vcruntime140

__current_exception
__CxxFrameHandler3
__C_specific_handler
memset
memmove
__current_exception_context
memcpy
memcmp

api-ms-win-crt-math-l1-1-0

_hypot
sin
exp2f
floor
acosf
cosf
fmin
cos
acos
fmax
round
tan
fminf
fmaxf
log2
atan2
fmod
ceilf
__setusermatherr
roundf
floorf
truncf
ceil
powf
pow
fmodf
trunc

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_crt_atexit
_exit
strerror
exit
terminate
_register_onexit_function
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92ea423385af38258a6386ff43dc6f11

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

09:ad:aa:47:e6:c8:0e:1f:b3:82:7c:e7:10:2b:19:efCertificate

Extended Key Usages

Key Usages

d2:24:20:04:72:39:ff:2e:b4:b4:75:dc:a6:1b:11:6c:83:45:f5:4bSigner

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

ntdll

kernel32

user32

advapi32

ws2_32

gdi32

dwmapi

ole32

secur32

crypt32

d3dcompiler_47

uxtheme

winmm

shell32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 102KB - Virtual size: 102KB

.rsrc Size: 100KB - Virtual size: 100KB

.reloc Size: 29KB - Virtual size: 28KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

09:ad:aa:47:e6:c8:0e:1f:b3:82:7c:e7:10:2b:19:ef
Certificate

d2:24:20:04:72:39:ff:2e:b4:b4:75:dc:a6:1b:11:6c:83:45:f5:4b
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 102KB - Virtual size: 102KB

.rsrc
Size: 100KB - Virtual size: 100KB

.reloc
Size: 29KB - Virtual size: 28KB