Setup[.]x86[.]en-US_ProPlusRetail_NQTF8-C889H-6HQ37-CC9RK-BKJQD_TX_PR_act_1_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Setup.x86.en-US_ProPlusRetail_NQTF8-C889H-6HQ37-CC9RK-BKJQD_TX_PR_act_1_.exe
Size

958KB
MD5

0f08f2b24d868d78196eb2f8860ad985
SHA1

66ddbffb1d22e95fab84bf0899751224deb2c760
SHA256

beb093cf3b9ffea445972b1c80a8c7e9e98407657ad89308dfcd2b6c3ed6764e
SHA512

749a80373db7a1a650c8b1f1fc741ca7528408380637444dd059c40761ed1c8bc41f97218c67d81ecd0b240e60309616bdc080ca4a40a4aa698135397e9ce6c8
SSDEEP

24576:AnQ3YYmrALiJ1UZrYcjE/SBeD5rrFH39+ihi:AnQ3Ydc9GcoXNrNhi

Score

1^/10

Malware Config

Signatures

Files

Setup.x86.en-US_ProPlusRetail_NQTF8-C889H-6HQ37-CC9RK-BKJQD_TX_PR_act_1_.exe
.exe windows:5 windows x86 arch:x86

78f3a0ce0f18b6b5072ad7c6ce3c763b

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:58:3f:c8:b7:dd:88:ca:a3:06:d3:52:27:7a:cd:17:8f:88:6d:6c
Signer

Actual PE Digest

d2:58:3f:c8:b7:dd:88:ca:a3:06:d3:52:27:7a:cd:17:8f:88:6d:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

P:\Target\x86\ship\click2run\en-us\bootstrapper.pdb

Imports

advapi32

RegCloseKey
RegCreateKeyExW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CredWriteW
CreateProcessAsUserW
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
RegGetValueW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LookupAccountNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RevertToSelf
EventWrite
EventUnregister
EventRegister

kernel32

InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
CloseHandle
GetLocalTime
GetComputerNameW
WriteFile
GetCurrentProcessId
SetEvent
CreateEventExW
GetTickCount64
WaitForMultipleObjects
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
SetLastError
CreateDirectoryW
FindClose
FindFirstFileExW
GetFileAttributesExW
SetFileAttributesW
SetFilePointerEx
GetTickCount
FormatMessageW
WideCharToMultiByte
CreateEventW
IsProcessorFeaturePresent
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForSingleObject
TerminateProcess
GetCurrentThread
GetThreadIOPendingFlag
TryEnterCriticalSection
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
SetWaitableTimerEx
CancelWaitableTimer
CreateWaitableTimerW
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
OpenProcess
MapViewOfFile
UnmapViewOfFile
CreateSemaphoreA
CreateFileMappingA
QueryFullProcessImageNameW
TlsSetValue
WerUnregisterMemoryBlock
CreateThread
GetProcessAffinityMask
ResetEvent
MulDiv
WaitForSingleObjectEx
CreateMemoryResourceNotification
FreeLibrary
LoadLibraryExW
IsSystemResumeAutomatic
GetSystemPowerStatus
ReleaseSemaphore
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
Sleep
RaiseException
TlsGetValue
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
HeapSize
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InterlockedExchange
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetVersionExW
GetUserGeoID
GetSystemDefaultLCID
ExpandEnvironmentStringsW
LocaleNameToLCID
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
CreateMutexW
FreeConsole
AttachConsole
AllocConsole
K32GetProcessImageFileNameW
LocalFree
GetShortPathNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetLocaleInfoEx
GetFileAttributesW
OutputDebugStringA
OpenThread
GetExitCodeThread
GetVersion
GetModuleHandleA
LoadLibraryA
MoveFileExW
LocalAlloc
GetTempPathW
GetStringTypeExW
GetOverlappedResult
DecodePointer
TlsFree
lstrcmpW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
TlsAlloc
GetProcessHeap
GetTempPathA
DeleteFileA
LCIDToLocaleName
GetLongPathNameW
GetShortPathNameA
GetModuleFileNameA
RtlUnwind
SetEndOfFile
SetUnhandledExceptionFilter
MultiByteToWideChar
RaiseFailFastException
GetModuleFileNameW
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
WerRegisterMemoryBlock
VerSetConditionMask
GetDiskFreeSpaceExW
GetNativeSystemInfo
VerifyVersionInfoW
ProcessIdToSessionId
GetTempFileNameW
ReadFile
CopyFileW
GetFullPathNameW
GetExitCodeProcess
CreateProcessW
GetPriorityClass
K32EnumProcesses
K32GetModuleFileNameExW
GetCurrentDirectoryW
GlobalFree

ole32

StringFromIID
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoRevokeInitializeSpy
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoRegisterInitializeSpy

ws2_32

GetAddrInfoW
WSAStartup
FreeAddrInfoW

gdi32

CreateFontW
CreateSolidBrush
DeleteObject
GetDeviceCaps
GetStockObject
Rectangle
SelectObject
SetDCPenColor
GetTextMetricsW
GetTextExtentPoint32W
SetBkColor
SetDCBrushColor
SetTextColor
CreatePen

gdiplus

GdipDeleteBrush
GdipDrawImageRectI
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipAlloc
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipCreateSolidFill
GdipCloneBrush
GdiplusStartup
GdipFree

rpcrt4

RpcBindingFromStringBindingW
RpcMgmtIsServerListening
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoW
RpcBindingFree

iphlpapi

FreeMibTable
CreateSortedAddressPairs

oleaut32

SysAllocString
VariantInit
VariantClear
SysFreeString

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

cabinet

ord13
ord10
ord14

setupapi

SetupIterateCabinetW

Sections

.text
Size: 774KB - Virtual size: 774KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78f3a0ce0f18b6b5072ad7c6ce3c763b

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33Certificate

Extended Key Usages

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:caCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

d2:58:3f:c8:b7:dd:88:ca:a3:06:d3:52:27:7a:cd:17:8f:88:6d:6cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ole32

ws2_32

gdi32

gdiplus

rpcrt4

iphlpapi

oleaut32

version

wintrust

cabinet

setupapi

Sections

.text Size: 774KB - Virtual size: 774KB

.data Size: 34KB - Virtual size: 38KB

.rsrc Size: 106KB - Virtual size: 108KB

.reloc Size: 36KB - Virtual size: 36KB

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

d2:58:3f:c8:b7:dd:88:ca:a3:06:d3:52:27:7a:cd:17:8f:88:6d:6c
Signer

.text
Size: 774KB - Virtual size: 774KB

.data
Size: 34KB - Virtual size: 38KB

.rsrc
Size: 106KB - Virtual size: 108KB

.reloc
Size: 36KB - Virtual size: 36KB