MSI6AB1[.]tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

MSI6AB1.tmp
Size

2.6MB
MD5

338f05cedf6051d67bc84a08c94f0e9c
SHA1

508151307c9f6669f49bcac7b661c85f64a61c9d
SHA256

4e3c9d222d32d55259a320ed99285da63bf9c5440e987bb6c4a5eedfd95bcbda
SHA512

1667655fca820a8903f52de886919e8862e0f530826b599527923a291f3205706b62e2547e0f43262a180e531772697bec04de8d9bd16c8b234e40a7b44fe0a8
SSDEEP

49152:sWvxRLMzh98qSPj+CXeQo562zTle8Ep2lcK5VYcPnRWc4:5xRLMzv8qWjfetlcKxRWc4

Score

1^/10

Malware Config

Signatures

Files

MSI6AB1.tmp
.dll regsvr32 windows:6 windows x86 arch:x86

902b718786bab513e35fb5bfd46fb26f

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:7a:98:4a:65:1e:f8:4d:77:cb:a3:e7:29:ab:5e:4f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12-05-2021 00:00

Not After

16-05-2024 23:59

Subject

CN=Topaz Systems\, Inc.,O=Topaz Systems\, Inc.,L=MOORPARK,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:02:01:76:cc:20:6a:4a:0f:d7:cc:3d:fe:db:95:b3:ce:98:2e:1a:15:5c:55:ba:0c:7e:c9:bd:ac:14:9a:82
Signer

Actual PE Digest

1a:02:01:76:cc:20:6a:4a:0f:d7:cc:3d:fe:db:95:b3:ce:98:2e:1a:15:5c:55:ba:0c:7e:c9:bd:ac:14:9a:82

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb

Imports

rpcrt4

UuidFromStringW
NdrStubCall2
NdrOleFree
UuidCreate
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release

comctl32

ord17

gdiplus

GdipAlloc
GdipGetImageHeight
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipGetImageWidth

kernel32

SetFileTime
GetPrivateProfileSectionW
MoveFileExW
ExpandEnvironmentStringsW
IsBadWritePtr
RemoveDirectoryW
GetTickCount
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetCurrentThreadId
FlushInstructionCache
GlobalAlloc
MulDiv
OutputDebugStringW
lstrcatW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenA
FlushFileBuffers
GetPrivateProfileIntA
GlobalFree
LoadLibraryW
WinExec
GetVersion
lstrcmpiA
GetSystemDirectoryW
GetCurrentProcess
GetShortPathNameW
SetEvent
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
WaitForSingleObject
SearchPathW
CompareStringA
WideCharToMultiByte
CompareStringW
SystemTimeToFileTime
IsBadReadPtr
lstrcmpW
DosDateTimeToFileTime
FileTimeToDosDateTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
GetSystemInfo
GetSystemTime
CreateEventW
QueryPerformanceFrequency
WriteFile
SetFilePointer
ReadFile
LocalFileTimeToFileTime
FreeResource
ReadConsoleW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetModuleFileNameA
GetFileType
GetStringTypeW
HeapReAlloc
HeapSize
GetModuleHandleExW
ExitProcess
GetStdHandle
GetCPInfo
GetOEMCP
IsValidCodePage
GetACP
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
ExitThread
CreateThread
IsDebuggerPresent
RtlUnwind
GetCurrentThread
QueryPerformanceCounter
lstrcpynW
CompareFileTime
GetExitCodeProcess
TerminateProcess
OpenProcess
GetFileTime
GetFileSize
FindNextFileW
FileTimeToLocalFileTime
CreateFileW
GetDiskFreeSpaceW
CreateProcessW
Sleep
MoveFileW
CopyFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcpyW
FormatMessageW
LocalFree
GetVersionExW
GetCurrentProcessId
OpenEventW
ResetEvent
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetUserDefaultLCID
MultiByteToWideChar
lstrlenW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExA
RaiseException
CloseHandle
DecodePointer
EncodePointer
LoadLibraryA
GetSystemDirectoryA
FindResourceW
GlobalUnlock
GlobalLock
SizeofResource
LockResource
LoadResource
SetLastError
GetLastError
GetProcessTimes
GetLocalTime
LCMapStringW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedCompareExchange
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange

