Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Installer.exe
Size

259KB
MD5

f09cb5f5e4a80e8dca53af835c15e85b
SHA1

699f4a9459f1aeb977df2b4c538fabb7b78521c3
SHA256

51c218ade7a5605c2b5862c9d66ab9a7b9d6a40e4f7ccd9865c1849dae988b4b
SHA512

6cb503b9652caca7914d0ccd07d7e4448f61bc19d0824853c9ce1cce631e13a4ab6aca1e13f2f83eae52ae2faefb6019fd5c3b4cdb3e4bbb5659e5c763990999
SSDEEP

3072:ffdmDLTkRNhW29OHkzBZvpBfAJ+YR78WJHcEqMZLQVoVJWJ51cDhnX:ffdUvgWcBZkP8IHTqMFVv01cDZ

Score

1^/10

Malware Config

Signatures

Files

Installer.exe
.exe windows:4 windows x86 arch:x86

8ef9b08797c1f0eda8fc6ab090e6e7aa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:43:56:18:56:76:6d:52:66:5c:39:b4:fe:1c:5e:a6
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

01/03/2016, 00:00

Not After

01/03/2019, 23:59

Subject

SERIALNUMBER=80303961,CN=Howyar Technologies Inc.,O=Howyar Technologies Inc.,L=Taipei City,ST=Taiwan,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:43:56:18:56:76:6d:52:66:5c:39:b4:fe:1c:5e:a6
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

01/03/2016, 00:00

Not After

01/03/2019, 23:59

Subject

SERIALNUMBER=80303961,CN=Howyar Technologies Inc.,O=Howyar Technologies Inc.,L=Taipei City,ST=Taiwan,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4b:2b:50:56:a1:4f:1d:b6:19:74:7e:f4:80:03:30:ef:66:3a:10:d0:5a:f0:48:46:cc:dd:4c:12:50:21:b6:04
Signer

Actual PE Digest

4b:2b:50:56:a1:4f:1d:b6:19:74:7e:f4:80:03:30:ef:66:3a:10:d0:5a:f0:48:46:cc:dd:4c:12:50:21:b6:04

Digest Algorithm

sha256

PE Digest Matches

true

a5:e5:3f:2a:3c:24:e6:dd:92:28:92:df:2a:a9:e7:fa:6e:5a:28:15
Signer

Actual PE Digest

a5:e5:3f:2a:3c:24:e6:dd:92:28:92:df:2a:a9:e7:fa:6e:5a:28:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4622
ord4424
ord3738
ord815
ord561
ord4160
ord2514
ord2621
ord617
ord5214
ord296
ord1134
ord641
ord656
ord6662
ord2784
ord1980
ord1223
ord1206
ord2725
ord2448
ord5834
ord5450
ord6394
ord2044
ord5265
ord4376
ord4853
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord2302
ord4234
ord818
ord2463
ord2642
ord1651
ord4080
ord3093
ord4710
ord755
ord470
ord3874
ord4224
ord6199
ord3499
ord2515
ord355
ord3092
ord3177
ord3873
ord2379
ord6055
ord1776
ord5290
ord3402
ord3610
ord1146
ord2820
ord6467
ord795
ord765
ord686
ord6197
ord6380
ord1768
ord2096
ord384
ord6334
ord6215
ord2864
ord3571
ord3626
ord2414
ord1641
ord2086
ord3721
ord3698
ord1176
ord1243
ord1578
ord600
ord826
ord269
ord1576
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord356
ord2770
ord2781
ord3181
ord4058
ord668
ord1168
ord4277
ord4202
ord6877
ord926
ord924
ord3663
ord3613
ord3126
ord350
ord3616
ord3127
ord5651
ord354
ord5186
ord665
ord6385
ord2803
ord1979
ord4204
ord3810
ord3054
ord3425
ord3880
ord5683
ord2915
ord5572
ord6874
ord2764
ord6663
ord922
ord5861
ord2614
ord6927
ord6929
ord4171
ord6311
ord6781
ord5608
ord5710
ord941
ord536
ord939
ord2818
ord2763
ord4129
ord858
ord6282
ord6283
ord6143
ord535
ord6883
ord537
ord540
ord541
ord860
ord800
ord801
ord823
ord567
ord825

