Installs_2023[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Installs_2023.exe
Size

36.9MB
MD5

59d4ab17146f03e9caaf0eb3ea444ab5
SHA1

98aa5df9efbd09c6e0b1abae7246a3ef82292afb
SHA256

8c1ed7d7cb5fe3e55bf4f6420608ac56d8dcff5776284913cd3de86b959f8378
SHA512

7acd2ed6b71cfd8e60dbb9005e69c4fdd8ce94097ce4c94f2ed33318fcfe10ba1b379aae3197ce3d15e952d232be177cfbcb97ac01dd3dfde27201fd47ea8d26
SSDEEP

786432:jE8KPKW9inveTwTYjYN3AhGoBdCR+1xFtTq0Etyf/A:oPjYN3ADLHFVq0vXA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Installs_2023.exe

Files

Installs_2023.exe
.exe windows:6 windows x86 arch:x86

a1cf31b94850bdfd01700f1653e34f8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
IsValidLocale
WaitForMultipleObjects
HeapReAlloc
lstrlenW
QueryPerformanceFrequency
ExitProcess
SetFileAttributesA
TerminateProcess
GlobalUnlock
CreateFileW
RemoveDirectoryW
WriteConsoleW
VirtualFree
TlsAlloc
MoveFileA
CreateFileA
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetConsoleMode
EnumSystemLocalesW
SetEnvironmentVariableW
VirtualAlloc
SetFilePointer
GetConsoleOutputCP
GetFullPathNameW
GetLocaleInfoW
SetEndOfFile
CompareFileTime
CreateDirectoryW
SetFilePointerEx
SetFileTime
DeleteFileA
SetPriorityClass
WaitForSingleObject
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
TlsFree
GetFileSize
GetModuleHandleW
FormatMessageA
RtlUnwind
CreateSemaphoreA
WriteFile
FindNextFileW
GetSystemInfo
GetModuleHandleA
GetCommandLineW
GetUserDefaultLCID
PeekNamedPipe
VerifyVersionInfoW
IsDebuggerPresent
AcquireSRWLockExclusive
GetStdHandle
FindFirstFileA
QueryPerformanceCounter
FindClose
IsProcessorFeaturePresent
GetProcAddress
GetCurrentProcess
ResetEvent
GetStringTypeW
DeleteCriticalSection
ReadFile
GetModuleFileNameA
GetCurrentThread
MoveFileExW
GetCommandLineA
GetModuleHandleExW
InitializeCriticalSectionEx
CreateEventA
TlsGetValue
GetProcessAffinityMask
CloseHandle
GetCurrentDirectoryA
AreFileApisANSI
SetEvent
ReleaseSemaphore
ExitThread
EnterCriticalSection
CreateDirectoryA
MoveFileW
ReleaseSRWLockExclusive
CreateThread
lstrcatW
GetTickCount
FreeLibraryAndExitThread
FileTimeToLocalFileTime
GetTickCount64
FreeLibrary
GetSystemTimeAsFileTime
SetFileAttributesW
UnhandledExceptionFilter
GetSystemWow64DirectoryW
FlushFileBuffers
InitializeCriticalSection
SleepEx
SystemTimeToTzSpecificLocalTime
ReadConsoleW
SetStdHandle
WideCharToMultiByte
GetDateFormatW
RemoveDirectoryA
FreeEnvironmentStringsW
CompareStringW
LCMapStringW
TlsSetValue
GetOEMCP
FindFirstFileExW
LocalFree
HeapFree
GetACP
lstrlenA
LoadLibraryW
GetCurrentThreadId
FormatMessageW
GlobalMemoryStatus
GetEnvironmentVariableA
GetFileAttributesW
GlobalFree
GetCurrentDirectoryW
lstrcatA
SetUnhandledExceptionFilter
RaiseException
HeapSize
GetFileInformationByHandle
LCMapStringEx
SetLastError
GetSystemDirectoryW
HeapAlloc
LoadLibraryExW
GetTimeZoneInformation
GlobalLock
GetTimeFormatW
GetStartupInfoW
GetDriveTypeW
GetProcessHeap
LoadLibraryA
DecodePointer
FileTimeToSystemTime
EncodePointer
GetModuleFileNameW
IsValidCodePage
GetLastError
GetCPInfo
WaitForSingleObjectEx
GlobalAlloc
GetFileAttributesExW
GetVersionExA
VerSetConditionMask
MultiByteToWideChar
DeleteFileW
FindFirstFileW
GetFileType
FindNextFileA
GetFileSizeEx
GetCurrentProcessId
InitializeSListHead
Sleep
LeaveCriticalSection

user32

LoadStringW
SetFocus
GetWindowRect
MessageBoxA
CloseClipboard
GetWindowLongA
EnableWindow
SetClipboardData
SendMessageA
OpenClipboard
SetWindowLongA
GetParent
CheckDlgButton
GetFocus
LoadIconA
ScreenToClient
KillTimer
SetWindowTextW
SetWindowTextA
EndDialog
wsprintfA
SetCursor
PostMessageA
GetDlgItem
ShowWindow
DialogBoxParamA
GetWindowTextA
EmptyClipboard
MapDialogRect
SystemParametersInfoA
MessageBoxW
DialogBoxParamW
CharUpperW
IsDlgButtonChecked
CharUpperA
SendMessageW
MoveWindow
SetTimer
GetKeyState
GetWindowTextLengthW
LoadCursorA
LoadStringA
GetWindowTextW
MonitorFromWindow
InvalidateRect
GetWindowTextLengthA
GetMonitorInfoA

advapi32

CryptReleaseContext
RegCloseKey
CryptHashData
CryptAcquireContextW
CryptCreateHash
RegOpenKeyExW
CryptEncrypt
CryptImportKey
RegSetValueExW
CryptDestroyHash
CryptDestroyKey
RegCreateKeyExW
CryptGetHashParam

shell32

SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetMalloc
SHBrowseForFolderA

ole32

CoInitialize
OleInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

bcrypt

BCryptGenRandom

crypt32

CryptDecodeObjectEx
CertGetNameStringW
CertAddCertificateContextToStore
CertGetCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CryptStringToBinaryW
CertFreeCertificateChainEngine
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertFreeCertificateChain
CertFindCertificateInStore
CertFindExtension
PFXImportCertStore
CertOpenStore

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ord27

ws2_32

getpeername
sendto
recvfrom
WSAEnumNetworkEvents
socket
ioctlsocket
gethostname
getsockopt
send
WSACreateEvent
freeaddrinfo
WSAIoctl
WSACloseEvent
WSAResetEvent
WSAEventSelect
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSAWaitForMultipleEvents
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo

Sections

.text
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1cf31b94850bdfd01700f1653e34f8f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.4MB - Virtual size: 6.4MB

.rdata Size: 230KB - Virtual size: 229KB

.data Size: 8KB - Virtual size: 28KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 79KB - Virtual size: 78KB

.text
Size: 6.4MB - Virtual size: 6.4MB

.rdata
Size: 230KB - Virtual size: 229KB

.data
Size: 8KB - Virtual size: 28KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 79KB - Virtual size: 78KB