Overhaul_Installer_Windows[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Overhaul_Installer_Windows.exe
Size

7.3MB
MD5

4b1ffcae99a055671ffab89e5f5ce1d6
SHA1

98d639ddeff5842d3afe93e44ef6c1d2f514d7c8
SHA256

b3787737a6c92e4666e0cc9f0c1ba67c15a444c558b9b765c9f8793c1fe9db43
SHA512

090f1a5b68ada6ba9869600c66dd8fbc998c3cfa463329006de70e260c4d0caef075c40ca2b5424b323c1e411893cf316e842ad69a2625397c1b68b15574f378
SSDEEP

49152:OFMdE9U6OfcgBqvibPgiEevj62MIB9hkdTSz3uve9RdNvKGI3HcDgWy3SqkqHK2E:BNK3IBUu1KlDKdOh0i3wut49tVQcZ5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Overhaul_Installer_Windows.exe

Files

Overhaul_Installer_Windows.exe
.exe windows:6 windows x64 arch:x64

686588007ec15b17c94b4175c32395b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

installer.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

CryptCreateHash
RegGetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
EventUnregister
EventWriteTransfer
EventSetInformation
OpenThreadToken
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
EventRegister

kernel32

SleepConditionVariableSRW
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WakeAllConditionVariable
GetFileInformationByHandleEx
GetLastError
CloseHandle
SwitchToThread
FindFirstFileW
FindClose
GetComputerNameExW
GetNativeSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
VerSetConditionMask
VerifyVersionInfoW
SetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
HeapReAlloc
HeapFree
GetModuleHandleW
GetCurrentThreadId
lstrlenW
GetFinalPathNameByHandleW
QueryPerformanceCounter
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
LoadLibraryA
Sleep
GetModuleHandleA
GetSystemDirectoryW
SetHandleInformation
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
FormatMessageW
GetSystemInfo
GetCurrentDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
WideCharToMultiByte
ReleaseMutex
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetTempPathW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetSystemTimePreciseAsFileTime
HeapAlloc
GetProcessHeap
DeleteFileW
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
LoadLibraryExA
GetUserDefaultUILanguage
LCIDToLocaleName
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
CreateEventA
GetSystemDirectoryA
GetEnvironmentVariableA
MoveFileExA
CreateFileA
GetFileSizeEx
ReadFile
OutputDebugStringA
OutputDebugStringW
LoadLibraryExW
TerminateProcess
IsProcessorFeaturePresent

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

user32

MapVirtualKeyW
GetUpdateRect
ValidateRect
GetRawInputData
MessageBoxW
RedrawWindow
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
PostMessageW
DestroyIcon
DestroyMenu
CheckMenuItem
CloseTouchInputHandle
SetMenuItemInfoW
AppendMenuW
CreatePopupMenu
CreateMenu
DrawMenuBar
SendMessageW
SetMenu
PostQuitMessage
DestroyAcceleratorTable
InvalidateRgn
SetWindowDisplayAffinity
SendInput
SetForegroundWindow
CreateAcceleratorTableW
SystemParametersInfoA
IsProcessDPIAware
GetClientRect
TrackMouseEvent
EnumChildWindows
DispatchMessageA
GetMessageA
MonitorFromRect
ShowCursor
GetDC
RegisterTouchWindow
IsWindow
ClipCursor
GetClipCursor
GetActiveWindow
GetWindowLongPtrW
ToUnicodeEx
GetKeyboardLayout
MapVirtualKeyExW
GetKeyboardState
ReleaseCapture
SetCapture
SetWindowLongW
RegisterClassExW
EnableMenuItem
GetSystemMenu
SetWindowPlacement
ChangeDisplaySettingsExW
SetPropW
GetWindowPlacement
CreateIcon
GetWindowRect
GetSystemMetrics
AdjustWindowRectEx
GetMenu
RegisterWindowMessageA
GetMenuBarInfo
GetTouchInputInfo
ShowWindow
RegisterClassW
MapWindowPoints
OffsetRect
RegisterRawInputDevices
GetMenuItemInfoW
CreateWindowExW
DestroyWindow
DrawIconEx
DefWindowProcW
GetKeyState
RemoveMenu
GetAsyncKeyState
SetWindowLongPtrW
ReleaseDC
SetWindowPos
GetMonitorInfoW
GetWindowLongW
ScreenToClient
SetCursor
LoadCursorW
MonitorFromWindow
GetCursorPos
SystemParametersInfoW
ClientToScreen
GetWindowDC

