e462625b50ddf2d24c0d8a3fbf6594a7

Sharing

Copy URL Twitter E-mail

General

Target

e462625b50ddf2d24c0d8a3fbf6594a7
Size

2.9MB
MD5

e462625b50ddf2d24c0d8a3fbf6594a7
SHA1

fdade7759eb2babadc26d9c78cc4931be0543f13
SHA256

2a518b6e15859114b3c4b25c0f0b3d679022b22356692225d610b7d525ecdacd
SHA512

c6397cbc4a13d88f01a29a2bdb76028e1b6697f34e83fb1f72362108ef3c061a93f24a9c4de1e419327401874509d3bfa072012b9ed52fa1cee967cb4b14bc72
SSDEEP

49152:LKxMCaumAtZYQWpOa8aBrFipNcWeScKlKmPELB7vahTHNH3sJFBa3bY+9X:LyMCzmAtyTv8aBZAzeScCKmPELZCoa3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e462625b50ddf2d24c0d8a3fbf6594a7

Files

e462625b50ddf2d24c0d8a3fbf6594a7
.dll windows:5 windows x86 arch:x86

5586b694e0a3109f9bd9f3a899e9353d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\jenkins\lightregulate\lightregulate\setup\InstallScript\Res\insthelper.pdb

Imports

kernel32

GetThreadTimes
lstrlenA
FormatMessageW
FileTimeToLocalFileTime
GetFileTime
LockResource
GetLocalTime
GetDiskFreeSpaceW
GetFileSizeEx
GetVolumeInformationW
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetErrorMode
DeviceIoControl
IsDBCSLeadByte
SetEnvironmentVariableA
GetFullPathNameA
WriteConsoleW
SetStdHandle
ReadConsoleW
HeapQueryInformation
SetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
ReadFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetTimeZoneInformation
SetConsoleCtrlHandler
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateSemaphoreW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
FatalAppExitA
GetDriveTypeW
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
ExitThread
GetSystemTime
GetFullPathNameW
IsDebuggerPresent
GetCommandLineA
AreFileApisANSI
ExitProcess
EncodePointer
GetSystemTimeAsFileTime
GetStringTypeW
QueryDosDeviceW
LoadLibraryA
MapViewOfFile
SetFileTime
CreateFileA
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetFileAttributesA
SizeofResource
GetPrivateProfileStringW
CreateDirectoryW
LoadResource
FindResourceW
FindResourceExW
SetEndOfFile
FreeResource
GetFileSize
GetTempFileNameW
GetDateFormatW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetSystemInfo
GetComputerNameW
FreeLibrary
SetFileAttributesW
GetWindowsDirectoryW
DeleteCriticalSection
DecodePointer
RemoveDirectoryW
HeapSize
GetCurrentDirectoryW
RaiseException
GlobalUnlock
CreateFileW
HeapDestroy
CopyFileW
InitializeCriticalSectionAndSpinCount
WriteFile
GetProcessHeap
GlobalLock
HeapFree
MoveFileExW
HeapAlloc
HeapReAlloc
DeleteFileW
FindNextFileW
FindClose
GetTempPathW
lstrlenW
GetSystemDirectoryW
GetTickCount
FindFirstFileW
GetVersionExW
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
GlobalMemoryStatusEx
GetThreadPriority
CreatePipe
SetProcessWorkingSetSize
OpenThread
SetThreadPriorityBoost
GetStartupInfoW
SetThreadPriority
Thread32Next
GetExitCodeProcess
ReadProcessMemory
Thread32First
GetPriorityClass
SetProcessPriorityBoost
GetCurrentThread
GetProcessPriorityBoost
SetPriorityClass
GetThreadIOPendingFlag
IsWow64Process
SystemTimeToFileTime
VerifyVersionInfoW
VerSetConditionMask
MoveFileW
LocalFree
InterlockedIncrement
InterlockedDecrement
SetFilePointer
QueryPerformanceFrequency
QueryPerformanceCounter
ResetEvent
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
GetPrivateProfileIntW
GetModuleHandleExW
IsProcessorFeaturePresent
LocalAlloc
LocalLock
LocalUnlock
LoadLibraryExW
CreateFileMappingW
GlobalReAlloc
MulDiv
OutputDebugStringA
GetCurrentThreadId
OpenEventW
OpenFileMappingW
GetModuleFileNameA
EnterCriticalSection
SetLastError
LeaveCriticalSection
InitializeCriticalSection
OutputDebugStringW
SetEvent
VirtualQuery
UnmapViewOfFile
CreateThread
GetModuleHandleW
GetProcAddress
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
lstrcpynW
lstrcmpiW
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GlobalAlloc
CreateProcessW
CloseHandle
GetLastError
TerminateProcess
Sleep
InterlockedCompareExchange
InterlockedExchange
lstrcpyW
SetFilePointerEx
GlobalFree

