essential-installer-3[.]0[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

essential-installer-3.0.2.exe
Size

33.8MB
MD5

cd5cbfbcdf4547f85d09ee88879e5bb0
SHA1

366c1f9a21e11f18995dc530d1097862c98a446c
SHA256

6a77071b9eeabf49886e09de3f2ec34c9423a3282499f828d4a6b45c73c795bf
SHA512

72891dea304eb0a206d1dedefa3ee317738e1c7b28092c7ee577a86f3e9575bda613d79dd4fbf3e7b9ee1264ceb52e00055395c7341862a0b037eff7e63af664
SSDEEP

786432:MTpIUPcZrKm2XQuOL9OytpJJvIkKjcOcxs:MpDPGV2gz9Oyr5B5K

Score

1^/10

Malware Config

Signatures

Files

essential-installer-3.0.2.exe
.exe windows:6 windows x64 arch:x64

42d9189db54d157795a71f0379dd5995

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:a1:08:a1:90:9d:09:e2:19:17:11:17:af:a2:9d:70
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

06/09/2023, 00:00

Not After

04/10/2024, 23:59

Subject

CN=ModCore Inc,O=ModCore Inc,L=Mount Vernon,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:fe:4e:76:89:95:00:12:fc:da:4c:9a:66:33:52:13:67:da:2d:da:d8:a6:7a:a5:09:3f:7f:46:7e:67:c9:f4
Signer

Actual PE Digest

83:fe:4e:76:89:95:00:12:fc:da:4c:9a:66:33:52:13:67:da:2d:da:d8:a6:7a:a5:09:3f:7f:46:7e:67:c9:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

installer_wrapper.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

bcryptprimitives

ProcessPrng

user32

RegisterClassExA
DefWindowProcA
CreateWindowExA
GetClipboardData
ScreenToClient
CloseTouchInputHandle
GetTouchInputInfo
GetCursorPos
GetMonitorInfoW
MapVirtualKeyExW
GetKeyboardLayout
ToUnicodeEx
GetKeyboardState
GetAsyncKeyState
SendMessageW
ShowWindow
SetWindowLongW
GetWindowLongW
AdjustWindowRectEx
GetClipCursor
ClipCursor
GetKeyState
SystemParametersInfoA
RegisterRawInputDevices
SetWindowLongPtrW
CreateWindowExW
RegisterClassExW
SetForegroundWindow
RegisterWindowMessageA
ChangeDisplaySettingsExW
SetWindowPlacement
ReleaseCapture
SetCapture
GetWindowRect
ShowCursor
IsIconic
MonitorFromRect
GetWindowPlacement
CloseClipboard
PostMessageW
TrackPopupMenu
ReleaseDC
SetMenuDefaultItem
GetMenu
MonitorFromPoint
TrackMouseEvent
MapVirtualKeyW
GetRawInputData
EnableMenuItem
ValidateRect
GetSystemMenu
ClientToScreen
PeekMessageW
SetWindowTextW
OpenClipboard
SetCursor
LoadCursorW
FlashWindowEx
IsProcessDPIAware
MonitorFromWindow
GetForegroundWindow
IsWindowVisible
GetDC
RegisterTouchWindow
GetSystemMetrics
SetWindowDisplayAffinity
DefWindowProcW
GetWindowLongPtrW
DestroyWindow
RedrawWindow
GetClientRect
InvalidateRgn
SetWindowPos
DestroyIcon
CreateIcon
SetTimer
GetMessageW
KillTimer
TranslateMessage
DispatchMessageW
EmptyClipboard
GetActiveWindow
SendInput
SetClipboardData

