Delete[.]On[.]Reboot_Installer (3)[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Delete.On.Reboot_Installer (3).zip
Size

188KB
MD5

84541149ca1991f8ee6693edd9b68efd
SHA1

f6ec45bf0c0a22e93cb2653942ce4338c286bf13
SHA256

6d557fe3edb070ea7e73949f8bc02ec4c1937ce55021af71eb8575f71fbb5eb5
SHA512

aded4fa1a022cac2bbd6f518a9fc9fb927277a9ba92532f9c9a56663cd74a7db2fd98b9b0e545b5c3a8a9df6a9fed2657b56066f6dedf3e8e0da9c6f316d754b
SSDEEP

3072:k+sc/vdxB+di1FK1z+wKZBOYHar6DKxeh6RNW5X1RQWbbcEYdXZZkrfIlXNl/Kky:kzc/vdxB+daFKKCY6r1eh6RNWdDQWXzn

Score

1^/10

Malware Config

Signatures

Files

Delete.On.Reboot_Installer (3).zip
.zip

Password: infected
Delete.On.Reboot_Installer.exe
.exe windows:4 windows x86 arch:x86

Password: infected

71b24a2155fa5335174d7129a13d5faf

Code Sign

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

19-06-2024 03:25

Not After

28-07-2038 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:86:27:71:6a:10:c6:eb:d3:64:86:32
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

24-07-2024 05:16

Not After

27-08-2026 09:33

Subject

SERIALNUMBER=2016,CN=Nenad Hrg,O=Nenad Hrg,STREET=Edelweissstr. 104,L=Taufkirchen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c16737570706f727440736f6674776172656f6b2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130b546175666b69726368656e,1.3.6.1.4.1.311.60.2.1.2=#130642617965726e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07-11-2023 17:13

Not After

09-12-2034 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

91:e2:72:15:fa:17:5f:ee:7a:5c:e6:32:64:46:f9:e8:93:86:6e:cb:4d:d8:1f:be:95:65:d0:9e:99:f8:49:19
Signer

Actual PE Digest

91:e2:72:15:fa:17:5f:ee:7a:5c:e6:32:64:46:f9:e8:93:86:6e:cb:4d:d8:1f:be:95:65:d0:9e:99:f8:49:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
CreateDirectoryW
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
MoveFileExW
WriteFile
SetCurrentDirectoryW
GetCurrentDirectoryW
GetCurrentProcessId
UnlockFile
LockFile
GetFileInformationByHandle
DuplicateHandle
lstrcpynW
GetVersionExW
GetTimeZoneInformation
GetLocalTime
CopyFileW
DeleteFileW
GetDriveTypeW
GetLogicalDriveStringsW
GetVersion
WaitForSingleObject
QueryDosDeviceW
GetExitCodeThread
CreateRemoteThread
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
lstrcpynA
WriteProcessMemory
GetFullPathNameW
GetNumberFormatW
GetLocaleInfoW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetStartupInfoW
FindResourceW
SizeofResource
LoadResource
LockResource
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
CompareStringW
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
lstrcmpiW
lstrcmpW
GetUserDefaultLangID
CreateMutexW
GetLastError
lstrcatW
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
FlushInstructionCache
FindClose
FindNextFileW
lstrcpyW
FindFirstFileW
SetLastError
OutputDebugStringW
DebugBreak
MultiByteToWideChar
lstrlenA
InterlockedDecrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetWindowsDirectoryW
GetCurrentProcess
Sleep
OpenProcess
TerminateProcess
CreateThread
Beep
GetCurrentThreadId
LoadLibraryW
GetProcAddress
TerminateThread
InterlockedIncrement
SetFileAttributesW
CreateFileW
CloseHandle
RemoveDirectoryW
WideCharToMultiByte
GetLongPathNameW
InterlockedExchange

