ParkclientInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ParkclientInstaller.exe
Size

466KB
MD5

f7ae303d52054ea1a687db12ff89a26f
SHA1

4e5e143e943c68a2922eb649018a65bea60d4d6f
SHA256

0f1a400356a92e29e56e5a73b6f69d30ebe6a7c3ebc9e2885e95df48d8d59694
SHA512

f4f68a70145b91a67321eba8a14b83b4bd3e9e062d5cbf344a77ef627d6ed6b5bdebca41aa8bdd17bd84795785684407ce27cbba09abf62d7503cc00a2eb15c9
SSDEEP

12288:dlvaj6rUQZI7fwwN4yXqWh9oIeR6pEHsX0V9/:dlvKTHh9oIeRWg3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ParkclientInstaller.exe

Files

ParkclientInstaller.exe
.exe windows:6 windows x86 arch:x86

4b8d4f0719e7662b59b673a8cfc72678

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\xiexb\source\repos\ParkclientInstaller\Release\ParkclientInstaller.pdb

Imports

comctl32

ord17

kernel32

GetFileAttributesW
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
WaitForSingleObjectEx
GetTickCount64
SleepEx
Sleep
GetProcAddress
FreeLibrary
SetFilePointer
EnterCriticalSection
FormatMessageA
SetLastError
SetFileTime
WriteFile
CreateDirectoryW
lstrcatW
ExpandEnvironmentStringsW
GetExitCodeProcess
CreateProcessW
ReadFile
WaitForSingleObject
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
PeekNamedPipe
CreateFileW
CloseHandle
LeaveCriticalSection
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
VerSetConditionMask
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
GetSystemTimeAsFileTime
GetLastError
InitializeSListHead
OutputDebugStringW
InitializeCriticalSectionEx

user32

GetMessageW
wsprintfW
DrawTextW
LoadStringW
GetClientRect
DispatchMessageW
EndPaint
EndDialog
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
MessageBoxW
PostMessageW
SetWindowPos
GetSystemMetrics
TranslateMessage
GetWindowRect
UpdateWindow
ShowWindow
LoadAcceleratorsW
CreateWindowExW
TranslateAcceleratorW
LoadIconW
RegisterClassExW
LoadCursorW
PostQuitMessage

gdi32

SelectObject
CreateFontW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

vcruntime140

memset
memcpy
_CxxThrowException
__std_exception_destroy
strrchr
__std_exception_copy
strchr
memmove
strstr
_except_handler4_common
__CxxFrameHandler3
memchr
wcsstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf
_open
_close
_write
_read
fwrite
__p__commode
_set_fmode
fopen
_lseeki64
fclose
fflush
__stdio_common_vsprintf
fputc
fread
ftell
fseek
fgets
fputs

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_getpid
_beginthreadex
perror
__sys_nerr
_beginthread
strerror
_errno
_initterm

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
calloc
free
_set_new_mode
malloc

api-ms-win-crt-string-l1-1-0

_strdup
isupper
tolower
strncpy
strpbrk
_wcsdup
strncmp

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtoll
strtol

api-ms-win-crt-filesystem-l1-1-0

_stat64
_fstat64
_access

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

WSAIoctl
ntohl
htonl
gethostname
ioctlsocket
listen
accept
sendto
WSAStartup
WSACleanup
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
recvfrom
getaddrinfo
freeaddrinfo

normaliz

IdnToAscii

wldap32

ord301
ord22
ord143
ord26
ord45
ord50
ord30
ord46
ord60
ord35
ord211
ord200
ord27
ord79
ord32
ord33
ord41

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine

advapi32

CryptHashData
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext

Sections

.text
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b8d4f0719e7662b59b673a8cfc72678

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

normaliz

wldap32

crypt32

advapi32

Sections

.text Size: 295KB - Virtual size: 295KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 295KB - Virtual size: 295KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 13KB - Virtual size: 13KB