user32

MapWindowPoints
DestroyMenu
GetClassInfoExW
SendMessageW
CreateWindowExW
DefWindowProcW
RegisterClassExW
DrawTextW
GetMenuItemInfoW
MessageBoxA
DrawIconEx
GetMenuState
GetSystemMenu
GetWindowTextW
SetWindowLongW
RedrawWindow
GetActiveWindow
SetWindowRgn
IsZoomed
SystemParametersInfoW
GetAncestor
EnableWindow
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
GetSysColor
InflateRect
FillRect
GetWindowThreadProcessId
MonitorFromPoint
GetMonitorInfoW
GetMenuItemCount
SetMenuItemInfoW
IsMenu
GetCaretPos
GetClassNameW
GetFocus
TrackMouseEvent
WindowFromPoint
ClientToScreen
GetClassInfoW
SetMenuInfo
GetMenuInfo
DeleteMenu
DrawFocusRect
DestroyIcon
PrivateExtractIconsW
LoadStringW
SetRectEmpty
GetParent
IsWindow
MoveWindow
GetWindowRect
LoadCursorW
PostMessageW
ShowWindow
CreateDesktopW
OpenDesktopW
CharUpperBuffW
EnumWindows
GetIconInfo
GetForegroundWindow
EnumChildWindows
GetShellWindow
SetThreadDesktop
CloseDesktop
SendMessageTimeoutW
GetDlgItem
FindWindowW
FindWindowExW
SetDlgItemTextW
CallWindowProcW
DestroyWindow
SetWindowPos
SetWindowTextW
PostQuitMessage
GetDlgItemTextW
GetSystemMetrics
UpdateWindow
SetRect
GetDesktopWindow
LoadImageW
ExitWindowsEx
SetClipboardData
OpenClipboard
EmptyClipboard
UnregisterClassW
CloseClipboard
DispatchMessageW
TranslateMessage
GetMessageW
FindWindowA
PtInRect
OffsetRect
IntersectRect
GetDC
ReleaseDC
SetCapture
ReleaseCapture
GetCapture
GetKeyState
SetTimer
KillTimer
GetWindowLongW
RegisterWindowMessageW
GetClientRect
UnionRect
InvalidateRect
IsRectEmpty
BeginPaint
EndPaint
UpdateLayeredWindow
IsWindowVisible
CreateCaret
ShowCaret
HideCaret
SetCaretPos
SetCursor
SetFocus
ScreenToClient
GetCursorPos
EqualRect
GetUserObjectInformationW
IsHungAppWindow
GetThreadDesktop
PeekMessageW
GetSubMenu
GetWindow

gdi32

GetCurrentObject
GetTextExtentExPointW
TextOutW
PatBlt
LPtoDP
CreateBitmap
SelectClipRgn
SetRectRgn
CreateRectRgnIndirect
DPtoLP
Polyline
RectVisible
ExtCreatePen
GetBkMode
CreatePenIndirect
SaveDC
SetStretchBltMode
GetStretchBltMode
GetTextColor
RestoreDC
CreatePatternBrush
CreateSolidBrush
GetDIBits
RealizePalette
SelectPalette
CreateDCW
GetTextExtentPoint32W
GetObjectA
CombineRgn
ExtCreateRegion
StretchBlt
SetTextColor
SetViewportOrgEx
Rectangle
LineTo
MoveToEx
ExtTextOutW
SetBkColor
GetTextMetricsW
GetObjectW
CreateFontIndirectW
CreateRectRgn
ExcludeClipRect
BitBlt
CreateCompatibleBitmap
GetClipBox
RoundRect
CreatePen
SetBkMode
GetStockObject
SelectObject
CreateDIBSection
DeleteDC
CreateCompatibleDC
DeleteObject
GetDeviceCaps
CreateDCA

advapi32

RegOpenKeyExA
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
GetUserNameW
RegQueryValueExW
GetLengthSid
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
InitializeAcl
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExA
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetAce
GetSidLengthRequired
InitializeSid
AddAce
GetFileSecurityW
DuplicateToken
MapGenericMask
AccessCheck
GetSecurityDescriptorDacl
GetAclInformation
LookupAccountSidW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
CryptEncrypt
RegGetKeySecurity
RegSetKeySecurity
ConvertStringSidToSidW
RegEnumKeyW
RegOpenKeyW
RegQueryInfoKeyW
CloseServiceHandle
DeleteService
OpenSCManagerW
EnumDependentServicesW
OpenServiceW
QueryServiceConfig2W
ChangeServiceConfig2W
StartServiceW
ChangeServiceConfigW
QueryServiceStatusEx
ControlService
QueryServiceConfigW
CryptAcquireContextA
CryptGenRandom
RegEnumKeyExW
CreateServiceW
QueryServiceStatus
GetTokenInformation
ConvertSidToStringSidW
CryptGetHashParam
CryptImportKey
CryptSetKeyParam