user32

InvalidateRect
GetDC
ReleaseDC
BeginPaint
RegisterWindowMessageW
LoadStringW
CharNextW
wvsprintfW
GetWindow
SystemParametersInfoW
MapWindowPoints
CharLowerW
SendMessageW
IsDialogMessageW
ClientToScreen
GetCursorPos
CreatePopupMenu
GetSysColorBrush
DrawEdge
MessageBoxW
GetWindowRect
ScreenToClient
GetClientRect
GetActiveWindow
DialogBoxParamW
EndDialog
RedrawWindow
PostMessageW
GetWindowLongW
SetWindowLongW
SetWindowTextW
DrawTextW
DrawFocusRect
GetSysColor
GetDlgCtrlID
IsWindowVisible
CreateWindowExW
EndPaint
SetMenuItemInfoW
SetWindowPos
LoadImageW
GetSystemMetrics
GetDlgItem
GetParent
SetTimer
GetWindowThreadProcessId
FrameRect
TrackPopupMenu
CallNextHookEx
GetSubMenu
SetWindowsHookExW
TrackPopupMenuEx
UnhookWindowsHookEx
GetMessagePos
DestroyMenu
GetMenuItemCount
LoadIconW
GetKeyboardState
keybd_event
SetForegroundWindow
SetDlgItemTextW
MessageBoxA
FindWindowExW
GetMenuItemInfoW
CheckMenuItem
InsertMenuW
ExitWindowsEx
SetMenu
SetClassLongW
EnumChildWindows
KillTimer
EnableWindow
wsprintfW
OffsetRect
IsWindowEnabled
GetFocus
FillRect
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
SetCursor
CreateDialogParamW
IsWindow
PtInRect
SetFocus
SetCapture
GetCapture
ReleaseCapture
UpdateWindow
SetRectEmpty
DestroyWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
EnumWindows
SendMessageTimeoutW
PostQuitMessage
ShowWindow
AppendMenuW
LoadCursorW
CallWindowProcW

gdi32

SetPixel
CreateSolidBrush
CreateDIBSection
CreateCompatibleDC
SetBkMode
ExtTextOutW
SetTextColor
SetBkColor
DeleteDC
GetStockObject
SelectObject
DeleteObject
GetCurrentObject
CreateFontIndirectW
GetObjectW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
RegCloseKey
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegDeleteValueW

shell32

ord18
ord17
ord16
ord155
ord190
SHFileOperationW
DragQueryFileW
DragFinish
ShellExecuteExW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW

ole32

CoUninitialize
OleInitialize
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_XcptFilter
_exit
_onexit
__dllonexit
atol
isdigit
printf
_except_handler3
wcsncpy
_wcsnicmp
swscanf
_beginthreadex
_endthreadex
_wfopen
wcscat
localtime
wcsftime
mktime
iswspace
wcscpy
_wcsicmp
sprintf
fclose
fread
fseek
ftell
rewind
getc
putc
exit
time
_ftol
malloc
wcschr
_wfullpath
wcsrchr
memmove
iswdigit
wcslen
wcsstr
??2@YAPAXI@Z
free
realloc
_wtoi
??3@YAXPAX@Z
wcscmp
_purecall

comctl32

_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_LoadImageW
ImageList_Create
InitCommonControlsEx
ImageList_Draw

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
leggimi portatile e installa.txt
liesmich portable und install.txt
readme portable and install.txt
прочти о портативной и инсталляторе.txt

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

71b24a2155fa5335174d7129a13d5faf

Code Sign

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80Certificate

Extended Key Usages

Key Usages

68:86:27:71:6a:10:c6:eb:d3:64:86:32Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

91:e2:72:15:fa:17:5f:ee:7a:5c:e6:32:64:46:f9:e8:93:86:6e:cb:4d:d8:1f:be:95:65:d0:9e:99:f8:49:19Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcrt

comctl32

Sections

.text Size: 116KB - Virtual size: 113KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 12KB - Virtual size: 96KB

.rsrc Size: 140KB - Virtual size: 137KB

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80
Certificate

68:86:27:71:6a:10:c6:eb:d3:64:86:32
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

91:e2:72:15:fa:17:5f:ee:7a:5c:e6:32:64:46:f9:e8:93:86:6e:cb:4d:d8:1f:be:95:65:d0:9e:99:f8:49:19
Signer

.text
Size: 116KB - Virtual size: 113KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 12KB - Virtual size: 96KB

.rsrc
Size: 140KB - Virtual size: 137KB