Install[.]exe | Triage

Sharing

General

Target

Install.exe
Size

162KB
MD5

b05e31c3b9e6af68dcea0843167f7e70
SHA1

ae1d9f4e658d61e3d9325ad10032a92436e2adf0
SHA256

3f532d32ea2d79972e43613cc0c8cbcc67ca9cd07cc76176327507d6ff6a8c98
SHA512

6b5548c326db7850c4206672564a2f7fff5aca91e18e2ca46d5c4047f10fb7507a87a1b63f11bafa3c7160168521bd4bdd0190f964779161e04d7f66fafbafd3
SSDEEP

3072:WQpsrf7jq6uO5hfTXU3fjIqTbULcMmwAHVL6+C71mv/HiSHe3XoVrlkebmU:WQpsrf7jq6f5BTXU3c0VMm35C71wAoVR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Install.exe

Files

Install.exe
.exe windows:6 windows x86 arch:x86

eb3adbfdfdb25911eaec8fef643f639b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrNCatW
StrStrIW
StrCatW
StrCpyW

kernel32

SizeofResource
GetCurrentProcess
FindResourceA
GetModuleHandleA
LockResource
GetProcAddress
IsWow64Process
ExitProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
LoadResource

advapi32

RegSetValueExW
CryptAcquireContextW
CryptGenRandom
RegOpenKeyExW
CryptReleaseContext

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