1496a8986cd08bbfdf0404740f908cf3b3b003c02cc674cd64a1719307ae9514

Sharing

Copy URL Twitter E-mail

General

Target

1496a8986cd08bbfdf0404740f908cf3b3b003c02cc674cd64a1719307ae9514
Size

18.0MB
MD5

3243d6eeab926566909b155b6c44194b
SHA1

a5da09eb923f5337fcb60af492ec5444aa39ac0d
SHA256

1496a8986cd08bbfdf0404740f908cf3b3b003c02cc674cd64a1719307ae9514
SHA512

9e4f7a10e43c62b3561aa30f5e89d063d89d0825d10b19b9c1062e079c1fa7e62b35cfcb9f3a23738182565310290b849000aae07167fb5b141131ea6acae0b0
SSDEEP

393216:wG0eMuAWKx4ihS27lObhRYF+UUQ7IDl6XNSIibMoPVnbW1dCgsv:/K3x4bIlObhqFNUi4loN7ibRPVnbWTm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Installs_2025.exe

Files

1496a8986cd08bbfdf0404740f908cf3b3b003c02cc674cd64a1719307ae9514
.zip
Installs_2025.exe
.exe windows:6 windows x86 arch:x86

6806d9b4a268fea22ebdaa5d60e6c3a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SignalObjectAndWait
SleepEx
FreeLibrary
GetFileSize
VerifyVersionInfoW
lstrcatA
GlobalLock
GetFileInformationByHandle
FlushFileBuffers
LoadLibraryExW
GetCurrentThread
GetStartupInfoW
CreateDirectoryW
FreeLibraryAndExitThread
GetProcAddress
GlobalUnlock
ReadConsoleW
MoveFileExW
QueryDepthSList
FindFirstFileW
SetThreadPriority
GetLogicalDriveStringsW
ReadFile
PeekNamedPipe
SetFilePointer
GetSystemDirectoryW
GetDateFormatW
GetCurrentProcess
CreateSemaphoreW
SetPriorityClass
QueryPerformanceCounter
TlsSetValue
EnumSystemLocalesW
WaitForMultipleObjects
GetLastError
VirtualFree
WriteFile
GetLocaleInfoW
LoadLibraryW
FileTimeToLocalFileTime
SetThreadAffinityMask
GetConsoleOutputCP
GetTimeFormatW
WaitForSingleObject
SetLastError
GetEnvironmentVariableA
VirtualProtect
GetFileType
CompareFileTime
GetProcessHeap
UnregisterWaitEx
ReleaseSRWLockExclusive
WriteConsoleW
SetFileTime
HeapFree
EncodePointer
UnregisterWait
IsValidLocale
RegisterWaitForSingleObject
InitializeCriticalSectionAndSpinCount
QueryPerformanceFrequency
GetUserDefaultLCID
GetTickCount
FindNextFileW
DeleteCriticalSection
GetCurrentThreadId
GetEnvironmentStringsW
InterlockedFlushSList
CloseHandle
GetCPInfo
VirtualAlloc
GetTimeZoneInformation
SetStdHandle
SwitchToThread
LeaveCriticalSection
FreeEnvironmentStringsW
MultiByteToWideChar
GetFileAttributesExW
CreateThread
DecodePointer
InitializeCriticalSectionEx
CompareStringW
TlsAlloc
InterlockedPushEntrySList
GetLogicalProcessorInformation
GetFileAttributesW
GetTickCount64
GetProcessAffinityMask
ResetEvent
FindClose
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
TerminateProcess
SetEnvironmentVariableW
ExitProcess
GetModuleHandleA
GetModuleHandleW
GetSystemInfo
TryEnterCriticalSection
ExitThread
SystemTimeToTzSpecificLocalTime
GlobalFree
GetThreadTimes
AcquireSRWLockExclusive
LCMapStringW
Sleep
lstrlenA
SetEndOfFile
FormatMessageW
RemoveDirectoryW
GlobalMemoryStatus
VerSetConditionMask
InitializeCriticalSection
IsValidCodePage
InitializeSListHead
SetEvent
TlsGetValue
GetFullPathNameW
GlobalAlloc
GetNumaHighestNodeNumber
LocalFree
SetFilePointerEx
GetCurrentDirectoryW
DeleteTimerQueueTimer
SetFileAttributesW
CreateFileW
GetThreadPriority
GetVersion
TlsFree
GetCommandLineW
MoveFileW
CreateEventW
RaiseException
ReleaseSemaphore
GetConsoleMode
SetUnhandledExceptionFilter
WideCharToMultiByte
EnterCriticalSection
HeapSize
ChangeTimerQueueTimer
GetModuleFileNameW
CreateTimerQueueTimer
GetStdHandle
WaitForSingleObjectEx
GetCurrentProcessId
RtlUnwind
UnhandledExceptionFilter
GetCommandLineA
GetFileSizeEx
CreateTimerQueue
GetDriveTypeW
FindFirstFileExW
GetOEMCP
DuplicateHandle
GetACP
InterlockedPopEntrySList
GetModuleHandleExW
IsDebuggerPresent
DeleteFileW
GetStringTypeW
IsProcessorFeaturePresent
GetVersionExW

user32

GetWindowTextLengthW
CloseClipboard
PostMessageW
SystemParametersInfoW
MessageBoxW
EndDialog
SendMessageW
InvalidateRect
EnableWindow
SetDlgItemTextW
GetWindowTextW
GetWindowRect
MonitorFromWindow
EmptyClipboard
CheckDlgButton
GetParent
SetWindowTextW
SetWindowLongW
LoadStringW
GetDlgItem
SetCursor
ScreenToClient
wsprintfA
LoadIconW
SetFocus
MoveWindow
MapDialogRect
DialogBoxParamW
GetFocus
SetClipboardData
SetTimer
MessageBoxA
ShowWindow
CharUpperW
OpenClipboard
GetKeyState
IsDlgButtonChecked
GetMonitorInfoA
GetWindowLongW
KillTimer
LoadCursorW

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptGetHashParam
CryptHashData
CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CloseServiceHandle

shell32

SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
OleInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain
CertFindCertificateInStore
CertEnumCertificatesInStore
PFXImportCertStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CryptDecodeObjectEx
CryptStringToBinaryW
CertCloseStore
CryptQueryObject
CertGetNameStringW
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertFindExtension
CertOpenStore
CertFreeCertificateContext

wldap32

ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27

ws2_32

recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAWaitForMultipleEvents
freeaddrinfo
getsockopt
send
WSACloseEvent
WSAResetEvent
WSAEnumNetworkEvents
socket
WSAEventSelect
getaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSAIoctl
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSACreateEvent

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6806d9b4a268fea22ebdaa5d60e6c3a4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.6MB - Virtual size: 6.6MB

.rdata Size: 276KB - Virtual size: 275KB

.data Size: 13KB - Virtual size: 34KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 96KB - Virtual size: 95KB

.text
Size: 6.6MB - Virtual size: 6.6MB

.rdata
Size: 276KB - Virtual size: 275KB

.data
Size: 13KB - Virtual size: 34KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 96KB - Virtual size: 95KB