install[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

install.rar
Size

448KB
MD5

4564a9a35d9e7e7883faa2ed3361e0e4
SHA1

79a611b96bc0cdab0bea30423814b4ad7245800c
SHA256

06ce088beb65731be6268934f89d44a00d386e517ad88f8e28a8968c0a43b7e0
SHA512

efcec8c64edc5e23a7d24610c4a7e7facd3c682eb42875bc0b19e95ffc3479749d044a78f274cbdabd4252a07ef3da567aabe995abf2f5790da139203075fa51
SSDEEP

12288:F9bblaGD4p/3gInZckaElBVL+aiPH5ZfCgu1vhAbFvUnonXsGO:F9bbap/tukzfLliPHXLuYxUngFO

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cr.dll
unpack001/main.exe

Files

install.rar
.rar
cr.dll
.dll windows:4 windows x86 arch:x86

Password: 1111

3711bb8756d5f4974e0f68de8aa75adc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteConsoleW
CloseHandle
ExpandEnvironmentStringsA
GetNumaNodeNumberFromHandle
GetSystemWindowsDirectoryW
GetTapePosition
IdnToUnicode
SetFileBandwidthReservation
TransmitCommChar

msvcrt

_amsg_exit
_initterm
_iob
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf

clusapi

CloseClusterNotifyPort
ClusterRegDeleteValue
ClusterResourceOpenEnum
GetClusterFromGroup
GetClusterFromNode
GetClusterQuorumResource

comctl32

CreateStatusWindowW
DSA_Destroy
DefSubclassProc
DrawStatusTextA
FlatSB_EnableScrollBar
LBItemFromPt

eappprxy

EapHostPeerClearConnection
EapHostPeerEndSession
EapHostPeerFreeEapError
EapHostPeerFreeRuntimeMemory
EapHostPeerGetResponseAttributes
EapHostPeerGetSendPacket
EapHostPeerProcessReceivedPacket
EapHostPeerSetUIContext
EapHostPeerUninitialize

qwave

QOSAddSocketToFlow
QOSCreateHandle
QOSEnumerateFlows
QOSQueryFlow
QOSRemoveSocketFromFlow
QOSSetFlow
QOSStopTrackingClient

setupapi

CM_Get_DevNode_Registry_PropertyW
CM_Get_Resource_Conflict_Count
SetupDiDeleteDeviceInterfaceRegKey
SetupGetInfDriverStoreLocationA
SetupSetDirectoryIdA
SetupWriteTextLogInfLine

sspicli

DecryptMessage
EnumerateSecurityPackagesW
GetUserNameExA
ImpersonateSecurityContext
InitializeSecurityContextA
SaslInitializeSecurityContextA
SspiFreeAuthIdentity
VerifySignature

userenv

DeleteProfileA
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetUserProfileDirectoryW
ProcessGroupPolicyCompleted
RefreshPolicy
RsopAccessCheckByType
RsopSetPolicySettingStatus

usp10

ScriptItemize
ScriptJustify
ScriptRecordDigitSubstitution
ScriptStringAnalyse
ScriptStringFree
ScriptStringGetOrder
ScriptTextOut
ScriptXtoCP

winmm

auxGetNumDevs
auxSetVolume
joySetThreshold
midiOutGetID
mixerSetControlDetails
mmioGetInfo
mmioSetBuffer
waveInReset

wkscli

NetUseAdd
NetUseGetInfo
NetValidateName
NetWkstaGetInfo
NetWkstaSetInfo
NetWkstaUserEnum
NetWkstaUserSetInfo

Exports

Exports

sAsBCgmQrGmAgIGl

Sections

.text
Size: 793KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 586KB - Virtual size: 586KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 184B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 683.6MB - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
main.exe
.exe windows:4 windows x86 arch:x86