user32

DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
GetDesktopWindow
CharUpperBuffW
WaitForInputIdle
wsprintfW
CharNextW
ExitWindowsEx
CharUpperW
RegisterWindowMessageW
SendMessageW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
DefWindowProcW
DestroyWindow
MoveWindow
SetWindowPos
GetDlgItem
SetFocus
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDC
ReleaseDC
BeginPaint
MsgWaitForMultipleObjects
UnregisterClassW
EndPaint
InvalidateRect
InvalidateRgn
RedrawWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CallWindowProcW
IsChild
MessageBoxW
IsWindowUnicode
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageA
GetMessageA
OffsetRect
CopyRect
RemovePropW
SetPropW
DrawTextW
GetDlgCtrlID
MonitorFromPoint
EnumChildWindows
GetWindowDC
GetDlgItemTextW
MessageBeep
AdjustWindowRectEx
UpdateWindow
SystemParametersInfoW
MapWindowPoints
CreateDialogIndirectParamW
GetWindowPlacement
GetSystemMetrics
RemoveMenu
AppendMenuW
GetSystemMenu
SetDlgItemTextW
DialogBoxParamW
LoadStringW
LoadIconW
SetCursor
GetPropW
SetWindowRgn
EnableWindow
IsIconic
ShowWindow
IsRectEmpty
IntersectRect
GetWindowRect
LoadCursorW
GetWindow
GetClassNameW
GetParent
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
GetClientRect

gdi32

SaveDC
RestoreDC
CreateFontIndirectW
GetObjectW
SelectObject
GetStockObject
GetDeviceCaps
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateDIBitmap
CreateBitmap
CreatePalette
GetSystemPaletteEntries
PlayMetaFile
SetBkColor
SetMetaFileBitsEx
StretchBlt
SetBkMode
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
UnrealizeObject
CreatePatternBrush
CreateRectRgn
GetMapMode
PatBlt
RealizePalette
SelectClipRgn
SelectPalette
SetMapMode
SetPixel
LPtoDP
Rectangle
GetTextExtentPoint32W
DeleteMetaFile
EnumFontFamiliesExW
SetStretchBltMode
SetTextColor
TextOutW

advapi32

SetFileSecurityW
RegOpenKeyW
RegQueryValueExW
RegEnumValueW
RegConnectRegistryW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
IsValidSecurityDescriptor
GetFileSecurityW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
EqualSid
GetTokenInformation
OpenThreadToken
RegOverridePredefKey
FreeSid
AllocateAndInitializeSid

shell32

SHGetMalloc
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetFolderPathW

ole32

StringFromGUID2
StgOpenStorage
StgCreateDocfile
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoRegisterPSClsid
CoRevokeClassObject
CoUninitialize
CreateItemMoniker
GetRunningObjectTable
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
PropVariantClear
CLSIDFromProgID
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromString
OleInitialize
OleUninitialize
OleLockRunning
CoMarshalInterface
CoUnmarshalInterface
CoRegisterClassObject
CoInitializeEx
CoCreateGuid
CoReleaseMarshalData
CoInitialize
ProgIDFromCLSID
ReadClassStm
WriteClassStm
OleSaveToStream

oleaut32

GetErrorInfo
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
OleLoadPicturePath
DispCallFunc
OleCreateFontIndirect
LoadRegTypeLi
DispGetParam
VariantCopyInd
CreateErrorInfo
SetErrorInfo
VarBstrCat
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringLen
VarUI4FromStr
LoadTypeLi
SysAllocString
VariantInit
VariantClear
VariantCopy
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
VariantChangeType
RegisterTypeLi
UnRegisterTypeLi
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim

