ec9c1e1fddb6184ebb401c5386f3b4769e8d4c67af4f95edaa11f2143eab00de

Sharing

Copy URL Twitter E-mail

General

Target

ec9c1e1fddb6184ebb401c5386f3b4769e8d4c67af4f95edaa11f2143eab00de
Size

2.6MB
MD5

86869bfe16c25d31543ddba62557c320
SHA1

a575123eb43988caee90e3808bb338e98c72963e
SHA256

ec9c1e1fddb6184ebb401c5386f3b4769e8d4c67af4f95edaa11f2143eab00de
SHA512

87fcb02a42d46d4a2b93ecaf6c8d59fbda6945a5d174c47d88f8051e412a5caf6d4019c92d7d56c80ca11ce3e98c2212e2a13c2cba64346d791e0874f879e121
SSDEEP

49152:k7HDqSzBB7NwOJf9smIyQInwD5KdkPDXEXTtDnSEbw6ddxU:MdzBBJwOzsmBQInE4diDXA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec9c1e1fddb6184ebb401c5386f3b4769e8d4c67af4f95edaa11f2143eab00de

Files

ec9c1e1fddb6184ebb401c5386f3b4769e8d4c67af4f95edaa11f2143eab00de
.exe windows:5 windows x86 arch:x86

b636a5851343135e63308b831d6cb111

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\IntallationKit\ZwSetupSrc_2.0_main\OutPut\Win32_Release_Pdb\ZwInstaller.pdb

Imports

psapi

GetProcessImageFileNameW
EnumProcesses

msiprovider

?InstallPackage@?$Installer@VMsiProvider@@@MSI@@QAEIPB_W0_N@Z
??0MsiProvider@@QAE@XZ
??1MsiProvider@@UAE@XZ
?setCallback@MsiProvider@@UAEXPAVMsiCallbackInterface@@@Z
?uninstallPackage@MsiProvider@@UAEIPB_W0@Z
?repairPackage@MsiProvider@@UAEIPB_W0_N@Z
?modifyPackage@MsiProvider@@UAEIPB_W0_N@Z

mfc100u

ord8618
ord3932
ord13352
ord7065
ord13043
ord5049
ord12992
ord7366
ord12446
ord7976
ord9524
ord9897
ord8143
ord2346
ord4785
ord2885
ord377
ord1987
ord2064
ord11982
ord945
ord4068
ord12821
ord12186
ord3428
ord374
ord2184
ord10081
ord3174
ord5855
ord5799
ord2068
ord3446
ord3495
ord2185
ord5862
ord8509
ord12951
ord4802
ord4959
ord13208
ord5813
ord1272
ord871
ord5118
ord9328
ord7624
ord6869
ord1292
ord7548
ord11236
ord9498
ord11845
ord11784
ord4086
ord7176
ord13854
ord4744
ord9447
ord2164
ord11476
ord11477
ord13381
ord7108
ord13387
ord8530
ord3684
ord3625
ord11864
ord7126
ord1739
ord14162
ord10976
ord13267
ord11469
ord7179
ord13570
ord13567
ord13572
ord7109
ord13382
ord2407
ord2665
ord3992
ord14067
ord5143
ord3999
ord4416
ord4383
ord4379
ord4413
ord4434
ord4392
ord4421
ord4430
ord4400
ord4404
ord4408
ord4396
ord4425
ord4388
ord1519
ord1512
ord12557
ord1508
ord9353
ord11244
ord11246
ord12724
ord2853
ord8393
ord10045
ord6247
ord11210
ord8112
ord13380
ord10937
ord3397
ord3402
ord11081
ord8277
ord14060
ord14059
ord14132
ord14149
ord14145
ord14147
ord14148
ord14146
ord13569
ord13571
ord13568
ord12753
ord890
ord6140
ord12325
ord6539
ord3416
ord5261
ord11228
ord7391
ord11240
ord2089
ord4150
ord7211
ord13218
ord7973
ord12948
ord11940
ord13388
ord868
ord11209
ord849
ord1934
ord7914
ord5652
ord2418
ord7385
ord9333
ord2884
ord2887
ord12610
ord5558
ord5468
ord6117
ord2844
ord3763
ord1266
ord8273
ord6344
ord381
ord2756
ord2980
ord2981
ord3627
ord9525
ord10412
ord10058
ord8179
ord948
ord11163
ord8347
ord2417
ord12606
ord5556
ord11123
ord6711
ord788
ord1212
ord3261
ord947
ord8346
ord7393
ord4792
ord6922
ord6932
ord6931
ord4623
ord4794
ord4645
ord4901
ord8483
ord5115
ord4923
ord4642
ord4512
ord4511
ord11494
ord11765
ord13189
ord5575
ord4849
ord4921
ord13202
ord4147
ord5827
ord6710
ord6671
ord2404
ord1687
ord11483
ord6925
ord6917
ord5077
ord7291
ord3526
ord1313
ord897
ord4360
ord11159
ord2852
ord2951
ord2952
ord3491
ord11116
ord2339
ord4805
ord1501
ord5276
ord6156
ord10725
ord1514
ord13047
ord290
ord1312
ord1476
ord1479
ord11683
ord11516
ord11374
ord1269
ord10969
ord2542
ord2135
ord1480
ord7913
ord293
ord7228
ord1899
ord1440
ord2136
ord4151
ord11801
ord7876
ord7871
ord13206
ord13219
ord13213
ord11838
ord7524
ord2062
ord869
ord12801
ord12153
ord12154
ord1270
ord870
ord1615
ord11544
ord4159
ord1271
ord423
ord981
ord4956
ord7353
ord2529
ord4197
ord4216
ord265
ord4290
ord2629
ord285
ord5264
ord3628
ord296
ord280
ord286
ord902
ord1310
ord2620
ord13207
ord2614
ord266
ord2683
ord13661
ord13611

