installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

installer.exe
Size

4.9MB
MD5

4b9773183088bbc6b0edf5952af4ede2
SHA1

cd3d4b8c4138a613fa2b77d873a71804f991e910
SHA256

f34f3999cf9055d80ae26f0a48f5bbdd6d0ce2edf1764b3178169ee1f6f9e005
SHA512

8d03e150a3e3a09149e4160d84e6d4ed14dc70edfbc2105cc0e9cfe1c5b90097fd98da643d2d145ded9c9755fbef54ffb84e348b18455877f0cc4d20845acb37
SSDEEP

49152:nN81ZKlQqWuSRobNivKLSO1k5m864zab9VAKcZiT5ZKt0Vax1LIU6iNFsLwmWcrE:nN8TuGLcT86GaEk4xK+NAwmRtaud6

Score

1^/10

Malware Config

Signatures

Files

installer.exe
.exe windows:6 windows x64 arch:x64

75ac675ec0ff899bb19d6f2d385603fb

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:22:4e:25:28:bd:07:a2:e7:34:f8:9f
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

25/04/2024, 07:03

Not After

26/04/2025, 07:03

Subject

CN=IP Shataev Dmitry Yurievich,O=IP Shataev Dmitry Yurievich,L=Naro-Fominsk,ST=Moscow Oblast,C=RU,1.2.840.113549.1.9.1=#0c0e61646d696e406863732e6c616e64

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:2d:ae:aa:7e:d7:ae:8d:7f:9e:1e:6e:dc:1d:12:e3:58:e8:b0:61:f1:fd:63:72:e9:96:91:ba:f1:19:c0:cd
Signer

Actual PE Digest

3b:2d:ae:aa:7e:d7:ae:8d:7f:9e:1e:6e:dc:1d:12:e3:58:e8:b0:61:f1:fd:63:72:e9:96:91:ba:f1:19:c0:cd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtReadFile
NtWriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind

user32

AdjustWindowRectEx
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CloseTouchInputHandle
CreateIcon
CreateIconFromResourceEx
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
EmptyClipboard
EnableMenuItem
EnumDisplayMonitors
FlashWindowEx
GetActiveWindow
GetAsyncKeyState
GetClassInfoExW
GetClassNameW
GetClientRect
GetClipCursor
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageW
GetMonitorInfoW
GetRawInputData
GetSystemMenu
GetSystemMetrics
GetTouchInputInfo
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InvalidateRgn
IsClipboardFormatAvailable
IsIconic
IsProcessDPIAware
KillTimer
LoadCursorW
MapVirtualKeyExW
MapVirtualKeyW
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
OpenClipboard
PeekMessageW
PostMessageW
RedrawWindow
RegisterClassExW
RegisterRawInputDevices
RegisterTouchWindow
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
ScreenToClient
SendInput
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetForegroundWindow
SetTimer
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoA
ToUnicodeEx
TrackMouseEvent
TranslateMessage
ValidateRect

kernel32

AddVectoredExceptionHandler
CloseHandle
CompareStringOrdinal
CompareStringW
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DuplicateHandle
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetQueuedCompletionStatusEx
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MoveFileExW
MultiByteToWideChar
OpenEventW
OpenMutexW
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFileEx
RemoveDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointerEx
SetHandleInformation
SetLastError
SetStdHandle
SetThreadErrorMode
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UpdateProcThreadAttribute
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteFileEx

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CertVerifyTimeValidity

gdi32

ChoosePixelFormat
CreateRectRgn
DeleteObject
DescribePixelFormat
GetDeviceCaps
SetPixelFormat
SwapBuffers

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
CoTaskMemFree
CoUninitialize
OleInitialize
RegisterDragDrop
RevokeDragDrop

shell32

DragFinish
DragQueryFileW
SHCreateItemFromParsingName
SHGetKnownFolderPath

dwmapi

DwmEnableBlurBehindWindow

oleaut32

GetErrorInfo
SysFreeString
SysStringLen

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow

winmm

PlaySoundW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

uxtheme

SetWindowTheme

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSASend
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
recv
send
setsockopt
shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

opengl32

wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent
wglShareLists

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 577B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75ac675ec0ff899bb19d6f2d385603fb

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

64:22:4e:25:28:bd:07:a2:e7:34:f8:9fCertificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

3b:2d:ae:aa:7e:d7:ae:8d:7f:9e:1e:6e:dc:1d:12:e3:58:e8:b0:61:f1:fd:63:72:e9:96:91:ba:f1:19:c0:cdSigner

Headers

DLL Characteristics

File Characteristics

Imports

bcryptprimitives

ntdll

user32

kernel32

shlwapi

bcrypt

crypt32

gdi32

ole32

shell32

dwmapi

oleaut32

imm32

winmm

advapi32

uxtheme

ws2_32

api-ms-win-core-synch-l1-2-0

opengl32

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 5KB - Virtual size: 10KB

.pdata Size: 42KB - Virtual size: 41KB

.gxfg Size: 5KB - Virtual size: 4KB

.tls Size: 1024B - Virtual size: 577B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 43KB - Virtual size: 43KB

.reloc Size: 9KB - Virtual size: 8KB

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

64:22:4e:25:28:bd:07:a2:e7:34:f8:9f
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

3b:2d:ae:aa:7e:d7:ae:8d:7f:9e:1e:6e:dc:1d:12:e3:58:e8:b0:61:f1:fd:63:72:e9:96:91:ba:f1:19:c0:cd
Signer

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 5KB - Virtual size: 10KB

.pdata
Size: 42KB - Virtual size: 41KB

.gxfg
Size: 5KB - Virtual size: 4KB

.tls
Size: 1024B - Virtual size: 577B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 43KB - Virtual size: 43KB

.reloc
Size: 9KB - Virtual size: 8KB