Password: 1111

3c786137af220bbbe2b39cb10db4323a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GlobalAlloc
GlobalFlags
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
CloseHandle
ExpandEnvironmentStringsA
GetNumaNodeNumberFromHandle
GetSystemWindowsDirectoryW
GetTapePosition
IdnToUnicode
SetFileBandwidthReservation
TransmitCommChar

msvcrt

__getmainargs
__initenv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf

clusapi

CloseClusterNotifyPort
ClusterRegDeleteValue
ClusterResourceOpenEnum
GetClusterFromGroup
GetClusterFromNode
GetClusterQuorumResource

comctl32

CreateStatusWindowW
DSA_Destroy
DefSubclassProc
DrawStatusTextA
FlatSB_EnableScrollBar
LBItemFromPt

eappprxy

EapHostPeerClearConnection
EapHostPeerEndSession
EapHostPeerFreeEapError
EapHostPeerFreeRuntimeMemory
EapHostPeerGetResponseAttributes
EapHostPeerGetSendPacket
EapHostPeerProcessReceivedPacket
EapHostPeerSetUIContext
EapHostPeerUninitialize

qwave

QOSAddSocketToFlow
QOSCreateHandle
QOSEnumerateFlows
QOSQueryFlow
QOSRemoveSocketFromFlow
QOSSetFlow
QOSStopTrackingClient

setupapi

CM_Get_DevNode_Registry_PropertyW
CM_Get_Resource_Conflict_Count
SetupDiDeleteDeviceInterfaceRegKey
SetupGetInfDriverStoreLocationA
SetupSetDirectoryIdA
SetupWriteTextLogInfLine

sspicli

DecryptMessage
EnumerateSecurityPackagesW
GetUserNameExA
ImpersonateSecurityContext
InitializeSecurityContextA
SaslInitializeSecurityContextA
SspiFreeAuthIdentity
VerifySignature

userenv

DeleteProfileA
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetUserProfileDirectoryW
ProcessGroupPolicyCompleted
RefreshPolicy
RsopAccessCheckByType
RsopSetPolicySettingStatus

usp10

ScriptItemize
ScriptJustify
ScriptRecordDigitSubstitution
ScriptStringAnalyse
ScriptStringFree
ScriptStringGetOrder
ScriptTextOut
ScriptXtoCP

winmm

auxGetNumDevs
auxSetVolume
joySetThreshold
midiOutGetID
mixerSetControlDetails
mmioGetInfo
mmioSetBuffer
waveInReset

wkscli

NetUseAdd
NetUseGetInfo
NetValidateName
NetWkstaGetInfo
NetWkstaSetInfo
NetWkstaUserEnum
NetWkstaUserSetInfo

cr

sAsBCgmQrGmAgIGl

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 188B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 683.6MB - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1111

3711bb8756d5f4974e0f68de8aa75adc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

clusapi

comctl32

eappprxy

qwave

setupapi

sspicli

userenv

usp10

winmm

wkscli

Exports

Exports

Sections

.text Size: 793KB - Virtual size: 792KB

.data Size: 586KB - Virtual size: 586KB

.rdata Size: 1KB - Virtual size: 1KB

.eh_fram Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 184B

.edata Size: 512B - Virtual size: 82B

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 683.6MB - Virtual size: 576B

Password: 1111

3c786137af220bbbe2b39cb10db4323a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

clusapi

comctl32

eappprxy

qwave

setupapi

sspicli

userenv

usp10

winmm

wkscli

cr

Sections

.text Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 48B

.rdata Size: 2KB - Virtual size: 1KB

.eh_fram Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 188B

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 683.6MB - Virtual size: 592B

.text
Size: 793KB - Virtual size: 792KB

.data
Size: 586KB - Virtual size: 586KB

.rdata
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 184B

.edata
Size: 512B - Virtual size: 82B

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 683.6MB - Virtual size: 576B

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 48B

.rdata
Size: 2KB - Virtual size: 1KB

.eh_fram
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 188B

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 683.6MB - Virtual size: 592B