comctl32

RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass

ole32

CoTaskMemFree
RegisterDragDrop
OleInitialize
CoCreateInstance
CoInitializeEx
CoUninitialize
RevokeDragDrop
CoTaskMemAlloc

shell32

SHCreateItemFromParsingName
DragFinish
DragQueryFileW
SHAppBarMessage
SHGetKnownFolderPath

gdi32

SelectObject
CreateRectRgn
DeleteObject
CreateDIBSection
CreateCompatibleDC
GetDeviceCaps
DeleteDC

dwmapi

DwmEnableBlurBehindWindow

crypt32

CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateChain
CertFreeCertificateContext
CertGetCertificateChain
CertCloseStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore
CertFreeCertificateChainEngine

ws2_32

getsockname
connect
select
__WSAFDIsSet
ntohs
socket
htons
WSASetLastError
listen
recv
WSACreateEvent
WSACloseEvent
send
getsockopt
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
bind
WSAGetLastError
WSAIoctl
setsockopt
accept
ioctlsocket
htonl
WSASocketW
closesocket

uxtheme

DrawThemeBackground
DrawThemeText
CloseThemeData
OpenThemeData

ntdll

NtReadFile
NtWriteFile
NtCreateFile
RtlGetVersion
RtlNtStatusToDosError

oleaut32

SetErrorInfo
SysFreeString
GetErrorInfo
SysStringLen

shlwapi

AssocQueryStringW
SHCreateMemStream

vcruntime140

memset
__CxxFrameHandler3
memcmp
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception_context
__current_exception
strchr
__C_specific_handler
_purecall
wcsrchr
memchr
strstr
strrchr
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

roundf
trunc
round
_fdopen
floor
__setusermatherr
exp2f
fma
exp
log2
pow
ceil
truncf
powf
floorf
log2f
fmaxf
fmaf

api-ms-win-crt-string-l1-1-0

strcpy
strpbrk
strncpy
strcspn
_strdup
strlen
wcslen
strncmp
_wcsicmp
wcscmp
strcmp
strspn

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
malloc
free
realloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

_rotl64
qsort

api-ms-win-crt-runtime-l1-1-0

__sys_errlist
__sys_nerr
_beginthreadex
abort
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_wassert
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_exit
terminate
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_errno
_initterm
_initterm_e
exit

api-ms-win-crt-convert-l1-1-0

strtoll
atoi
_ultow_s
strtoul
_wtoi
wcstol
wcstombs
strtol

api-ms-win-crt-stdio-l1-1-0

ftell
__stdio_common_vswprintf
__stdio_common_vsprintf
fputc
fflush
fputs
_read
fgets
_set_fmode
_lseeki64
_write
_close
_open
_fileno
fwrite
__p__commode
feof
__acrt_iob_func
fopen
fseek
fread
_fseeki64
__stdio_common_vsscanf
fclose

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlink
_stat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

686588007ec15b17c94b4175c32395b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

version

user32

comctl32

ole32

shell32

gdi32

dwmapi

crypt32

ws2_32

uxtheme

ntdll

oleaut32

shlwapi

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 12KB - Virtual size: 23KB

.pdata Size: 115KB - Virtual size: 114KB

.rsrc Size: 144KB - Virtual size: 143KB

.reloc Size: 45KB - Virtual size: 45KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 12KB - Virtual size: 23KB

.pdata
Size: 115KB - Virtual size: 114KB

.rsrc
Size: 144KB - Virtual size: 143KB

.reloc
Size: 45KB - Virtual size: 45KB