9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d

Sharing

Copy URL Twitter E-mail

General

Target
9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d
Size 368KB
Sample240315-e1meragb6s
SHA256 9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d
MD5 42dfd7023b75ef0ae483e161a0a94d5e
SHA1 5b72a46467c5f485d82106e6c2407ec2607d81c5
SHA512 a10bb847e54dbe7c99054dd24f857b9de7f093f54f56f7610762358a3c8aa8b95740fb7448d7b8a4c4c10e98f5e702c1a407d2e62478422fdd114a35a3d44891
SSDEEP 6144:1BcY+8MHT++DU9Az2sfEnk+Cp/rDK6g9i2CqAHyqgFZ8951BDMph+:r+DUGzL+CJHeVAWFZ89TBof+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d
unpack001/$TEMP/InstallSetup_two.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d

.exe 368KB
$TEMP/InstallSetup_two.exe

.exe 388KB

9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d

IMPHASH 187b3ae62ff818788b8c779ef7bc3d1c
SHA256 9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d
MD5 42dfd7023b75ef0ae483e161a0a94d5e
SHA1 5b72a46467c5f485d82106e6c2407ec2607d81c5
SHA512 a10bb847e54dbe7c99054dd24f857b9de7f093f54f56f7610762358a3c8aa8b95740fb7448d7b8a4c4c10e98f5e702c1a407d2e62478422fdd114a35a3d44891
SSDEEP 6144:1BcY+8MHT++DU9Az2sfEnk+Cp/rDK6g9i2CqAHyqgFZ8951BDMph+:r+DUGzL+CJHeVAWFZ89TBof+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetFileSecurityA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$TEMP/InstallSetup_two.exe

IMPHASH 21784de70fd9035e1fb12e10a80008e3
SHA256 5a62584d8b61c9e23281990a954f497b238dc12509e81bf8de1b1b9bf10141fc
MD5 21e039c9526d9af270a51b1145ee3c5c
SHA1 92411cfe14cf7717eae50b5420f25176ed03eb53
SHA512 23b181e33c781b35bd1d2e3b0eeac844006db480f4a131fd2e2f3122542f488251e753e66e377bb6beaa3624a825c910e76c54a2337e05bb538202a5546ced02
SSDEEP 6144:Pmnh/qNdaHXG8q5sNIsIvOJ2xLV3mkcsbXZ8F/30rUogOUViu5:Kh/edaH2z5FOQtVxc4J8F/37O+5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize GetNumaProcessorNode GetLocaleInfoA WriteConsoleOutputCharacterA SystemTimeToFileTime CreateJobObjectW ExpandEnvironmentStringsA GlobalAlloc LoadLibraryW GetFileAttributesA HeapCreate GetModuleFileNameW FreeLibraryAndExitThread GetLastError GetCurrentDirectoryW FindVolumeMountPointClose HeapSize LocalLock SetComputerNameA GetAtomNameA LoadLibraryA InterlockedExchangeAdd GetFileType SetConsoleCtrlHandler ConvertDefaultLocale BuildCommDCBA VirtualProtect ScrollConsoleScreenBufferA FindAtomW GetConsoleProcessList HeapReAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer HeapAlloc HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW MultiByteToWideChar GetStringTypeW

user32

GetMonitorInfoA

9e7b0a827b302d9f15eb1e1303fae16788fdd9ca72236b6d1d297dbfc14cb73d

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$TEMP/InstallSetup_two.exe

kernel32

user32

generic