9016f356f8dd0ea8fc92857b2a499cdb

Sharing

Copy URL Twitter E-mail

General

Target
9016f356f8dd0ea8fc92857b2a499cdb
Size 492KB
Sample240204-zbxjmsabd5
SHA256 5ce2685169c772ac50c61f4aa5aaad2cece546b7705e95e37b8377f71f341c7a
MD5 9016f356f8dd0ea8fc92857b2a499cdb
SHA1 63ec8834c74b998e443c6e63b4d1b0bd77387af9
SHA512 04d18a318b4ceba0486f0de5cf4c94551038e9cd831805ab72ac88afd622110504e11c7258262ed22ee4631114b9877f180376150cf797232aef4e107ecfc3b6
SSDEEP 6144:3uk4fqjzbQqF6jtY03ZgLpp6TURimpBwXVUTL7E97IkXQxBRUoz0JehYvH7Aw0v9:x4fw36peEUBwXVwM9vylzdYvH7AwC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/GetVersion.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/Processes.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack003/$PLUGINSDIR/NSISdl.dll
unpack004/$PLUGINSDIR/NSISdl.dll
unpack005/$PLUGINSDIR/NSISdl.dll
unpack006/$PLUGINSDIR/NSISdl.dll

NSIS installer 11 IoCs

installer

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderDDLR.exe	nsis_installer_1
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderDDLR.exe	nsis_installer_2
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER0.exe	nsis_installer_1
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER0.exe	nsis_installer_2
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER1.exe	nsis_installer_1
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER1.exe	nsis_installer_2
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER2.exe	nsis_installer_1
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER2.exe	nsis_installer_2
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderSTUB.exe	nsis_installer_1
static1/unpack001/$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderSTUB.exe	nsis_installer_2

File Explorer

9016f356f8dd0ea8fc92857b2a499cdb

.exe 492KB
$PLUGINSDIR/GetVersion.dll

.dll 9KB
$PLUGINSDIR/NSISdl.dll

.dll 82KB
$PLUGINSDIR/Processes.dll

.dll 35KB
$PLUGINSDIR/nsExec.dll

.dll 9KB
$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderDDLR.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER0.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER1.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER2.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderSTUB.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/preinstaller.exe

.exe 213KB

9016f356f8dd0ea8fc92857b2a499cdb

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 5ce2685169c772ac50c61f4aa5aaad2cece546b7705e95e37b8377f71f341c7a
MD5 9016f356f8dd0ea8fc92857b2a499cdb
SHA1 63ec8834c74b998e443c6e63b4d1b0bd77387af9
SHA512 04d18a318b4ceba0486f0de5cf4c94551038e9cd831805ab72ac88afd622110504e11c7258262ed22ee4631114b9877f180376150cf797232aef4e107ecfc3b6
SSDEEP 6144:3uk4fqjzbQqF6jtY03ZgLpp6TURimpBwXVUTL7E97IkXQxBRUoz0JehYvH7Aw0v9:x4fw36peEUBwXVwM9vylzdYvH7AwC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

15931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/GetVersion.dll

IMPHASH fb1aa2bbc159c94cb45792330366bd5f
SHA256 ecfcbe30f5b248673f9cbebb734b9981ed14b06380ea787c563d67b30e2d069e
MD5 225f776172f1baccd2721a6e5d512b36
SHA1 2dbbc86f7b0285682880a627b56a75de09f4bed6
SHA512 4b99a5ac68122501a5913cf54bd3ae99d851d57656b0e136980122739cceef739fa2d5ea097f2442068b9489a4c25ea0884653c41d85f27f25996792bf6c21bb
SSDEEP 192:MMr/9XGqK7s/AlHdJZBi46AQ5VuNxHA8/:MsXGqM93Bi46AQ5Vujg8/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 6c01223cb63ee4264a1cff8d0322dcde
SHA256 740889b170366dd60b93e0f381bc885be2a0591ea8905e48f9bd9830cb266436
MD5 cb1facc94ddb9f50fcfc176444d01063
SHA1 3ddd287a0aa1e376b9b200ee546c3b68f1e48ec7
SHA512 5bd93e8e45b35c8d89040d01756a71890c1e8bd60b71e9945e8ccdd55e327816b596c03ea2222acee9c5f5edef85e5167403f4735e9303bfed8bfa739831d464
SSDEEP 1536:nKHghY8sc+h3f3A9yBZgqCZMEeVDaDUg566Xo:KHghnsb7uCVGUg5jo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileA CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection FreeLibrary GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetTickCount GlobalAlloc GlobalFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement LeaveCriticalSection LoadLibraryA MulDiv ReleaseSemaphore SetLastError Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject WriteFile lstrcatA lstrcmpiA lstrcpyA lstrcpynA lstrlenA

