InstallAgent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

InstallAgent.exe
Size

176KB
MD5

59ea3040abe6a482060184ff1f02c228
SHA1

0dde7c14611319c1cb1d8b4e2d46abed6e8c4371
SHA256

55b91d291f106b7dab473de1daa71180ade8fc22c3773a2a0f12998e17dc707f
SHA512

58346b866556532a7830d825bf48d5f0214eca27e0922449af5d28ee345dada84382813bcec360ec9ee8d181a09ded3f2325b29991fd66ab444a4d158ef50b2a
SSDEEP

3072:JNu2jMjWcwYpoFEOQOQ2RgGjrGofbUjgNs8En/moo1clWJFM5BjLe+ydGgug3NDM:JXQOQ2dC0wE8/1oilW05wXdGO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallAgent.exe

Files

InstallAgent.exe
.exe windows:10 windows x86 arch:x86

2ceeb7e6c995070451ba49a79402aeb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

InstallAgent.pdb

Imports

msvcrt

_wcmdln
_lock
__dllonexit
wcstoul
_onexit
_initterm
__setusermatherr
free
_ftol2
memcmp
__CxxFrameHandler3
?terminate@@YAXXZ
_controlfp
__p__fmode
_except_handler4_common
_vsnwprintf
malloc
memcpy_s
wcstombs
_errno
strtol
_set_errno
strncpy_s
strchr
sprintf_s
_wcsicmp
_purecall
memmove_s
mbstowcs
realloc
_ui64tow_s
_wtoi64
wcstok
_wtoi
_callnewh
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_unlock
memset

combase

ord154

api-ms-win-core-misc-l1-1-0

Sleep
LocalAlloc
LocalFree
FormatMessageW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventActivityIdControl
EventWrite
EventRegister
EventWriteTransfer

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

SetEvent
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateMutexW
OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
CreateMutexExW
InitOnceExecuteOnce
ReleaseSemaphore
CreateEventW
InitializeSRWLock

api-ms-win-core-heap-l1-2-0

HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
IsThreadpoolTimerSet
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameA
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegGetValueW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-file-l1-2-1

GetFileSizeEx
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
WriteFile
CreateFileW
CompareFileTime

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
FlushViewOfFile
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-security-base-l1-2-0

DuplicateToken
GetTokenInformation

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ceeb7e6c995070451ba49a79402aeb3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

combase

api-ms-win-core-misc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-registry-l1-1-1

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-security-sddl-l1-1-0

Sections

.text Size: 155KB - Virtual size: 154KB

.data Size: 2KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 216B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 155KB - Virtual size: 154KB

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB