Setup[.]X64[.]es-es_ProPlusRetail_B9GN2-DXXQC-9DHKT-GGWCR-4X6XK_TX_DB_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Setup.X64.es-es_ProPlusRetail_B9GN2-DXXQC-9DHKT-GGWCR-4X6XK_TX_DB_.exe
Size

1.5MB
MD5

0ad16db1d55c9b708eac75238725c7a5
SHA1

cb197845f9fbd8f3b237e523fc0aee546a01b242
SHA256

ccc66cf4c495d627d87f05b818af3c126df1a259205ce7841b3fc8e2e57bce00
SHA512

5c8fe9261b33e4b4f5a50d31b2334dbdd8a16335d4ccf05a3fb661383a3f52989ada26510079aeac79182c350582e358a71e6db7bb2975c608eb1d0abcde1633
SSDEEP

24576:MnGrgkMvFVOwzw3F344tBpkrQsVR+yJbw+1W:Ft26F34cKksVlbwQW

Score

1^/10

Malware Config

Signatures

Files

Setup.X64.es-es_ProPlusRetail_B9GN2-DXXQC-9DHKT-GGWCR-4X6XK_TX_DB_.exe
.exe windows:5 windows x64 arch:x64

474e4964caedad65fa4b1701bd5e611d

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:89:7b:42:15:0e:20:a5:dc:c8:26:b2:2a:3b:67:a7:e0:0d:c0:00:83:fe:38:7f:b2:80:03:89:3d:b7:5c:b7
Signer

Actual PE Digest

4a:89:7b:42:15:0e:20:a5:dc:c8:26:b2:2a:3b:67:a7:e0:0d:c0:00:83:fe:38:7f:b2:80:03:89:3d:b7:5c:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

P:\Target\x64\ship\click2run\en-us.pre\bootstrapper.pdb

Imports

advapi32

RegCloseKey
RegCreateKeyExW
CredWriteW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateProcessAsUserW
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
RegGetValueW
GetTokenInformation
OpenProcessToken
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LookupAccountNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RevertToSelf
EventWrite
EventUnregister
EventRegister

kernel32

GetLongPathNameW
LCIDToLocaleName
GetShortPathNameA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
CloseHandle
GetLocalTime
GetComputerNameW
WriteFile
GetCurrentProcessId
SetEvent
CreateEventExW
GetTickCount64
WaitForMultipleObjects
GetSystemTimeAsFileTime
RaiseException
GlobalAlloc
GlobalFree
SetLastError
CreateDirectoryW
FindClose
FindFirstFileExW
GetFileAttributesExW
SetFileAttributesW
SetFilePointerEx
GetTickCount
FormatMessageW
WideCharToMultiByte
CreateEventW
IsProcessorFeaturePresent
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForSingleObject
TerminateProcess
GetCurrentThread
GetThreadIOPendingFlag
TryEnterCriticalSection
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
SetWaitableTimerEx
CancelWaitableTimer
CreateWaitableTimerW
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
OpenProcess
MapViewOfFile
UnmapViewOfFile
CreateSemaphoreA
CreateFileMappingA
GetModuleFileNameA
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
CreateThread
GetProcessAffinityMask
ResetEvent
MulDiv
WaitForSingleObjectEx
GetSystemDirectoryW
CreateMemoryResourceNotification
FreeLibrary
LoadLibraryExW
IsSystemResumeAutomatic
GetSystemPowerStatus
ReleaseSemaphore
GetCommandLineW
GetStartupInfoW
EncodePointer
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
HeapSize
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
InitializeCriticalSection
GetVersionExW
GetUserGeoID
GetSystemDefaultLCID
ExpandEnvironmentStringsW
LocaleNameToLCID
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
CreateMutexW
FreeConsole
AttachConsole
AllocConsole
K32GetProcessImageFileNameW
LocalFree
GetShortPathNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetLocaleInfoEx
OutputDebugStringA
OpenThread
GetExitCodeThread
GetModuleHandleExW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
MoveFileExW
LocalAlloc
LoadLibraryA
GetOverlappedResult
lstrcmpW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
GetCurrentDirectoryW
K32GetModuleFileNameExW
GetTempPathW
GetStringTypeExW
DecodePointer
DeleteFileA
GetTempPathA
GetProcessHeap
SetEndOfFile
MultiByteToWideChar
RaiseFailFastException
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
QueryFullProcessImageNameW
VerSetConditionMask
GetDiskFreeSpaceExW
GetNativeSystemInfo
VerifyVersionInfoW
ProcessIdToSessionId
GetTempFileNameW
ReadFile
CopyFileW
GetFullPathNameW
GetExitCodeProcess
CreateProcessW
GetPriorityClass
K32EnumProcesses

ole32

CoRevokeInitializeSpy
CoRegisterInitializeSpy
CreateStreamOnHGlobal
CoCreateInstance
CoCreateGuid
CoTaskMemFree
StringFromGUID2
CoInitializeEx
CoUninitialize
StringFromIID

ws2_32

GetAddrInfoW
WSAStartup
FreeAddrInfoW

gdi32

CreateFontW
CreateSolidBrush
DeleteObject
GetDeviceCaps
GetStockObject
Rectangle
SelectObject
SetDCPenColor
GetTextMetricsW
GetTextExtentPoint32W
SetBkColor
CreatePen
SetDCBrushColor
SetTextColor

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipLoadImageFromStream
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipAlloc
GdipFillRectangleI
GdipDrawImageRectI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdiplusStartup
GdipFree

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoW
RpcBindingFree
RpcMgmtIsServerListening

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

setupapi

SetupIterateCabinetW

Sections

.text
Size: 875KB - Virtual size: 875KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 1024B - Virtual size: 869B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 112KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

474e4964caedad65fa4b1701bd5e611d

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

4a:89:7b:42:15:0e:20:a5:dc:c8:26:b2:2a:3b:67:a7:e0:0d:c0:00:83:fe:38:7f:b2:80:03:89:3d:b7:5c:b7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ole32

ws2_32

gdi32

gdiplus

rpcrt4

oleaut32

setupapi

Sections

.text Size: 875KB - Virtual size: 875KB

.rdata Size: 416KB - Virtual size: 416KB

.data Size: 40KB - Virtual size: 52KB

.pdata Size: 57KB - Virtual size: 57KB

text Size: 1024B - Virtual size: 869B

data Size: 3KB - Virtual size: 2KB

.rsrc Size: 112KB - Virtual size: 116KB

.reloc Size: 8KB - Virtual size: 8KB

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

4a:89:7b:42:15:0e:20:a5:dc:c8:26:b2:2a:3b:67:a7:e0:0d:c0:00:83:fe:38:7f:b2:80:03:89:3d:b7:5c:b7
Signer

.text
Size: 875KB - Virtual size: 875KB

.rdata
Size: 416KB - Virtual size: 416KB

.data
Size: 40KB - Virtual size: 52KB

.pdata
Size: 57KB - Virtual size: 57KB

text
Size: 1024B - Virtual size: 869B

data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 112KB - Virtual size: 116KB

.reloc
Size: 8KB - Virtual size: 8KB