installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

installer.exe
Size

3.5MB
MD5

71ebb8c221d0547204061b8ecba92eed
SHA1

2b029d9bf3df4e356b6c9771be598f474c7c3b69
SHA256

5b50323bbb79e39705dc2a6f7be26cd71d4c185d6ae5ae9825e72c58d6c7d6c3
SHA512

326894858443e751db005790f829cec928681afb669bec2a68cc040f6ea1936e586c4b6b5c2586150723e149d7f154083b9a2899d6d344d9e0ab9b817e241454
SSDEEP

49152:jLznojjO6VBKvKgXyxLkAZiRpmYzdaaHsUq1p8yhnn2Vf06BrS4Gef98c:cN/hh1pPnn2VZr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
installer.exe

Files

installer.exe
.exe windows:6 windows x64 arch:x64

f88292beececf4c45b4a231cc4453088

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Windows\Documents\Rust Stuff\yourcontrolinstaller\src-tauri\target\release\deps\installer.pdb

Imports

simconnect

SimConnect_Close
SimConnect_Open

ntdll

RtlLookupFunctionEntry
RtlGetNtVersionNumbers
RtlCaptureContext
RtlVirtualUnwind

ws2_32

WSACleanup
freeaddrinfo
WSAStartup
setsockopt
shutdown
send
ioctlsocket
WSASocketW
connect
select
WSAGetLastError
getaddrinfo
closesocket
recv
WSADuplicateSocketW
getsockopt

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegDeleteKeyExW
RegCreateKeyExW
RegOpenKeyExW
SystemFunction036

shell32

ShellExecuteW
SHGetKnownFolderPath
SHCreateItemFromParsingName

kernel32

SetFileInformationByHandle
SetFilePointerEx
GetEnvironmentVariableW
GetEnvironmentStringsW
GetStdHandle
GetCurrentProcessId
GetCurrentDirectoryW
SetLastError
SetHandleInformation
WriteFileEx
SleepEx
GetExitCodeProcess
GetCurrentThread
WaitForMultipleObjects
GetOverlappedResult
WakeAllConditionVariable
TryAcquireSRWLockExclusive
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
CreateDirectoryW
FindFirstFileW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GetFileInformationByHandleEx
CopyFileExW
CreateEventW
ReadFile
CancelIo
GetCurrentProcess
Sleep
SwitchToThread
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
CreateProcessW
CreateThread
TlsGetValue
TlsSetValue
WriteConsoleW
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
ReleaseSRWLockShared
FindClose
ReleaseMutex
FreeEnvironmentStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
DuplicateHandle
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetModuleHandleA
GetModuleFileNameA
GetCurrentThreadId
GetSystemInfo
lstrlenW
FormatMessageW
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WaitForSingleObject
SetEvent
CreateEventA
HeapAlloc
CloseHandle
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapFree
GetProcessHeap
InterlockedPushEntrySList
TerminateProcess

secur32

DeleteSecurityContext
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
EncryptMessage
FreeContextBuffer
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW

crypt32

CertDuplicateStore
CertCloseStore
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertFreeCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateChain
CertGetCertificateChain
CertEnumCertificatesInStore
CertOpenStore

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
CoUninitialize
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles

oleaut32

SysFreeString
SysStringLen
GetErrorInfo

user32

MessageBoxA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
LoadImageA
SetWindowLongPtrA
GetWindowLongPtrA
SetWindowLongA
GetWindowLongA
AdjustWindowRect
GetClientRect
SetWindowTextA
UpdateWindow
GetSystemMetrics
SetFocus
DestroyWindow
SetWindowPos
ShowWindow
PostQuitMessage

shlwapi

PathFindFileNameA

bcrypt

BCryptGenRandom

webview2loader

CreateCoreWebView2EnvironmentWithOptions

msvcp140

?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??Bid@locale@std@@QEAA_KXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z

vcruntime140

memmove
memcpy
__CxxFrameHandler3
memset
_purecall
__current_exception_context
__current_exception
__C_specific_handler
__std_exception_copy
_CxxThrowException
__std_exception_destroy
memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncat
isalnum
strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vsprintf_s
_set_fmode
__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_errno
_cexit
_c_exit
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_wassert
__p___argv
terminate
_register_thread_local_exe_atexit_callback
_initterm_e
_crt_atexit
exit
_exit
_set_app_type
__p___argc

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateStringReference
WindowsPromoteStringBuffer
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsPreallocateStringBuffer

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 959KB - Virtual size: 958KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f88292beececf4c45b4a231cc4453088

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

simconnect

ntdll

ws2_32

advapi32

shell32

kernel32

secur32

crypt32

ole32

oleaut32

user32

shlwapi

bcrypt

webview2loader

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 959KB - Virtual size: 958KB

.data Size: 17KB - Virtual size: 20KB

.pdata Size: 109KB - Virtual size: 109KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 959KB - Virtual size: 958KB

.data
Size: 17KB - Virtual size: 20KB

.pdata
Size: 109KB - Virtual size: 109KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 23KB - Virtual size: 22KB