msvcr100

_copysign
fmod
exp
abort
_snprintf
_vsnprintf_s
acos
__iob_func
vprintf
atan2
rewind
_get_osfhandle
_local_unwind4
wcsncpy
_finite
_vsnprintf
sqrt
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
strchr
isspace
isalpha
isalnum
_stricmp
_CxxThrowException
_setjmp3
longjmp
strcmp
strncmp
strtol
_lrotl
feof
ldexp
tan
isprint
tolower
log
wcstok
sin
cos
pow
_swprintf
memmove_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_wcsicmp
wcsncmp
_purecall
swscanf
free
malloc
memmove
ceil
wcschr
wcsstr
_snwprintf_s
_wtoi
swprintf_s
_wcsnicmp
vswprintf_s
_wsplitpath
_waccess
_wcsrev
_wcsupr
wcscat_s
wcscpy_s
calloc
_resetstkoflw
_recalloc
memcpy_s
fputc
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_unlock_file
ungetc
fgetpos
memchr
_fseeki64
fflush
fgetc
fsetpos
fopen
setvbuf
_lock_file
fprintf
fwrite
setlocale
fclose
_wcslwr
_vscwprintf
_beginthreadex
_wtof
_wfopen
wcslen
wcscmp
memcpy
wcstol
wcstoul
_ftelli64
sprintf
memset
memcmp
fread
ftell
fseek
__CxxFrameHandler3
ferror
realloc
strlen
qsort
bsearch
swscanf_s
abs
fabs
floor
wcsrchr
labs
wcscpy
_filelength
_fileno
div
isdigit
_localtime64_s
_time64

kernel32

Sleep
TerminateProcess
SetThreadPriority
SetEvent
CopyFileW
GetEnvironmentVariableW
GetUserDefaultLocaleName
MapViewOfFile
UnmapViewOfFile
VirtualQuery
GetTempPathW
GetPrivateProfileStringW
OpenMutexW
Process32FirstW
Process32NextW
OpenFileMappingW
CreateToolhelp32Snapshot
OpenEventW
GetDiskFreeSpaceExW
GetVersion
FlushInstructionCache
HeapDestroy
ReleaseMutex
HeapAlloc
HeapCreate
InitializeCriticalSection
LockResource
LoadResource
SizeofResource
FindResourceW
SetLastError
FreeResource
GetFullPathNameW
MulDiv
GetVersionExA
LoadLibraryA
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
FlushFileBuffers
MultiByteToWideChar
CreateFileW
EnterCriticalSection
SetCurrentDirectoryW
CreateMutexW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapFree
GetLocalTime
InterlockedExchange
lstrlenW
LeaveCriticalSection
LocalFree
DeleteFileW
CloseHandle
FindNextFileW
GetSystemInfo
FindFirstFileW
QueryDosDeviceW
RemoveDirectoryW
FindClose
GetLastError
GetModuleFileNameW
GetExitCodeProcess
GetVersionExW
FormatMessageW
OpenProcess
GetModuleHandleW
WaitForSingleObject
CreateDirectoryW
GetLogicalDriveStringsW
GetCurrentProcess
CreateProcessW
OutputDebugStringA
WideCharToMultiByte
GetTickCount
GetProcAddress
LoadLibraryW
FreeLibrary
InterlockedDecrement
GetFileInformationByHandle
GetFileSizeEx
TlsSetValue
TlsGetValue
TlsAlloc
ExitProcess
MoveFileExW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
CreateFileMappingW
InterlockedIncrement