kernel32

GlobalFree
MultiByteToWideChar
GlobalAlloc
SetStdHandle
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GetCommandLineW
GetCPInfo
SetLastError
GetProcAddress
LoadLibraryExW
GetOEMCP
GetACP
lstrlenW
FormatMessageW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
GetCurrentProcess
DuplicateHandle
VirtualProtect
UnmapViewOfFile
CloseHandle
GetFileType
SwitchToThread
IsValidCodePage
FindFirstFileExW
SetHandleInformation
GetCommandLineA
GetModuleHandleExW
WriteFile
GetUserPreferredUILanguages
GetStringTypeW
TlsFree
HeapReAlloc
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsAlloc
FlsGetValue
RaiseException
RtlPcToFileHeader
HeapFree
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
FlsSetValue
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
SetUnhandledExceptionFilter
CreateWaitableTimerExW
SetWaitableTimer
Sleep
UnhandledExceptionFilter
FlsFree
WaitForMultipleObjects
GetOverlappedResult
GetStdHandle
GetConsoleScreenBufferInfo
SetThreadErrorMode
GetLastError
GetCurrentThread
GetCurrentThreadId
SetThreadStackGuarantee
TlsSetValue
LoadLibraryExA
GlobalSize
CompareStringW
LCMapStringW
AddVectoredExceptionHandler
HeapSize
RemoveVectoredExceptionHandler
FlushFileBuffers
DeleteFileW
GetConsoleOutputCP
GetFileInformationByHandleEx
FreeLibrary
SetConsoleTextAttribute
GetTimeZoneInformationForYear
GetCurrentProcessId
GetSystemInfo
CreateEventA
PostQueuedCompletionStatus
GetProcessHeap
CreateIoCompletionPort
SetFileCompletionNotificationModes
HeapAlloc
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
GetModuleHandleA
GetSystemTimePreciseAsFileTime
QueryPerformanceCounter
ExitProcess
ReadFile
CancelIo
CreateEventW
TlsGetValue
GetConsoleMode
WriteFileEx
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetTempPathW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
SleepEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
ReadFileEx
CreateThread
CreateNamedPipeW
DeleteProcThreadAttributeList
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
ImpersonateAnonymousToken
RevertToSelf
RegCloseKey

shell32

DragFinish
SHGetKnownFolderPath
DragQueryFileW

ole32

RevokeDragDrop
OleInitialize
CoTaskMemFree
RegisterDragDrop
CoUninitialize
CoCreateInstance
CoInitializeEx

bcrypt

BCryptGenRandom

ws2_32

closesocket
ioctlsocket
WSAIoctl
bind
WSAGetLastError
WSAStartup
WSASocketW
shutdown
send
getsockopt
recv
WSASend
getpeername
getsockname
setsockopt
connect
getaddrinfo
freeaddrinfo
WSACleanup

gdi32

DeleteObject
BitBlt
CreateRectRgn
DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleDC
SwapBuffers
ChoosePixelFormat
DescribePixelFormat
SetPixelFormat
GetDeviceCaps
GetPixelFormat

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmAssociateContextEx
ImmGetContext

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtReadFile
NtWriteFile
NtCancelIoFileEx
NtCreateFile

d3dcompiler_47

D3DCompile

opengl32

wglMakeCurrent
wglGetCurrentContext
wglCreateContext
wglGetProcAddress
wglDeleteContext

oleaut32

GetErrorInfo
SysStringLen
SysFreeString

uxtheme

SetWindowTheme

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26.1MB - Virtual size: 26.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42d9189db54d157795a71f0379dd5995

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:a1:08:a1:90:9d:09:e2:19:17:11:17:af:a2:9d:70Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

83:fe:4e:76:89:95:00:12:fc:da:4c:9a:66:33:52:13:67:da:2d:da:d8:a6:7a:a5:09:3f:7f:46:7e:67:c9:f4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

kernel32

advapi32

shell32

ole32

bcrypt

ws2_32

gdi32

dwmapi

imm32

ntdll

d3dcompiler_47

opengl32

oleaut32

uxtheme

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 26.1MB - Virtual size: 26.1MB

.data Size: 7KB - Virtual size: 12KB

.pdata Size: 348KB - Virtual size: 347KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 52KB - Virtual size: 51KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:a1:08:a1:90:9d:09:e2:19:17:11:17:af:a2:9d:70
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

83:fe:4e:76:89:95:00:12:fc:da:4c:9a:66:33:52:13:67:da:2d:da:d8:a6:7a:a5:09:3f:7f:46:7e:67:c9:f4
Signer

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 26.1MB - Virtual size: 26.1MB

.data
Size: 7KB - Virtual size: 12KB

.pdata
Size: 348KB - Virtual size: 347KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 52KB - Virtual size: 51KB