mini_installer_patch_3stage.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e91b8208d68d97952e0febf3fbd6769814414b22ce3973be22942aae89954bf8.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
e91b8208d68d97952e0febf3fbd6769814414b22ce3973be22942aae89954bf8.exe
Resource
win10v2004-20240419-en
General
-
Target
e91b8208d68d97952e0febf3fbd6769814414b22ce3973be22942aae89954bf8
-
Size
948KB
-
MD5
e81c5ade0b0ebe7b5d216e540b0976e8
-
SHA1
e47fd39f5c37abc6e485818710e1d06a3dff5272
-
SHA256
e91b8208d68d97952e0febf3fbd6769814414b22ce3973be22942aae89954bf8
-
SHA512
4066fc1c1a3344a826f62ede35ad64c840e64b24757283da097d9458fbcf06a08df7a614292153209b393f770cf75ba4931e7c78bde0c8f7477a37cc89d12f97
-
SSDEEP
1536:jRZcW2s58TaFsM7nHF2bcphH2n6qEJr/lM2Xn9P+Q1D+x:jRl2sfuM7nHFdH2n63rllix
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e91b8208d68d97952e0febf3fbd6769814414b22ce3973be22942aae89954bf8
Files
-
e91b8208d68d97952e0febf3fbd6769814414b22ce3973be22942aae89954bf8.exe windows:4 windows x86 arch:x86
8e5e2eb068d303a72252fb9c94095513
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
kernel32
LocalFree
LockResource
SizeofResource
LoadResource
FindResourceW
lstrcmpiW
GetCommandLineW
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
CloseHandle
SetFilePointer
CreateFileW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
LoadLibraryExW
ExpandEnvironmentStringsW
lstrlenW
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
MoveFileExW
EnumResourceNamesW
GetTempPathW
FindFirstFileExW
SetProcessWorkingSetSize
GetCurrentProcess
ExitProcess
GetModuleHandleW
shell32
CommandLineToArgvW
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 921KB - Virtual size: 921KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