user32

SystemParametersInfoW
DrawIconEx
GetForegroundWindow
MsgWaitForMultipleObjects
AppendMenuW
CreatePopupMenu
SetMenuContextHelpId
IsMenu
DestroyMenu
SetForegroundWindow
TrackPopupMenu
SetMenuInfo
GetMenuInfo
GetMenuItemCount
GetMenuItemInfoW
UpdateLayeredWindow
MapVirtualKeyA
CharLowerBuffW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DrawTextW
SystemParametersInfoA
EnableMenuItem
GetSysColor
CreateIconFromResource
LoadBitmapW
RegisterClassExW
CreateWindowExW
MapWindowPoints
UnregisterClassW
CallWindowProcW
DefWindowProcW
GetDlgItem
GetKeyState
GetFocus
SetLayeredWindowAttributes
BeginPaint
EndPaint
GetClassNameW
TrackMouseEvent
AnimateWindow
IsZoomed
GetParent
SetCaretPos
GetCaretBlinkTime
CreateCaret
HideCaret
GetCapture
ReleaseCapture
IsIconic
SetFocus
SetWindowLongW
GetDesktopWindow
IsWindowEnabled
SetActiveWindow
PostQuitMessage
GetWindowLongW
GetIconInfo
DestroyIcon
KillTimer
SetTimer
SetCursor
NotifyWinEvent
UnionRect
EqualRect
IsRectEmpty
DestroyWindow
LoadCursorW
DestroyCursor
FindWindowW
GetWindowThreadProcessId
RedrawWindow
SetWindowTextW
MessageBoxW
LoadImageW
GetClientRect
InvalidateRect
UpdateWindow
EnableWindow
GetWindow
ExitWindowsEx
wsprintfW
IntersectRect
ShowWindow
GetActiveWindow
IsWindow
IsWindowVisible
ClientToScreen
ScreenToClient
SetCapture
PostMessageW
MonitorFromWindow
GetCursorPos
GetSystemMetrics
GetMonitorInfoW
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
SendMessageW
MonitorFromRect
SetRect
CharNextW
PtInRect
InflateRect
OffsetRect
CopyRect

gdi32

GetGlyphOutlineW
GetCurrentObject
GetViewportOrgEx
BitBlt
GetStockObject
GetObjectW
CreateCompatibleDC
SelectObject
DeleteObject
SetDIBColorTable
StretchBlt
CreateDIBSection
DeleteDC
EnumFontsW
CreateBitmap
GetFontData
CreateRoundRectRgn
CreateFontIndirectW
SetBkMode
Rectangle
CreateSolidBrush
SetViewportOrgEx
GetRegionData
SelectClipRgn
ExtCreateRegion
IntersectClipRect
GetTextMetricsW
GetOutlineTextMetricsW
RemoveFontMemResourceEx
GetGlyphIndicesW
GdiFlush
ExtTextOutW
SetWorldTransform
SetTextColor
SetTextAlign
GetTextFaceW
GetFontUnicodeRanges
GetTextExtentPointI
GetCharABCWidthsW
EnumFontFamiliesExW
AddFontMemResourceEx
SetGraphicsMode
GetDeviceCaps

msimg32

AlphaBlend

advapi32

RegDeleteKeyValueW
DuplicateTokenEx
RegDeleteKeyW
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupPrivilegeValueW
RegQueryInfoKeyW
RegOpenKeyW
RegQueryValueExW
OpenProcessToken
RegEnumKeyExW

shell32

ShellExecuteW
SHChangeNotify
SHGetSpecialFolderPathW

shlwapi

StrToIntW
PathRemoveFileSpecW
StrToIntExW
PathIsDirectoryW
PathIsDirectoryEmptyW
PathFileExistsW
StrStrW

ole32

CoCreateGuid
IIDFromString
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoUninitialize
CoCreateInstance
CreateBindCtx

oleaut32

VariantClear
SysStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ

gdiplus

GdipGraphicsClear
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipSaveImageToFile
GdiplusStartup
GdipGetImageWidth
GdipCloneImage
GdipBitmapLockBits
GdipGetImagePaletteSize
GdipCreateBitmapFromFile
GdipDisposeImage
GdipAlloc
GdipDrawImageI
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImageHeight
GdipFree
GdiplusShutdown
GdipDrawImageRectI

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContext

msi

ord32
ord118
ord8
ord92
ord159
ord70
ord78
ord150
ord113
ord160
ord45

usp10

ScriptItemize
ScriptShape
ScriptFreeCache

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 454KB - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b636a5851343135e63308b831d6cb111

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

msiprovider

mfc100u

msvcr100

kernel32

user32

gdi32

msimg32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp100

gdiplus

version

imm32

msi

usp10

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 454KB - Virtual size: 454KB

.data Size: 56KB - Virtual size: 145KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 214KB - Virtual size: 213KB

.reloc Size: 185KB - Virtual size: 185KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 454KB - Virtual size: 454KB

.data
Size: 56KB - Virtual size: 145KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 214KB - Virtual size: 213KB

.reloc
Size: 185KB - Virtual size: 185KB