27d7245e7db36e5f2595341b2361788de080763e0dcb2b96634a08a5964a3449

Sharing

Copy URL Twitter E-mail

General

Target

27d7245e7db36e5f2595341b2361788de080763e0dcb2b96634a08a5964a3449
Size

20.3MB
MD5

2d77ef8c310627a7fe82b9a8a4f3e650
SHA1

5f938d2d3225378ec9b865852bac7cd2e3c8f08f
SHA256

27d7245e7db36e5f2595341b2361788de080763e0dcb2b96634a08a5964a3449
SHA512

aa524173bea7b13ec62425e6dcd0d7724070e5b4122097d878fdc9a41d13bcd2016362d6d5c142be03125f206511ee36e73b99c2a646a2d5cbed362986215ca3
SSDEEP

393216:o/Gq+CFWsu9hfFj52+I41CbycT3ZC9a7ORfKEjW+9xKcLIVjDJtl2nzbAhQ9UCK:YGdCWFfF12+I41CDhcyEq6xkRPMnD5K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Installation_2025.exe

Files

27d7245e7db36e5f2595341b2361788de080763e0dcb2b96634a08a5964a3449
.zip
Installation_2025.exe
.exe windows:6 windows x86 arch:x86

f3ba5f630cff5346633a89244fd47d24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
ReleaseSemaphore
SetFilePointerEx
ExitThread
QueryPerformanceCounter
LeaveCriticalSection
DuplicateHandle
GlobalFree
lstrcatA
CreateFileW
TlsFree
WaitForMultipleObjects
GetStdHandle
SystemTimeToTzSpecificLocalTime
ReadFile
InitializeCriticalSectionEx
SleepEx
GetTimeFormatW
CreateDirectoryW
RegisterWaitForSingleObject
GetSystemTimeAsFileTime
MoveFileW
LCMapStringW
RaiseException
FindClose
GlobalUnlock
TlsGetValue
TerminateProcess
FreeEnvironmentStringsW
GetFullPathNameW
VerifyVersionInfoW
GlobalLock
GetProcAddress
FlushFileBuffers
GetCurrentProcess
HeapReAlloc
GetSystemInfo
VirtualProtect
GetLastError
GetStringTypeW
FindFirstFileExW
GetTimeZoneInformation
DeleteFileW
VirtualAlloc
CreateTimerQueue
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetStartupInfoW
GetCommandLineA
GetProcessHeap
FreeLibrary
CompareFileTime
GetEnvironmentStringsW
SetFileAttributesW
FindFirstFileW
EnterCriticalSection
SetUnhandledExceptionFilter
PeekNamedPipe
GetSystemDirectoryW
GetLogicalProcessorInformation
VirtualFree
GetVersionExW
CreateEventW
IsDebuggerPresent
WriteFile
SetFileTime
CompareStringW
GetCurrentThread
SetThreadAffinityMask
MultiByteToWideChar
SetFilePointer
MoveFileExW
GetLocaleInfoW
FindNextFileW
LocalFree
GetDriveTypeW
DeleteTimerQueueTimer
GetModuleFileNameW
GetNumaHighestNodeNumber
GetProcessAffinityMask
SignalObjectAndWait
GetConsoleMode
LoadLibraryExW
RemoveDirectoryW
ResetEvent
InterlockedFlushSList
WriteConsoleW
GetFileSize
GetThreadTimes
ExitProcess
GetFileInformationByHandle
InterlockedPopEntrySList
RtlUnwind
GetTickCount
SetEndOfFile
ReleaseSRWLockExclusive
WaitForSingleObject
GetACP
FormatMessageW
FreeLibraryAndExitThread
SetPriorityClass
GetCommandLineW
GetDateFormatW
InitializeCriticalSection
UnregisterWait
SetEnvironmentVariableW
IsProcessorFeaturePresent
lstrlenA
SetThreadPriority
ReadConsoleW
FileTimeToSystemTime
GetOEMCP
GetFileAttributesExW
UnregisterWaitEx
InitializeSListHead
IsValidCodePage
EnumSystemLocalesW
GetTickCount64
GlobalMemoryStatus
SetLastError
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetEnvironmentVariableA
GetFileAttributesW
SetEvent
WaitForSingleObjectEx
GetCPInfo
HeapSize
IsValidLocale
LoadLibraryW
SwitchToThread
GetModuleHandleExW
CreateSemaphoreW
FileTimeToLocalFileTime
InterlockedPushEntrySList
QueryDepthSList
DeleteCriticalSection
GetConsoleOutputCP
SetStdHandle
GetCurrentProcessId
CloseHandle
GetCurrentDirectoryW
GetModuleHandleW
HeapFree
CreateTimerQueueTimer
GetLogicalDriveStringsW
GetThreadPriority
GetFileType
GetFileSizeEx
ChangeTimerQueueTimer
Sleep
VerSetConditionMask
UnhandledExceptionFilter
TryEnterCriticalSection
GlobalAlloc
GetVersion
CreateThread
HeapAlloc
WideCharToMultiByte
EncodePointer
AcquireSRWLockExclusive
GetUserDefaultLCID

user32

GetWindowTextW
GetWindowLongW
IsDlgButtonChecked
SystemParametersInfoW
MessageBoxW
SetTimer
SetDlgItemTextW
InvalidateRect
CloseClipboard
SetFocus
GetFocus
GetMonitorInfoA
PostMessageW
EnableWindow
SetWindowLongW
wsprintfA
DialogBoxParamW
SetWindowTextW
GetWindowRect
OpenClipboard
MessageBoxA
SetCursor
CharUpperW
MonitorFromWindow
KillTimer
MoveWindow
LoadStringW
CheckDlgButton
GetKeyState
MapDialogRect
LoadIconW
SetClipboardData
GetDlgItem
EmptyClipboard
EndDialog
ScreenToClient
ShowWindow
SendMessageW
GetParent
GetWindowTextLengthW
LoadCursorW

advapi32

CryptImportKey
CryptDestroyKey
CloseServiceHandle
CryptGetHashParam
CryptEncrypt
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext

shell32

SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
SHBrowseForFolderW

ole32

CoTaskMemFree
CoCreateInstance
OleInitialize
CoUninitialize
CoInitialize

oleaut32

SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

crypt32

CertCreateCertificateChainEngine
CertAddCertificateContextToStore
CertGetNameStringW
CertCloseStore
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptQueryObject
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CryptDecodeObjectEx
CertOpenStore
CryptStringToBinaryW
CertFindCertificateInStore
PFXImportCertStore

wldap32

ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27

ws2_32

recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAResetEvent
freeaddrinfo
getsockopt
send
WSAIoctl
WSAEnumNetworkEvents
WSACreateEvent
socket
WSAWaitForMultipleEvents
WSAEventSelect
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSACloseEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 275KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3ba5f630cff5346633a89244fd47d24

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.5MB - Virtual size: 6.5MB

.rdata Size: 275KB - Virtual size: 275KB

.data Size: 13KB - Virtual size: 34KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 95KB - Virtual size: 95KB

.text
Size: 6.5MB - Virtual size: 6.5MB

.rdata
Size: 275KB - Virtual size: 275KB

.data
Size: 13KB - Virtual size: 34KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 95KB - Virtual size: 95KB