msvcrt

atof
strtol
sscanf
_access
sprintf
strlen
_errno
atol
_mbscmp
_mbsicmp
malloc
memset
__setusermatherr
_initterm
__getmainargs
memcpy
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
_ftol
time
strrchr
_vsnprintf
fopen
fwrite
fclose
exit
memcmp
free
__CxxFrameHandler
_strcmpi
_purecall
_mbsrchr
strcpy
_ltoa
_setmbcp
_adjust_fdiv
__p__commode
__p__fmode
strcat
__set_app_type
??1type_info@@UAE@XZ
_acmdln
_controlfp

kernel32

CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpA
GetVersionExA
GetModuleHandleA
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
CopyFileA
lstrlenW
GetTickCount
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FreeLibrary
CreateDirectoryA
GetPrivateProfileSectionA
LoadLibraryA
OpenFile
RemoveDirectoryA
OutputDebugStringA
WinExec
CreateProcessA
GetCommandLineA
MoveFileA
DeleteFileA
GetLastError
lstrcpyA
lstrcpynA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcatA
lstrcmpiA
DeviceIoControl
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateFileA
lstrlenA
WaitForSingleObject
TerminateProcess
CloseHandle
OpenProcess
UnmapViewOfFile
FlushViewOfFile
CompareFileTime
LocalFree
LocalAlloc
GetStartupInfoA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
ExpandEnvironmentStringsA
GetTempPathA
GetShortPathNameA
SetFileTime
GetTempFileNameA
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
GetFileTime
MapViewOfFile
Sleep
GetFileSize
CreateFileMappingA

user32

EnumWindows
PostMessageA
GetWindowLongA
GetWindowThreadProcessId
SendMessageTimeoutA
UpdateWindow
LoadBitmapA
IsWindow
LoadIconA
SetRect
GetFocus
CharNextA
wsprintfA
EnableWindow
GetClientRect
IsIconic
SendMessageA
DrawIcon
GetSystemMetrics
GetDesktopWindow
ExitWindowsEx
LoadStringA

advapi32

QueryServiceStatus
CreateServiceA
RegEnumKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownA
OpenServiceA
ControlService
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ImageList_AddMasked
ImageList_GetIcon

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoRegisterClassObject
CoRevokeClassObject

oleaut32

VariantInit
VariantClear
SysAllocStringLen
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysStringLen
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses
GetModuleBaseNameA

msvcirt

?getline@istream@@QAEAAV1@PADHD@Z
??0ofstream@@QAE@PBDHH@Z
??6ostream@@QAEAAV0@PBD@Z
??_Dofstream@@QAEXXZ
?openprot@filebuf@@2HB
??0ifstream@@QAE@PBDHH@Z
?good@ios@@QBEHXZ
??_Difstream@@QAEXXZ

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ef9b08797c1f0eda8fc6ab090e6e7aa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

20:43:56:18:56:76:6d:52:66:5c:39:b4:fe:1c:5e:a6Certificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

20:43:56:18:56:76:6d:52:66:5c:39:b4:fe:1c:5e:a6Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

4b:2b:50:56:a1:4f:1d:b6:19:74:7e:f4:80:03:30:ef:66:3a:10:d0:5a:f0:48:46:cc:dd:4c:12:50:21:b6:04Signer

a5:e5:3f:2a:3c:24:e6:dd:92:28:92:df:2a:a9:e7:fa:6e:5a:28:15Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp60

psapi

msvcirt

version

Sections

.text Size: 152KB - Virtual size: 149KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 20KB - Virtual size: 24KB

.rsrc Size: 44KB - Virtual size: 42KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

20:43:56:18:56:76:6d:52:66:5c:39:b4:fe:1c:5e:a6
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

20:43:56:18:56:76:6d:52:66:5c:39:b4:fe:1c:5e:a6
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

4b:2b:50:56:a1:4f:1d:b6:19:74:7e:f4:80:03:30:ef:66:3a:10:d0:5a:f0:48:46:cc:dd:4c:12:50:21:b6:04
Signer

a5:e5:3f:2a:3c:24:e6:dd:92:28:92:df:2a:a9:e7:fa:6e:5a:28:15
Signer

.text
Size: 152KB - Virtual size: 149KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 20KB - Virtual size: 24KB

.rsrc
Size: 44KB - Virtual size: 42KB