installer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
installer.exe
Size 1.4MB
Sample240430-zh1vmsfe2w
SHA256 2086255aa9dd46e1ce72441abad47ea9c845a010ebc92cd6cb4414c37d5b20d7
MD5 c1a2839277487b16f3a80b52f1efb39e
SHA1 689e75b411a530a28597ecea9a6283700576ec56
SHA512 81bb748975356a3f751ecc9398d40c232c2510d1a4f8c498e3e40008d35439531bc5ae625f7309fe41cc9d3685335db5bdfdf34290f732c740b896ddbee94644
SSDEEP 24576:kwGvIBKN5VI/EtUhUN51zj1SqdAGFQZIx+C45UJoens:xKNU/EtUuN3zjYq+ZIgL5UJoes
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

installer.exe

.exe 1.4MB

installer.exe

IMPHASH 14c198737dea646ad253084b784990ed
SHA256 2086255aa9dd46e1ce72441abad47ea9c845a010ebc92cd6cb4414c37d5b20d7
MD5 c1a2839277487b16f3a80b52f1efb39e
SHA1 689e75b411a530a28597ecea9a6283700576ec56
SHA512 81bb748975356a3f751ecc9398d40c232c2510d1a4f8c498e3e40008d35439531bc5ae625f7309fe41cc9d3685335db5bdfdf34290f732c740b896ddbee94644
SSDEEP 24576:kwGvIBKN5VI/EtUhUN51zj1SqdAGFQZIx+C45UJoens:xKNU/EtUuN3zjYq+ZIgL5UJoes
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Password

infected

PE Signature issue

Digest

80:2b:cb:0d:ee:04:2d:64:c2:93:33:10:37:9a:54:bb:35:f3:bb:76:b7:95:45:69:6a:b3:78:13:45:98:2e:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 30, 2023

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

316003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\750240\out\Release\360Installer.pdb

kernel32

GetVersionExW GetVersion GetProcAddress GetModuleHandleW FreeLibrary lstrlenW lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection InterlockedDecrement InterlockedIncrement DebugBreak OutputDebugStringW lstrlenA LockResource FreeResource GetCurrentThreadId GetCommandLineW LocalFree GetSystemDirectoryW CloseHandle ReadFile SetFilePointer CreateFileW GetCurrentProcessId DeviceIoControl GetUserDefaultUILanguage GetTempPathW SetEnvironmentVariableW Sleep GetCurrentProcess FlushInstructionCache SetLastError GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetFileSizeEx GetLogicalDriveStringsW GetDriveTypeW GetTempFileNameW DeleteFileW GetDiskFreeSpaceExW QueryDosDeviceW OpenProcess MulDiv GetPrivateProfileStringW GetTickCount CreateProcessW LoadLibraryW GetModuleFileNameA CreateToolhelp32Snapshot MoveFileExW FindClose GetFullPathNameW FindFirstFileW lstrcpyW FindNextFileW RemoveDirectoryW FreeConsole Process32FirstW Process32NextW WideCharToMultiByte SetEvent CreateMutexW CreateEventW WaitForSingleObject GetLogicalDrives WriteFile LocalAlloc InterlockedCompareExchange CreateFileA GetFileSize InterlockedExchange LoadLibraryA HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree VirtualAlloc SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetEndOfFile SetFilePointerEx TlsGetValue TlsSetValue HeapUnlock OpenThread HeapLock HeapWalk ReleaseMutex TlsAlloc TlsFree lstrcmpA lstrcmpiA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread ExitProcess GetStartupInfoW RtlUnwind LCMapStringA LCMapStringW GetCPInfo HeapReAlloc HeapSize HeapCreate HeapDestroy GetStdHandle GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetModuleHandleA SetStdHandle GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW FindResourceExW

Sharing

General

Malware Config

Signatures

File Explorer

installer.exe

PE Signature issue

kernel32

generic