520f441ac62a7b62b9e66b9fcd1859a0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

520f441ac62a7b62b9e66b9fcd1859a0N.exe
Size

229KB
MD5

520f441ac62a7b62b9e66b9fcd1859a0
SHA1

f1dd6f1aebbe078902237e9240a46830ec12fea4
SHA256

b59f4c87214de34b71b6ef70c312914b85caf9dd7f81947ea050fe08626feb7c
SHA512

e9ad4d876da11779a0b82c2146b314d6b96e5a06cc3c73e4be9f2de57682eb7bb80dece1367f10ef28fb9e6e04a1fc35318799a9959e234525050747cef2f7b1
SSDEEP

3072:BoEFNZeg7aYAXwFlysBG5VGrAoEFNZeg7aYAXwFlysBG5VGrN:BbPeoaY5naGrAbPeoaY5naGrN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
520f441ac62a7b62b9e66b9fcd1859a0N.exe

Files

520f441ac62a7b62b9e66b9fcd1859a0N.exe
.dll windows:5 windows x86 arch:x86

1d4c56821273343d67fd22dfc0348a71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Visioneer\OT4\branches\RWAR_10530\InstallerEx\OT4Actions\Release\OT4Actions.pdb

Imports

msi

ord120
ord49
ord145
ord74
ord8
ord160
ord159
ord32

urlmon

CreateURLMonikerEx

kernel32

LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
SetEvent
WaitForSingleObject
GetModuleHandleW
GetProcAddress
FreeLibrary
CreateFileW
GetFileSize
ReadFile
LoadLibraryW
HeapAlloc
HeapFree
GetLastError
SetFilePointer
SetEndOfFile
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
GetTickCount
Sleep
GetProcessHeap
CreateProcessW
GetLocaleInfoW
RemoveDirectoryW
GetExitCodeProcess
OpenEventW
LoadLibraryA
MultiByteToWideChar
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
WriteFile
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
HeapSize
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSection
GetFullPathNameW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCurrentThreadId
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
RaiseException
GetCurrentDirectoryA
GetDriveTypeA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
GetStringTypeA
GetStringTypeW

user32

GetDesktopWindow

advapi32

CloseServiceHandle
ControlService
OpenServiceW
QueryServiceStatus
StartServiceW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
OpenSCManagerW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
VariantInit

shlwapi

SHDeleteKeyW
PathFileExistsW

Exports

Exports

CleanupInstallation
CleanupRegistry
Initialize
InstallDriver
LaunchInstallationPicture
MSIStopRequest
PrepareInstallation
StartOTServices
StartOTServicesRollback
StopOTServices
StopOTServicesRollback
UninstallDriver

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d4c56821273343d67fd22dfc0348a71

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

urlmon

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 82KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 11KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 83KB - Virtual size: 82KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 11KB

.reloc
Size: 7KB - Virtual size: 7KB