shlwapi

SHStrDupW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EmbeddedUIHandler
InitializeEmbeddedUI
RunISMSIMajorUpgradeRemoval
RunISMSISetup
ShutdownEmbeddedUI
f1
f10
f100
f1000
f101
f102
f103
f104
f105
f106
f107
f108
f109
f11
f110
f111
f112
f113
f114
f115
f116
f117
f118
f119
f12
f120
f121
f122
f123
f124
f125
f126
f127
f128
f129
f13
f130
f131
f132
f133
f134
f135
f136
f137
f138
f139
f14
f140
f141
f142
f143
f144
f145
f146
f147
f148
f149
f15
f150
f151
f152
f153
f154
f155
f156
f157
f158
f159
f16
f160
f161
f162
f163
f164
f165
f166
f167
f168
f169
f17
f170
f171
f172
f173
f174
f175
f176
f177
f178
f179
f18
f180
f181
f182
f183
f184
f185
f186
f187
f188
f189
f19
f190
f191
f192
f193
f194
f195
f196
f197
f198
f199
f2
f20
f200
f201
f202
f203
f204
f205
f206
f207
f208
f209
f21
f210
f211
f212
f213
f214
f215
f216
f217
f218
f219
f22
f220
f221
f222
f223
f224
f225
f226
f227
f228
f229
f23
f230
f231
f232
f233
f234
f235
f236
f237
f238
f239
f24
f240
f241
f242
f243
f244
f245
f246
f247
f248
f249
f25
f250
f251
f252
f253
f254
f255
f256
f257
f258
f259
f26
f260
f261
f262
f263
f264
f265
f266
f267
f268
f269
f27
f270
f271
f272
f273
f274
f275
f276
f277
f278
f279
f28
f280
f281
f282
f283
f284
f285
f286
f287
f288
f289
f29
f290
f291
f292
f293
f294
f295
f296
f297
f298
f299
f3
f30
f300
f301
f302
f303
f304
f305
f306
f307
f308
f309
f31
f310
f311
f312
f313
f314
f315
f316
f317
f318
f319
f32
f320
f321
f322
f323
f324
f325
f326
f327
f328
f329
f33
f330
f331
f332
f333
f334
f335
f336
f337
f338
f339
f34
f340
f341
f342
f343
f344
f345
f346
f347
f348
f349
f35
f350
f351
f352
f353
f354
f355
f356
f357
f358
f359
f36
f360
f361
f362
f363
f364
f365
f366
f367
f368
f369
f37
f370
f371
f372
f373
f374
f375
f376
f377
f378
f379
f38
f380
f381
f382
f383
f384
f385
f386
f387
f388
f389
f39
f390
f391
f392
f393
f394
f395
f396
f397
f398
f399
f4
f40
f400
f401
f402
f403
f404
f405
f406
f407
f408
f409
f41
f410
f411
f412
f413
f414
f415
f416
f417
f418
f419
f42
f420
f421
f422
f423
f424
f425
f426
f427
f428
f429
f43
f430
f431
f432
f433
f434
f435
f436
f437
f438
f439
f44
f440
f441
f442
f443
f444
f445
f446
f447
f448
f449
f45
f450
f451
f452
f453
f454
f455
f456
f457
f458
f459
f46
f460
f461
f462
f463
f464
f465
f466
f467
f468
f469
f47
f470
f471
f472
f473
f474
f475
f476
f477
f478
f479
f48
f480
f481
f482
f483
f484
f485
f486
f487
f488
f489
f49
f490
f491
f492
f493
f494
f495
f496
f497
f498
f499
f5
f50
f500
f501
f502
f503
f504
f505
f506
f507
f508
f509
f51
f510
f511
f512
f513
f514
f515
f516
f517
f518
f519
f52
f520
f521
f522
f523
f524
f525
f526
f527
f528
f529
f53
f530
f531
f532
f533
f534
f535
f536
f537
f538
f539
f54

Sections

.text
Size: 786KB - Virtual size: 786KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 329KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

902b718786bab513e35fb5bfd46fb26f

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:7a:98:4a:65:1e:f8:4d:77:cb:a3:e7:29:ab:5e:4fCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

1a:02:01:76:cc:20:6a:4a:0f:d7:cc:3d:fe:db:95:b3:ce:98:2e:1a:15:5c:55:ba:0c:7e:c9:bd:ac:14:9a:82Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

comctl32

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 786KB - Virtual size: 786KB

.orpc Size: 1024B - Virtual size: 544B

.rdata Size: 329KB - Virtual size: 329KB

.data Size: 59KB - Virtual size: 100KB

.rsrc Size: 120KB - Virtual size: 119KB

.reloc Size: 265KB - Virtual size: 265KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:7a:98:4a:65:1e:f8:4d:77:cb:a3:e7:29:ab:5e:4f
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

1a:02:01:76:cc:20:6a:4a:0f:d7:cc:3d:fe:db:95:b3:ce:98:2e:1a:15:5c:55:ba:0c:7e:c9:bd:ac:14:9a:82
Signer

.text
Size: 786KB - Virtual size: 786KB

.orpc
Size: 1024B - Virtual size: 544B

.rdata
Size: 329KB - Virtual size: 329KB

.data
Size: 59KB - Virtual size: 100KB

.rsrc
Size: 120KB - Virtual size: 119KB

.reloc
Size: 265KB - Virtual size: 265KB