Tftpd64-4[.]64-setup[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Tftpd64-4.64-setup.exe
Size

633KB
MD5

044cc568b52ce2e65eb82d3d3b7ffa2f
SHA1

e53df45b9994f7d02b48b0e002d5e06f00535bc6
SHA256

525a2eb43f2a4c702213723541335dc0391b42a01177e1faf5873e0cb7540ce0
SHA512

1ee71ba4ba71faf0f1bc4fc4b3f5292ffef6cfa19d08b169534260daaf2bf99960db364382039f45fb17e44295d9c2473a747779a21cb35375666c08af3ed4be
SSDEEP

12288:slKyxovP4Jw+ULNC0IVfG5IAeKPOFwTM84qpcy+qtv2tSoTqLQby4q:sMyavP4Jhg7IWWFA4qphN28o+LQe4q

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

Processes:

resource
Tftpd64-4.64-setup.exe
unpack001/tftpd64.exe
unpack001/uninstall.exe

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

Files

Tftpd64-4.64-setup.exe
.exe windows:4 windows x86 arch:x86

b76363e9cb88bf9390860da8e50999d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
CompareFileTime
SearchPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
Sleep
lstrcmpiA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
lstrlenA
GetCommandLineA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
MultiByteToWideChar
LoadLibraryExA
GetModuleHandleA
FreeLibrary

user32

SetCursor
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
EndDialog
ScreenToClient
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
GetWindowLongA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
SetTimer
PostQuitMessage
SetWindowLongA
SendMessageTimeoutA
LoadImageA
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
CreateDialogParamA
DestroyWindow
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA

advapi32

RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EUPL-EN.pdf
.pdf
tftpd32.chm
.chm
tftpd32.ini
tftpd64.exe
.exe windows:5 windows x64 arch:x64

cd339696c8e5d1a47aa69598eea5f5d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

SHBrowseForFolderA
DragQueryFileA
DragFinish
DragAcceptFiles
ShellExecuteA
SHGetPathFromIDListA
Shell_NotifyIconA

ws2_32

listen
accept
select
getsockname
ntohs
WSACloseEvent
WSACreateEvent
WSAEventSelect
gethostbyname
bind
WSAIoctl
ntohl
inet_ntoa
getservbyname
gethostname
htonl
setsockopt
WSACleanup
WSAStartup
getaddrinfo
socket
connect
recvfrom
recv
freeaddrinfo
sendto
WSAGetLastError
closesocket
WSAAsyncSelect
getpeername
getnameinfo
inet_addr
send
htons
WSASetLastError

comctl32

InitCommonControlsEx

iphlpapi

GetIpNetTable
SendARP
GetAdaptersAddresses
DeleteIpNetEntry

kernel32

MultiByteToWideChar
GetFullPathNameW
GetCurrentDirectoryW
HeapReAlloc
OutputDebugStringW
SetStdHandle
LCMapStringW
CompareStringW
GetCommandLineA
GetCommandLineW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetModuleFileNameA
lstrlenA
lstrcatA
lstrcpyA
lstrcmpiA
lstrcpynA
OutputDebugStringA
GetEnvironmentVariableA
lstrcmpA
SetLastError
GetCurrentProcess
CreateMutexA
ReleaseMutex
Sleep
GetLastError
CloseHandle
SetProcessWorkingSetSize
GetFullPathNameA
GetVersion
GetLocalTime
CreateProcessA
ReadFile
ReleaseSemaphore
WriteFile
WaitForSingleObject
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFileAttributesA
CreateFileA
DeleteFileA
GetFileSize
CreateSemaphoreA
SetEnvironmentVariableA
SetThreadPriority
SetFilePointer
GetCurrentThread
WideCharToMultiByte
FlushFileBuffers
GetCurrentThreadId
GetTickCount
ResetEvent
GetSystemTime
WaitForMultipleObjects
SetEvent
CreateEventA
CreateThread
SetFilePointerEx
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
FileTimeToSystemTime
GetDateFormatA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCPInfo
HeapFree
HeapAlloc
GetTimeZoneInformation
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
FreeLibraryAndExitThread
ResumeThread
ExitThread
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
RaiseException
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
GetEnvironmentStringsW
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
GetConsoleCP
GetConsoleMode
GetFileSizeEx
HeapSize
ReadConsoleW
SetEndOfFile
GetThreadPriority

user32

GetFocus
GetWindowLongA
SetWindowLongA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
DialogBoxParamA
GetClassInfoA
RegisterClassA
GetDesktopWindow
GetClassLongPtrA
DrawIcon
SetFocus
DialogBoxIndirectParamA
CreateWindowExA
SystemParametersInfoA
MessageBeep
wvsprintfA
RedrawWindow
MoveWindow
MapDialogRect
InvalidateRect
GetWindow
GetSystemMetrics
SetDlgItemTextA
SetWindowTextA
IsWindow
SetTimer
DestroyIcon
CallWindowProcA
GetWindowTextA
SetClassLongPtrA
MessageBoxA
GetSysColor
DefWindowProcA
SendDlgItemMessageA
LoadIconA
CheckMenuItem
UnregisterClassA
SetWindowLongPtrA
FindWindowA
SetForegroundWindow
ChildWindowFromPoint
EnableWindow
GetDC
ReleaseDC
GetSystemMenu
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
ShowWindow
GetTopWindow
GetDialogBaseUnits
CreateDialogParamA
AppendMenuA
GetClientRect
PostMessageA
GetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
LoadMenuA
TrackPopupMenu
wsprintfA
GetSubMenu
DestroyMenu
GetDlgItem
GetWindowLongPtrA
GetParent
GetCursorPos
SendMessageA
EndDialog
KillTimer

gdi32

SetBkColor
SetTextColor
LPtoDP
GetTextExtentPoint32A
GetTextMetricsA
ExtTextOutA

comdlg32

GetOpenFileNameA

advapi32

RegOpenKeyExA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegDeleteKeyA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninstall.exe
.exe windows:4 windows x86 arch:x86

b76363e9cb88bf9390860da8e50999d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
CompareFileTime
SearchPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
Sleep
lstrcmpiA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
lstrlenA
GetCommandLineA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
MultiByteToWideChar
LoadLibraryExA
GetModuleHandleA
FreeLibrary

user32

SetCursor
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
EndDialog
ScreenToClient
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
GetWindowLongA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
SetTimer
PostQuitMessage
SetWindowLongA
SendMessageTimeoutA
LoadImageA
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
CreateDialogParamA
DestroyWindow
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA

advapi32

RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b76363e9cb88bf9390860da8e50999d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 151KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 5KB - Virtual size: 4KB

cd339696c8e5d1a47aa69598eea5f5d8

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ws2_32

comctl32

iphlpapi

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 225KB - Virtual size: 225KB

.rdata Size: 71KB - Virtual size: 71KB

.data Size: 12KB - Virtual size: 104KB

.pdata Size: 9KB - Virtual size: 9KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 61KB - Virtual size: 60KB

.reloc Size: 2KB - Virtual size: 2KB

b76363e9cb88bf9390860da8e50999d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 151KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 151KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 5KB - Virtual size: 4KB

.text
Size: 225KB - Virtual size: 225KB

.rdata
Size: 71KB - Virtual size: 71KB

.data
Size: 12KB - Virtual size: 104KB

.pdata
Size: 9KB - Virtual size: 9KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 61KB - Virtual size: 60KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 151KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 5KB - Virtual size: 4KB