installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

installer.exe
Size

1.2MB
MD5

40fef3d32851e6f1b3ff4d92debc05f4
SHA1

2616b34273dd4b192ab2a56437250ff21a5b67b3
SHA256

2a325c3585e216f6b923f3efdfcb580f7e8c6a7a0a0d178eef72cde3b1c35240
SHA512

70f724a1a6f4a1884d956a828b4ca98ca64d51053e784719bcfcc5a53ce6b110c07c1db4dfaffbdc5e52450d425cd49401ce00db92ff4ecb29b55f7cdd4f6c2e
SSDEEP

24576:9hBu6LtKCWslV+dmaBnW2Mij+SpJp6c45/WgVbw:Ju6LtzJ0jTtpJ4ced8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
installer.exe

Files

installer.exe
.exe windows:6 windows x64 arch:x64

7c7f908af6f7e70afd94c139cc096f22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Leonardo\source\repos\HomocideLoader\x64\Release\installer.pdb

Imports

crypt32

CertFindExtension
CertGetNameStringW
CryptQueryObject
CryptDecodeObjectEx
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
PFXImportCertStore
CryptStringToBinaryW
CertAddCertificateContextToStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertCreateCertificateChainEngine
CryptBinaryToStringA

ws2_32

send
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
getsockopt
WSAWaitForMultipleEvents
WSACloseEvent
bind
closesocket
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
WSAGetLastError
accept
select
__WSAFDIsSet
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
inet_ntop
WSASetLastError
ntohs
inet_pton
WSAResetEvent

kernel32

HeapQueryInformation
HeapSize
SetEndOfFile
DeleteFileW
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
HeapReAlloc
GetExitCodeProcess
WaitForSingleObject
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
GetTempPathW
GetVolumeInformationA
GetLastError
GetLogicalDriveStringsA
GetModuleHandleW
FindClose
GetComputerNameA
CloseHandle
CreateProcessW
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
WideCharToMultiByte
SetLastError
FormatMessageW
MoveFileExW
WaitForSingleObjectEx
GetEnvironmentVariableA
GetCurrentProcessId
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
GetModuleHandleA
VerifyVersionInfoW
CreateFileW
GetFileSizeEx
GetCurrentThread
GetThreadTimes
FlsAlloc
HeapFree
FlushFileBuffers
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
WriteConsoleW
CreateDirectoryA
WriteFile
GetModuleFileNameW
ExitProcess
RtlUnwind
GetCurrentThreadId
GetExitCodeThread
TryAcquireSRWLockExclusive
EncodePointer
DecodePointer
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetCPInfo
GetSystemTimeAsFileTime
GetStringTypeW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedPushEntrySList
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
SetFilePointerEx

advapi32

CryptAcquireContextW
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptReleaseContext
CryptCreateHash

zlib1

inflateEnd
inflateInit_
inflateInit2_
inflate
zlibVersion

iphlpapi

GetAdaptersInfo

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

Sections

.text
Size: 958KB - Virtual size: 957KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c7f908af6f7e70afd94c139cc096f22

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

kernel32

advapi32

zlib1

iphlpapi

bcrypt

Sections

.text Size: 958KB - Virtual size: 957KB

.rdata Size: 242KB - Virtual size: 242KB

.data Size: 22KB - Virtual size: 36KB

.pdata Size: 45KB - Virtual size: 45KB

.fptable Size: 512B - Virtual size: 256B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 958KB - Virtual size: 957KB

.rdata
Size: 242KB - Virtual size: 242KB

.data
Size: 22KB - Virtual size: 36KB

.pdata
Size: 45KB - Virtual size: 45KB

.fptable
Size: 512B - Virtual size: 256B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 8KB - Virtual size: 7KB