InstallManager_GEN_GEN[.]exe

Resubmissions

22/08/2024, 19:22

240822-x3l6watdjf 3

22/08/2024, 19:21

240822-x26h5awekk 1

Sharing

Copy URL Twitter E-mail

General

Target

InstallManager_GEN_GEN.exe
Size

457KB
MD5

b7d813b69d3621d3c7ff1bcc5b7741a7
SHA1

3f423e4c284d16cca24cd9af1e9b7decbf91104f
SHA256

c29a4c94d4db69804e7f6ce4b173c1082c9e8ecb5380d1ce78a844660e1345ae
SHA512

2ff024150d9b98efdd115cefc1e323294de1d9eca9e33ff1265c17d8c4a1ccca28e4e150a38278b581b206dc45cc2f4128266d4e98530523d754c5a61a179436
SSDEEP

6144:dNuhaLEzxVXPKAeHI5+kLmVl8N1DiriNLkpszu/B6:dbEzaAeHs+kyVGPtkp0N

Score

1^/10

Malware Config

Signatures

Files

InstallManager_GEN_GEN.exe
.exe windows:6 windows x86 arch:x86

0935162cea7eabc3c1ad01e55149d347

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

99:a0:1e:c0:53:62:1e:8d:ba:b8:5f:6d:3d:4e:35:15:37:9d:50:ad
Signer

Actual PE Digest

99:a0:1e:c0:53:62:1e:8d:ba:b8:5f:6d:3d:4e:35:15:37:9d:50:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\bt\960063\target\retail\wink\i386\InstallManager.pdb

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
DuplicateTokenEx
OpenProcessToken
RegEnumValueW
RegEnumKeyW
CryptDestroyKey
CryptReleaseContext
AllocateAndInitializeSid
EqualSid
FreeSid
ConvertStringSidToSidW
SetTokenInformation
CreateProcessAsUserW
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
CopySid
ConvertSidToStringSidW
GetTokenInformation
CryptSignHashW
CryptHashData
CryptCreateHash
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
CryptGenKey
CryptGetUserKey
CryptSetProvParam
CryptAcquireContextW
IsValidSid
InitializeSid
GetSidLengthRequired
RegFlushKey
CryptDestroyHash

kernel32

LockResource
LoadResource
FindResourceW
FindResourceExW
SetFilePointer
FlushFileBuffers
GetFileSize
GetTempFileNameW
GetTempPathW
MulDiv
GetDiskFreeSpaceW
GetExitCodeProcess
CreateProcessW
OpenProcess
FreeLibrary
LoadLibraryW
FindClose
FindNextFileW
FindFirstFileW
TerminateProcess
lstrcmpiW
CopyFileW
GetTimeZoneInformation
GetTimeFormatW
GetDateFormatW
GlobalMemoryStatusEx
FileTimeToLocalFileTime
lstrcmpA
GetVersionExW
GetSystemWow64DirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalAlloc
LocalFree
SetFileAttributesW
MoveFileExW
GetFileAttributesW
CompareStringW
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileW
InitializeCriticalSectionAndSpinCount
LCMapStringW
WriteConsoleW
SizeofResource
WriteConsoleA
SetStdHandle
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetModuleFileNameW
RaiseException
CloseHandle
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetProcAddress
GetModuleHandleW
lstrlenW
FlushInstructionCache
GetCurrentProcess
Sleep
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
SetUnhandledExceptionFilter
GetConsoleMode
GetConsoleCP
GetStartupInfoW
CreateThread
VirtualAlloc
VirtualFree
GetLocalTime
CreateFileA
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ReadFile
MultiByteToWideChar
CreateDirectoryW
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
lstrlenA
GetUserDefaultUILanguage
GetUserGeoID
GetGeoInfoW
SignalObjectAndWait
ExpandEnvironmentStringsW
GetConsoleOutputCP
RemoveDirectoryW
WideCharToMultiByte
WriteFile
DeleteFileW
ResetEvent
GetProcessHeap
HeapSetInformation
CreateMutexW
GetCommandLineW
SetLastError
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateEventW
GetCurrentThreadId
LCMapStringA

user32

LoadCursorW
DispatchMessageW
TranslateMessage
SetWindowLongW
CharUpperW
CharNextW
PostThreadMessageW
UnregisterClassA
GetMessageW
RegisterClassExW
CreateWindowExW
LoadIconW
MessageBoxW
LoadStringW
CallWindowProcW
GetWindowLongW
GetMenu
MoveWindow
SetWindowPos
GetClassInfoExW
GetClientRect
ShowWindow
FindWindowW
GetWindowThreadProcessId
GetSystemMenu
EnableMenuItem
MsgWaitForMultipleObjects
SetWindowTextW
PeekMessageW
SetFocus
CharUpperBuffW
DefWindowProcW
DestroyWindow
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
AdjustWindowRectEx

shell32

SHGetFolderPathW
ShellExecuteExW
ord165
SHCreateDirectoryExW

ole32

CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize

oleaut32

VariantChangeType
VarBstrCmp
VariantClear
VariantInit
SysStringByteLen
SysAllocStringLen
VarBstrCat
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
SysAllocStringByteLen

shlwapi

StrCmpIW
StrChrW
StrStrIW
StrRChrW
PathStripPathW
AssocQueryStringW
SHCreateStreamOnFileW
SHDeleteKeyW
PathRemoveFileSpecW
PathFileExistsW

comctl32

InitCommonControlsEx

urlmon

URLDownloadToFileW
CreateURLMonikerEx
URLOpenBlockingStreamW

msi

ord141
ord195
ord175
ord113
ord88
ord169

crypt32

CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CertGetCertificateChain
CryptMsgGetAndVerifySigner
CryptHashPublicKeyInfo
CertFreeCertificateChain
CryptMsgGetParam
CryptDecodeObject
CertVerifyCertificateChainPolicy
CryptQueryObject

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetConnectW
HttpSendRequestW
InternetCrackUrlW
DeleteUrlCacheEntryW
InternetOpenW
HttpOpenRequestW
InternetCloseHandle

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

0935162cea7eabc3c1ad01e55149d347

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

99:a0:1e:c0:53:62:1e:8d:ba:b8:5f:6d:3d:4e:35:15:37:9d:50:adSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

msi

crypt32

version

wininet

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 7KB - Virtual size: 53KB

.rsrc Size: 223KB - Virtual size: 223KB

.reloc Size: 13KB - Virtual size: 13KB

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

99:a0:1e:c0:53:62:1e:8d:ba:b8:5f:6d:3d:4e:35:15:37:9d:50:ad
Signer

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 7KB - Virtual size: 53KB

.rsrc
Size: 223KB - Virtual size: 223KB

.reloc
Size: 13KB - Virtual size: 13KB