c60584f7031377ae853ad17a17580df42011d451d801432a93a98747356f4522 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c60584f7031377ae853ad17a17580df42011d451d801432a93a98747356f4522
Size

3.0MB
MD5

42cef83b530ddfe6e9df117a1e2002f8
SHA1

5fcd00ac90ffe4464c430d2a339e40e180a7d20e
SHA256

c60584f7031377ae853ad17a17580df42011d451d801432a93a98747356f4522
SHA512

a7390ec0e6d4d1d41fb6469d03e28cc3cdb59f1b5808ea1270ea0552c768a57ad48ed3d27525be2d71eea5443b1bba9e11663ce6b974ecb63870826e3be13af1
SSDEEP

24576:VNUqpGvXu5pD+pVzu/Gdv3TscpCANuYgTRgHs8l7fdDpCyUe+oLwFP7qaCqNh7NE:IqpEw6psAP49YmU1JpCyWLH3KTsOjZh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c60584f7031377ae853ad17a17580df42011d451d801432a93a98747356f4522

Files

c60584f7031377ae853ad17a17580df42011d451d801432a93a98747356f4522
.exe windows:4 windows x86 arch:x86

97c84e275e3d60a5007b71caf69b1f34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mini_installer_patch_3stage.pdb

Imports

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

LocalFree
lstrcmpiW
LockResource
SizeofResource
LoadResource
FindResourceW
GetCommandLineW
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
CloseHandle
SetFilePointer
CreateFileW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
LoadLibraryExW
ExpandEnvironmentStringsW
lstrlenW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
MoveFileExW
GetLastError
EnumResourceNamesW
GetTempPathW
FindFirstFileExW
SetProcessWorkingSetSize
GetCurrentProcess
ExitProcess
GetModuleHandleW

shell32

CommandLineToArgvW

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