313987c8fa54336231bad14158cb5ebbe66ebc62912c659a569b235cbdb7260c

Sharing

Copy URL Twitter E-mail

General

Target

313987c8fa54336231bad14158cb5ebbe66ebc62912c659a569b235cbdb7260c
Size

24.4MB
MD5

ea55cb4e721b4da010c1243d3985d760
SHA1

d89ce3bf27cfd1f78b1b5e5f6fbdde07c2ddc37b
SHA256

313987c8fa54336231bad14158cb5ebbe66ebc62912c659a569b235cbdb7260c
SHA512

6725fbca04ad663c635e23b26d826f199e5b15600d1e6c60fa75887026882f3b13caea320f645dfec5bc732e908b0f64f36456d5cb66ed109e12539e563b1948
SSDEEP

196608:Gb6LzJP6J+r9jqOGSwfuyrF7yyw0nj7kjKxPW7:FukqXTu4w0j7k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
313987c8fa54336231bad14158cb5ebbe66ebc62912c659a569b235cbdb7260c

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

313987c8fa54336231bad14158cb5ebbe66ebc62912c659a569b235cbdb7260c
.exe windows:5 windows x86 arch:x86

97b7643811affae6c1f98c515c5c5935

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\slave\workspace\WINS_2.0_Branch_MSI\workspace\Source\irisserver\Release\SRUnPackFile.pdb

Imports

kernel32

FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetFileAttributesW
GetTickCount
TerminateProcess
LocalFree
GlobalFree
GlobalAlloc
GetCurrentThreadId
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetModuleHandleW
GetModuleFileNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetLastError
OpenProcess
ReadFile
WriteFile
FormatMessageW
CreateFileW
GlobalLock
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
lstrcmpW
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
GlobalDeleteAtom
GlobalAddAtomW
InterlockedIncrement
InterlockedDecrement
CompareStringW
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
lstrlenA
SetErrorMode
WritePrivateProfileStringW
GetModuleHandleA
GlobalFlags
GetVersionExA
LoadLibraryA
GlobalFindAtomW
GetStartupInfoW
HeapAlloc
HeapFree
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
LCMapStringW
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CreateFileA
SetEnvironmentVariableA
GetCurrentProcess
GetCurrentProcessId
ProcessIdToSessionId
GetExitCodeProcess
GetProcessId
GetSystemWindowsDirectoryW
GetCommandLineW
GetLastError
CreateMutexW
MultiByteToWideChar
GetDiskFreeSpaceExW
RemoveDirectoryW
SetCurrentDirectoryW
Sleep
GetTempPathW
CreateThread
WaitForSingleObject
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
OutputDebugStringW
FreeLibrary
GetProcAddress
LoadLibraryW
GlobalUnlock
CloseHandle

user32

GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
IsWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
WinHelpW
LoadIconW
RegisterWindowMessageW
UnregisterClassW
DestroyMenu
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
SetWindowPos
MapWindowPoints
IsIconic
GetDlgCtrlID
SetWindowTextW
DrawTextExW
DrawTextW
TabbedTextOutW
GetCapture
ClientToScreen
UnhookWindowsHookEx
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
GetParent
SendMessageW
ModifyMenuW
EnableMenuItem
CheckMenuItem
PostQuitMessage
PostMessageW
CharUpperW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
MessageBoxW
GetWindowTextW
IsWindowVisible
GetClassNameW
ShowWindow
GetForegroundWindow
SetMenu
GetWindowThreadProcessId
SetCursor
LoadCursorW
SystemParametersInfoA
GetWindow
GetWindowPlacement
GetWindowRect
GetClientRect
CreateWindowExW
PtInRect
SetForegroundWindow
GetSystemMetrics
GetClassInfoExW
GetClassInfoW
RegisterClassW
GrayStringW
AdjustWindowRectEx
LoadBitmapW

advapi32

DuplicateTokenEx
OpenProcessToken
RegSetValueExW
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegFlushKey
RegCreateKeyExW
RegCloseKey
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
RegQueryValueW
RegOpenKeyW

shell32

ShellExecuteExW
SHCreateDirectoryExW

oleaut32

VariantClear
VariantInit
VariantChangeType

shlwapi

PathIsUNCW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW

wtsapi32

WTSQueryUserToken

gdi32

RectVisible
PtVisible
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
GetStockObject
DeleteDC
TextOutW
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
GetDeviceCaps

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

comdlg32

GetFileTitleW

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 422KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97b7643811affae6c1f98c515c5c5935

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

wtsapi32

gdi32

winspool.drv

comdlg32

Sections

.text Size: 171KB - Virtual size: 170KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 8KB - Virtual size: 23KB

.rsrc Size: 422KB - Virtual size: 422KB

.text
Size: 171KB - Virtual size: 170KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 422KB - Virtual size: 422KB