shell32

SHChangeNotify
ord51
SHGetDesktopFolder
SHGetFileInfoW
ExtractIconExW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteExW
SHCreateDirectoryExW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW
ord165
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoInitialize
IIDFromString
StringFromIID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateGuid

oleaut32

VariantInit
VarBstrCmp
SysStringByteLen
VariantClear
SysAllocString
SysAllocStringLen
CreateErrorInfo
SysStringLen
SysAllocStringByteLen
SafeArrayGetLBound
SysFreeString
OleCreatePictureIndirect
VariantTimeToSystemTime
SafeArrayGetElement
SafeArrayGetUBound
GetErrorInfo
VariantChangeType
SetErrorInfo

shlwapi

PathAppendW
PathFileExistsW
UrlIsW
StrRChrIW
PathIsDirectoryW
PathAddBackslashW
PathStripToRootW
SHDeleteKeyW
wnsprintfW
StrTrimW
StrCmpNIA
StrStrIA
StrChrA
PathRemoveBackslashW
PathStripPathW
StrStrW
PathFindFileNameW
PathRemoveFileSpecW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msimg32

AlphaBlend

dwmapi

DwmGetColorizationColor

imm32

ImmGetDefaultIMEWnd
ImmAssociateContext
ImmGetContext
ImmReleaseContext

gdiplus

GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawString
GdipFillPath
GdipFillPieI
GdipDrawPath
GdipDrawArcI
GdipDrawLineI
GdipSetInterpolationMode
GdipAddPathString
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetStringFormatLineAlign
GdipSetPenWidth
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipLoadImageFromFileICM
GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImagePointsI
GdipLoadImageFromStream
GdipGraphicsClear
GdipLoadImageFromFile
GdipGetImageGraphicsContext
GdipDisposeImage
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdiplusShutdown
GdiplusStartup
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipGetImageWidth
GdipFillRectangleI
GdipDrawRectangleI
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipMeasureString
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipGetImagePixelFormat
GdipGetImageThumbnail
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipGetImageRawFormat
GdipSetPenDashArray
GdipSetWorldTransform

ntdll

RtlInitUnicodeString
NtUnlockVirtualMemory
NtDuplicateObject
NtSuspendProcess
NtSetSystemInformation
NtTerminateProcess
NtQuerySystemInformation
NtQueryInformationProcess
RtlNtStatusToDosError
NtClose
NtResumeProcess
NtSetInformationProcess
NtLockVirtualMemory
RtlUnwind
RtlNtPathNameToDosPathName
NtOpenProcess
NtCreatePagingFile

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

ws2_32

ioctlsocket
send
select
__WSAFDIsSet
getpeername
WSAIoctl
connect
htonl
freeaddrinfo
WSAEventSelect
getsockopt
WSAStartup
ntohs
getsockname
setsockopt
WSACleanup
htons
getaddrinfo
ntohl
WSAGetLastError
WSASetLastError
socket
bind
recv
closesocket

dbghelp

MiniDumpWriteDump

netapi32

NetApiBufferFree
NetWkstaTransportEnum
Netbios

wininet

GetUrlCacheEntryInfoExW

Exports

Exports

AbortInstall
CreateInstallWnd
DirLeave
DoUnAdData
ExitWork
GeProtectStartState
GetAppdataLocalLow
GetAutoStartState
GetCheckBoxStatus
GetInstallSvrState
GetTNFromPackageName
GetXFromPackageName
HideWindow
InitInstallHelper
InitUnInstallHelper
KillProcess
NewNsisWndProc
NotifyHostSetupStatus
NotifyInstallStatus
RegisterExt
ReportSilentInstall
UnRegisterExt
UninitInstallHelper
UninstallWebAdapter
WriteMustRebootTag

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 427KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5586b694e0a3109f9bd9f3a899e9353d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

msimg32

dwmapi

imm32

gdiplus

ntdll

psapi

mpr

ws2_32

dbghelp

netapi32

wininet

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 427KB - Virtual size: 427KB

.data Size: 57KB - Virtual size: 85KB

.rsrc Size: 318KB - Virtual size: 317KB

.reloc Size: 114KB - Virtual size: 114KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 427KB - Virtual size: 427KB

.data
Size: 57KB - Virtual size: 85KB

.rsrc
Size: 318KB - Virtual size: 317KB

.reloc
Size: 114KB - Virtual size: 114KB