installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

installer.exe
Size

1.6MB
MD5

717185ab370c3dd143db0ce06369bdc9
SHA1

4d3def9c099b4a2df128d354ed36a017568fc21d
SHA256

9fa736a1ef90623337208246328f440a8858b48de1106226a60f8f19025ce29f
SHA512

55a64ed1adf468d542f1125cc2cd9ebd0c9082b47c3872c00185037bab08279657b0eb23488fbd2168fe78403e9aa1e6ac452fc2877066476ca4d8b77f5cf3ef
SSDEEP

24576:y2+UiiOTs92UkQ7hCUYbeG0YuuSHwgU5WvJ4+bgJ6ftxRryEUM/:6UuGuQlCHaGHH7WvJ4+bgJ6ftxRrtUM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
installer.exe

Files

installer.exe
.exe windows:6 windows x64 arch:x64

62a9ba346143950d18076cfe1ca3a4ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\hecker\Desktop\Bloxshade-main\bloxshade\build\installer.pdb

Imports

advapi32

GetUserNameW
RegGetValueW
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptEncrypt

kernel32

GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetProcessHeap
HeapQueryInformation
HeapReAlloc
HeapFree
FlushFileBuffers
WriteConsoleW
OutputDebugStringW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableW
CompareStringW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
CreateThread
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetSystemInfo
HeapValidate
HeapSize
HeapAlloc
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
ExitProcess
SetEndOfFile
MultiByteToWideChar
WinExec
WideCharToMultiByte
LocalFree
GetTempPathW
GetShortPathNameW
GetCommandLineW
FreeEnvironmentStringsW
WriteFile
GetLastError
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
VerifyVersionInfoA
Sleep
QueryPerformanceCounter
GetTickCount
CloseHandle
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
SetFileTime
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CopyFileW
MoveFileExW
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
RtlUnwind

user32

MessageBoxW

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW
CommandLineToArgvW

normaliz

IdnToAscii

ws2_32

htonl
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
recv
socket
WSAGetLastError
send
closesocket
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
ntohl
accept

wldap32

ord22
ord41
ord50
ord45
ord26
ord211
ord46
ord217
ord143
ord30
ord32
ord27
ord33
ord79
ord35
ord200
ord301
ord60

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62a9ba346143950d18076cfe1ca3a4ee

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

comdlg32

shell32

normaliz

ws2_32

wldap32

crypt32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 279KB - Virtual size: 279KB

.data Size: 9KB - Virtual size: 19KB

.pdata Size: 54KB - Virtual size: 54KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 279KB - Virtual size: 279KB

.data
Size: 9KB - Virtual size: 19KB

.pdata
Size: 54KB - Virtual size: 54KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 5KB - Virtual size: 5KB