7341e923d37930deb38419980bc4d3b2

Sharing

Copy URL Twitter E-mail

General

Target
7341e923d37930deb38419980bc4d3b2
Size 779KB
Sample240125-arnh8scdgp
SHA256 244c693922da65a044f6226a3f05ba26d8055eb210b3f43e64925dc80f3d6a17
MD5 7341e923d37930deb38419980bc4d3b2
SHA1 130b7c917d72d0ee83e81397cd60ad5684d6175d
SHA512 220a41d08151d1a3b102bbcd1d16c8db313a87a6d6bec80e4f8de5ccba0f4691917d2178dc42523455e5abbe9555fa93aee647ec92c4dc838e93c43d0d86dcda
SSDEEP 12288:gwMDD47E2/bDlvNXK6si6xhMiprWebxTAij1rlAUN4Cvt0RUli/F2mu:gtg7E2NvJAv/dqIxLjAUVl0RUlGYm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
7341e923d37930deb38419980bc4d3b2
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/pwgen.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

7341e923d37930deb38419980bc4d3b2

.exe 779KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/inetc.dll

.dll 20KB
$PLUGINSDIR/pwgen.dll

.dll 16KB
$_2_/DownloadManager.exe

.exe 1.3MB

7341e923d37930deb38419980bc4d3b2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 244c693922da65a044f6226a3f05ba26d8055eb210b3f43e64925dc80f3d6a17
MD5 7341e923d37930deb38419980bc4d3b2
SHA1 130b7c917d72d0ee83e81397cd60ad5684d6175d
SHA512 220a41d08151d1a3b102bbcd1d16c8db313a87a6d6bec80e4f8de5ccba0f4691917d2178dc42523455e5abbe9555fa93aee647ec92c4dc838e93c43d0d86dcda
SSDEEP 12288:gwMDD47E2/bDlvNXK6si6xhMiprWebxTAij1rlAUN4Cvt0RUli/F2mu:gtg7E2NvJAv/dqIxLjAUVl0RUlGYm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
MD5 c498ae64b4971132bba676873978de1e
SHA1 92e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA512 8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
SSDEEP 384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

14993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/pwgen.dll

IMPHASH ff5d1f24996d7518c448de0ef89caf7f
SHA256 82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e
MD5 a555472395178ac8c733d90928e05017
SHA1 f44b192d66473f01a6540aaec4b6c9ac4c611d35
SHA512 e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a
SSDEEP 96:Rb32p/4mp563gfdaDf2GEFd69qI214YgU+dXXDtFCOdd7KPcC+pyTY62l2z252NJ:YCQAED61dpEEN5VifUbw2mDG0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

77B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/DownloadManager.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 33ab2810cab812621f8e8bf1d30e49a41570af00693db2bfabff69c6d242bd01
MD5 31199b186530877b8a853119ceaf39ac
SHA1 fdb4db880edb74e718c913d477316330f1341b9b
SHA512 7d5bb60198e03fc1c136a64a1721792805effd66aea593ea64a74b63e3cfa101a96508676abf64a3aa0a53b8e134f7a9da8e80c0def3eac3f5c745acd80b2a02
SSDEEP 24576:N6f5P/g1xtwthdLc+eqi4c+nEHphwxo1ZAFi:k5UEXFe41Yixo7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

75:c1:a8:86:33:fc:ed:e2:6f:60:9a:d6:38:15:ad:32:2c:2e:bc:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WeDownload\, Ltd,O=WeDownload\, Ltd,L=Nicosia,C=CY

Chains

Jul 31, 2014

Minor OS version

Major OS version

Entry point

1338806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED

PDB paths

7341e923d37930deb38419980bc4d3b2

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/pwgen.dll

msvcrt

advapi32

kernel32

user32

generic

$_2_/DownloadManager.exe

PE Signature issue

mscoree

dotnet