be174eb4ffb7b227b2e78644b98ef1ab[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
be174eb4ffb7b227b2e78644b98ef1ab.exe
Size 1.8MB
Sample240308-yd3yrsfd5x
SHA256 d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb
MD5 be174eb4ffb7b227b2e78644b98ef1ab
SHA1 f97edc25319588b1c995beb7133daf037a1cca1a
SHA512 1d03e5ac4ee0caa2abbeda7f11e67d4699b7d35ea488867ffb0809ecc88035c7d53859ba001f02ebc6ad798941a51a31eb27a5c57d8ac4e0ef7552d6a733aeda
SSDEEP 49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$TEMP/BroomSetup.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
be174eb4ffb7b227b2e78644b98ef1ab.exe
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$TEMP/BroomSetup.exe
unpack002/out.upx
unpack001/$TEMP/syncUpd.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

be174eb4ffb7b227b2e78644b98ef1ab.exe

.exe 1.8MB
$PLUGINSDIR/INetC.dll

.dll 21KB
$TEMP/BroomSetup.exe

.exe 1.7MB
out.upx

.exe 4.7MB
$TEMP/syncUpd.exe

.exe 229KB

be174eb4ffb7b227b2e78644b98ef1ab.exe

IMPHASH 187b3ae62ff818788b8c779ef7bc3d1c
SHA256 d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb
MD5 be174eb4ffb7b227b2e78644b98ef1ab
SHA1 f97edc25319588b1c995beb7133daf037a1cca1a
SHA512 1d03e5ac4ee0caa2abbeda7f11e67d4699b7d35ea488867ffb0809ecc88035c7d53859ba001f02ebc6ad798941a51a31eb27a5c57d8ac4e0ef7552d6a733aeda
SSDEEP 49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetFileSecurityA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/INetC.dll

IMPHASH 8e4c63f70f7cc6490634d743e795c93e
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

16201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateThread CreateThread LocalAlloc lstrcpyA WaitForSingleObject MulDiv ReadFile GetModuleHandleA SleepEx lstrcatA GetTickCount CreateFileA GetFileSize DeleteFileA lstrcmpA lstrcmpiA SetFilePointer WriteFile GetProcAddress CloseHandle lstrlenA LoadLibraryA lstrcpynA LocalFree GlobalAlloc GlobalFree GetLastError WideCharToMultiByte

user32

LoadIconA SystemParametersInfoA GetWindowLongA GetParent MessageBoxA DispatchMessageA SetWindowLongA KillTimer PostMessageA IsWindow GetWindowTextA ShowWindow SendDlgItemMessageA TranslateMessage IsDialogMessageA CreateDialogParamA SetDlgItemTextA GetWindowRect SetWindowPos SetTimer SendMessageA RedrawWindow GetClientRect EnableWindow FindWindowExA UpdateWindow GetMessageA GetDlgItem wsprintfA DestroyWindow SetWindowTextA IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA InternetQueryOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile FtpOpenFileA InternetSetFilePointer HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetGetLastResponseInfoA InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetErrorDlg

$TEMP/BroomSetup.exe

SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
MD5 eee5ddcffbed16222cac0a1b4e2e466e
SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5134656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 ecb1e084cee0e5945d6e6b461e15191e9c60c1778dcd7c1c78336ef7eb966525
MD5 c2d029649aac332f86e0426953151fd6
SHA1 d5cd16c08d3e391d8418e0e8cdf60847ef16c87a
SHA512 8f028bfce21083c0f5f2c65ae2ee00d04f5a32334ab25b9b9fcb5dbb87b9ac3571772f0f1a5202a62dd84425796c677e5bbe63c5a29406fa4b5df6b386f6764f
SSDEEP 49152:b0oSiZ63YBmS9+rCgpvH8la0ZxRh+caGnj8HEQUhe9TUT8bt:uUla0cGwXUheBbt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

3783364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

109KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

76B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

815KB

Virtual Size

815KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$TEMP/syncUpd.exe

IMPHASH 59c8dd4ac2c97748fa2f414e5bacf8da
SHA256 748733ef6b3518ec18acbf68a3fa7f43e403738a29a275d6cb2df8e87851c277
MD5 eda757c6ae24693068781c06550cb3a6
SHA1 026eff85b267da853dac6cc00866bd1cb1c02c4d
SHA512 36d171794fa540ecd6112dc1c8f1f393be60af9a1bb8da9e0e64363c390f3c68d370df569738192cfba09361d60e89bac219f0802a5a7c1670c86801c1742060
SSDEEP 6144:/4qdvcItHrBhjlf6R05be5BlXE0tvi7DDu:BRcItHNCR05Sji0UPu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDefaultLangID GetFileSize WriteConsoleOutputCharacterW LocalCompact SystemTimeToTzSpecificLocalTime HeapAlloc ZombifyActCtx CreateJobObjectW CreateHardLinkA CreateNamedPipeW WideCharToMultiByte LoadLibraryW GetConsoleAliasExesLengthW GetFileAttributesW GetModuleFileNameW CompareStringW GetLastError GetProcessHeaps SetStdHandle BuildCommDCBW LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd LocalAlloc DeleteTimerQueue AddAtomA VirtualProtect GetCurrentDirectoryA FatalAppExitA ReleaseMutex FileTimeToLocalFileTime GlobalAddAtomW GetStringTypeW GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer IsProcessorFeaturePresent GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException LeaveCriticalSection EnterCriticalSection HeapFree Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind HeapSize HeapReAlloc LCMapStringW MultiByteToWideChar

user32

GetKeyboardState LoadIconW GetClassLongW

be174eb4ffb7b227b2e78644b98ef1ab.exe

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$TEMP/BroomSetup.exe

generic

out.upx

generic

$TEMP/syncUpd.exe

kernel32

user32

generic