671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120

Sharing

Copy URL Twitter E-mail

General

Target
671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
Size 2.0MB
Sample240312-xvcbpsbb37
SHA256 671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
MD5 0f115f24c7465cfa6a1679b3464f5771
SHA1 131e8238bd8605714add657992ba6efdaf424604
SHA512 0ec11d304004729c9493d847123e947beeb0ef1e4c5268ea542e36b247e958effb4f847baacecb444dd3bba507e455a5f621c0ee23fc8cedf0736a351832ad28
SSDEEP 49152:LtM+Cjo7TVrVH/qinqKgGOpa2PGLN2/5bsPwWFVICIEGxMa27:C+/VrcoqK06vwEV2rQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$TEMP/BroomSetup.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$TEMP/BroomSetup.exe
unpack002/out.upx
unpack001/$TEMP/syncUpd.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120

.exe 2.0MB
$PLUGINSDIR/INetC.dll

.dll 21KB
$TEMP/BroomSetup.exe

.exe 1.7MB
out.upx

.exe 4.7MB
$TEMP/file.txt

488KB
$TEMP/syncUpd.exe

.exe 200KB

671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120

IMPHASH 187b3ae62ff818788b8c779ef7bc3d1c
SHA256 671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
MD5 0f115f24c7465cfa6a1679b3464f5771
SHA1 131e8238bd8605714add657992ba6efdaf424604
SHA512 0ec11d304004729c9493d847123e947beeb0ef1e4c5268ea542e36b247e958effb4f847baacecb444dd3bba507e455a5f621c0ee23fc8cedf0736a351832ad28
SSDEEP 49152:LtM+Cjo7TVrVH/qinqKgGOpa2PGLN2/5bsPwWFVICIEGxMa27:C+/VrcoqK06vwEV2rQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetFileSecurityA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/INetC.dll

IMPHASH 8e4c63f70f7cc6490634d743e795c93e
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

16201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateThread CreateThread LocalAlloc lstrcpyA WaitForSingleObject MulDiv ReadFile GetModuleHandleA SleepEx lstrcatA GetTickCount CreateFileA GetFileSize DeleteFileA lstrcmpA lstrcmpiA SetFilePointer WriteFile GetProcAddress CloseHandle lstrlenA LoadLibraryA lstrcpynA LocalFree GlobalAlloc GlobalFree GetLastError WideCharToMultiByte

user32

LoadIconA SystemParametersInfoA GetWindowLongA GetParent MessageBoxA DispatchMessageA SetWindowLongA KillTimer PostMessageA IsWindow GetWindowTextA ShowWindow SendDlgItemMessageA TranslateMessage IsDialogMessageA CreateDialogParamA SetDlgItemTextA GetWindowRect SetWindowPos SetTimer SendMessageA RedrawWindow GetClientRect EnableWindow FindWindowExA UpdateWindow GetMessageA GetDlgItem wsprintfA DestroyWindow SetWindowTextA IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA InternetQueryOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile FtpOpenFileA InternetSetFilePointer HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetGetLastResponseInfoA InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetErrorDlg

$TEMP/BroomSetup.exe

SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
MD5 eee5ddcffbed16222cac0a1b4e2e466e
SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5134656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 ecb1e084cee0e5945d6e6b461e15191e9c60c1778dcd7c1c78336ef7eb966525
MD5 c2d029649aac332f86e0426953151fd6
SHA1 d5cd16c08d3e391d8418e0e8cdf60847ef16c87a
SHA512 8f028bfce21083c0f5f2c65ae2ee00d04f5a32334ab25b9b9fcb5dbb87b9ac3571772f0f1a5202a62dd84425796c677e5bbe63c5a29406fa4b5df6b386f6764f
SSDEEP 49152:b0oSiZ63YBmS9+rCgpvH8la0ZxRh+caGnj8HEQUhe9TUT8bt:uUla0cGwXUheBbt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

3783364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

109KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

76B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

815KB

Virtual Size

815KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$TEMP/syncUpd.exe

IMPHASH 1bfb9e30602d999465ce79b11a35f99e
SHA256 2b26a0dac779643189180d9e50ace8e299c5487a9a8cdaf4300cc64a9d674b33
MD5 11a8185b4885be3b627a0231d08719ae
SHA1 8b18353b7a52d66e4a868e4d12a21a0533fa0ee0
SHA512 091c82a9063b5371cc5d35e51dc73c956160477d0293137ae14fa4a7ec70ddc68a2dbd8601bbb8a80636b793c0e53b0887674a6bf3c383354d8722af083a4d6b
SSDEEP 3072:pHOLgO34PMRjf0jtAV+vQoCNJpuumeuG3BYBI3PuHhCadEZE+:pEg8RIOVboCZuAwW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PulseEvent HeapCompact GetConsoleAliasExesLengthA WriteConsoleOutputCharacterA HeapAlloc CreateJobObjectW HeapFree WaitForSingleObject CreateHardLinkA GlobalAlloc WideCharToMultiByte GetLocaleInfoW DnsHostnameToComputerNameW GetFileAttributesW GetModuleFileNameW FindNextVolumeMountPointW InterlockedExchange GetStdHandle FreeLibraryAndExitThread GetLastError GetConsoleDisplayMode BuildCommDCBW GetNumaHighestNodeNumber GetAtomNameA LoadLibraryA UnhandledExceptionFilter GetFileType FindAtomA ConvertDefaultLocale VirtualProtect GetCurrentDirectoryA ScrollConsoleScreenBufferA FileTimeToLocalFileTime HeapReAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer HeapCreate InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize RtlUnwind IsProcessorFeaturePresent LCMapStringW MultiByteToWideChar GetStringTypeW RaiseException

671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$TEMP/BroomSetup.exe

generic

out.upx

generic

$TEMP/file.txt

$TEMP/syncUpd.exe

kernel32

generic