msvcrt

_write __dllonexit _errno _iob _winmajor abort calloc fflush fputc fputs free fwrite malloc memcpy realloc sprintf strcmp strcpy strlen vfprintf

user32

CallWindowProcA CharPrevA CreateWindowExA DestroyWindow EnableWindow FindWindowExA GetClientRect GetDlgItem GetFocus GetWindowLongA GetWindowRect IsWindowVisible RegisterWindowMessageA SendMessageA SetDlgItemTextA SetWindowLongA SetWindowTextA ShowWindow wsprintfA

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect gethostbyname getsockname htons inet_addr ioctlsocket recv select send shutdown socket

Name

.text

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

95B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Processes.dll

IMPHASH f5edecae12589e705677a6e272ad0394
SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
MD5 2cfba79d485cf441c646dd40d82490fc
SHA1 83e51ac1115a50986ed456bd18729653018b9619
SHA512 cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
SSDEEP 768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 06e07a9e2c8ec78ec44f1a538a1bd2a2
SHA256 5f80c7ba031f546b69bd57071bdb5334760cde5afc43fe8271b9e6a3204ef390
MD5 dad21928213e804133c6eed2b5402dbc
SHA1 82fa0fe67dc55e22e2289800b2fca34bf59762d6
SHA512 8e8428f1bd5a81a447f8b892215d09d5695b1fcc9eb5bf0d9771a6989750feaa5957966fb444a24d78cf51ebb783d615348337e44b884c2e5d5f63d80551c9f3
SSDEEP 192:lkhF3tTTxsMRRuWDxvsiwDc4veSQ4b95Q4huV+:lqFh9LRR7Z/oPX5QIuV+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderDDLR.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER0.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER1.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER2.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderSTUB.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/preinstaller.exe

IMPHASH c75aa021b4be3f016821b31d91352687
SHA256 19460c3c1b450286c68fba77086c561e740374ae5c44213dd2ec22dc52a430b8
MD5 06baef00ae0f0e42fc5fea24fc4eac42
SHA1 9161574590f09cfe4c24498827386ed57f2e8c58
SHA512 29431ff9f16fdd4122a10dfec0f260a4397e776daae2ef17defae71e037f082d48d186a24d229c408c9d1b0b4f02aaeaa69011e44cf399795f9c09903ac51486
SSDEEP 6144:f03ZgLpp6TURimpBwXVUTL7E97IkXQxBRUoz0JehYvq:ZEUBwXVwM9vylzdYvq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

4740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateSolidBrush DeleteDC DeleteObject GetStockObject SelectObject SetBkColor SetBkMode SetTextColor

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipCreateFromHDC GdipDeleteGraphics GdipDisposeImage GdipDrawImageI GdipFree GdiplusShutdown GdiplusStartup

kernel32

AddAtomA CloseHandle CreateMutexA CreateSemaphoreA DeleteCriticalSection EnterCriticalSection ExitProcess FindAtomA FindResourceA GetAtomNameA GetCommandLineA GetCommandLineW GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection InterlockedDecrement InterlockedIncrement LeaveCriticalSection LoadResource LocalFree LockResource ReleaseMutex ReleaseSemaphore SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject

msvcrt

_write __getmainargs __p__environ __p__fmode __set_app_type _assert _cexit _iob _onexit _setmode abort atexit calloc fputc fputs free fwrite malloc realloc signal sprintf strcmp strcpy vfprintf

ole32

CreateStreamOnHGlobal

shell32

CommandLineToArgvW SHBrowseForFolderA SHGetFolderPathA SHGetPathFromIDListA ShellExecuteA

user32

BeginPaint ClientToScreen CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint GetCapture GetDC GetMessageA GetSystemMetrics LoadCursorA LoadIconA MessageBoxExA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC SendMessageA SetCapture SetCursor SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow TranslateMessage wsprintfA

Name

.text

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

9016f356f8dd0ea8fc92857b2a499cdb

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$PLUGINSDIR/GetVersion.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

kernel32

msvcrt

user32

ws2_32

generic

$PLUGINSDIR/Processes.dll

kernel32

user32

generic

$PLUGINSDIR/nsExec.dll

advapi32

kernel32

user32

generic

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderDDLR.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER0.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$TEMP/31e9d6bf3bddde88bd8187eff1fdf033/downloaderOFFER1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32