Insta Killer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Insta Killer.exe
Size

663KB
MD5

db3603f6795dd0d5a746a779c49750e0
SHA1

78f9c7386b9b0bd86140bee954656c588d81362d
SHA256

a289ecec2abc7557263b0d295e6c2c5d47edcecfc769d3188740c83e336c5dc1
SHA512

1f7d6af3f18df97368c1e2eea566db7d7fcf819db051ef8c17ba6c51e779ce8f6ab2210ba7a906c19123a11c44ecc9a8714658440f8803cfc06071f157b1493c
SSDEEP

12288:NEtALiQlg4KqieKjP8OLHnvsCISuDK6tvI9Af1JjMFdaKxERGmM9B:NAAGQ7Kq5KjdySuDKqTvwuKxkGp9B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Insta Killer.exe

Files

Insta Killer.exe
.exe windows:5 windows x86 arch:x86

e23a963fccd1777d5a12be543854846a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
Sleep
HeapSetInformation
GetModuleHandleW
UnmapViewOfFile
CloseHandle
InterlockedExchange
VirtualProtect
VirtualQuery
GetCurrentThreadId
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
GetCurrentProcessId
CreateMutexA
WaitForSingleObject
ReleaseMutex
FindResourceA
TerminateProcess
LockResource
CreateToolhelp32Snapshot
Module32First
GetProcAddress
Module32Next
GetModuleHandleA
EnumResourceNamesA
GetModuleFileNameA
CreateFileA
ReadFile
VirtualAlloc
SetFilePointer
VirtualFree
GetModuleHandleExA
CreateEventA
ExitProcess
SetEvent
GetExitCodeThread
TerminateThread
CreateThread
HeapAlloc
HeapFree
GetComputerNameW
WideCharToMultiByte
LocalFree
HeapCreate
HeapDestroy
GetSystemTime
SystemTimeToFileTime
GetCommandLineW
GlobalAlloc
GetSystemInfo
GetWindowsDirectoryA
GetVolumeInformationA
DeviceIoControl
GetCurrentThread
CreateFileW
GlobalFree
LoadLibraryA
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
MapViewOfFile
CreateFileMappingA
lstrcmpA
LocalAlloc
GetModuleFileNameW
GetLastError
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
OutputDebugStringA
DecodePointer
LoadResource
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
MultiByteToWideChar
lstrlenA
lstrlenW
IsProcessorFeaturePresent
EncodePointer

advapi32

RegCloseKey
CryptExportKey
CryptGenKey
CloseEventLog
ReadEventLogA
GetNumberOfEventLogRecords
OpenEventLogA
CryptGenRandom
LookupAccountSidW
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
SetThreadToken
RevertToSelf
OpenThreadToken
RegOpenKeyExA
RegEnumValueA
CryptDestroyKey
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam

oleaut32

SystemTimeToVariantTime
SysFreeString
VariantInit
VariantClear
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysAllocString

mscoree

GetHashFromFileW
_CorExeMain

ws2_32

closesocket
send
recv
WSAStartup
socket
setsockopt
WSACleanup
freeaddrinfo
getaddrinfo
shutdown
connect

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminReleaseCatalogContext

crypt32

CertCloseStore
CertFreeCertificateContext
CertGetNameStringA
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CryptMsgClose
CryptDecodeObject

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc

shell32

CommandLineToArgvW

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

rpcrt4

UuidCreate

Sections

.text
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e23a963fccd1777d5a12be543854846a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

oleaut32

mscoree

ws2_32

wintrust

crypt32

iphlpapi

ole32

shell32

setupapi

rpcrt4

Sections

.text Size: 458KB - Virtual size: 457KB

.rdata Size: 136KB - Virtual size: 136KB

.data Size: 39KB - Virtual size: 42KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 458KB - Virtual size: 457KB

.rdata
Size: 136KB - Virtual size: 136KB

.data
Size: 39KB - Virtual size: 42KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 14KB - Virtual size: 14KB