postinstall[.]exe | Triage™

Resubmissions

09/10/2024, 17:46

241009-wch6vszgpk9

09/10/2024, 17:34

241009-v5l8jsvarc9

Sharing

Copy URL Twitter E-mail

General

Target
postinstall.exe
Size 78KB
Sample241009-v5l8jsvarc
SHA256 d8f1a8ac9b5e70f9c45bdfaadbebf58531d1b9a3377e05d53a03f34c15503170
MD5 6a51174161805d1ab3b2266491977262
SHA1 7bfa58d9d08860d10b785aa29c15b771acea97f2
SHA512 2a46dc3253116f6c29e0d1fac396cdad7c9830b5aaa8e03b4fc818731b8a4b477f7a9da7a69d001c8ae86af45cc3cca8c5566fca32b8ece6544afabd839d650d
SSDEEP 768:dFrUDyws7COidwuGPthR2IJwCfWnq3+fZAMZSme4QJJ9WMrbtTq58VO/8Nf+4PfT:dxUD5s7C9dqthlD9uOm48i6W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
postinstall.exe

File Explorer

postinstall.exe

.exe 78KB

postinstall.exe

IMPHASH 183b4d24b54db7ed7e2371f93e4ed3a8
SHA256 d8f1a8ac9b5e70f9c45bdfaadbebf58531d1b9a3377e05d53a03f34c15503170
MD5 6a51174161805d1ab3b2266491977262
SHA1 7bfa58d9d08860d10b785aa29c15b771acea97f2
SHA512 2a46dc3253116f6c29e0d1fac396cdad7c9830b5aaa8e03b4fc818731b8a4b477f7a9da7a69d001c8ae86af45cc3cca8c5566fca32b8ece6544afabd839d650d
SSDEEP 768:dFrUDyws7COidwuGPthR2IJwCfWnq3+fZAMZSme4QJJ9WMrbtTq58VO/8Nf+4PfT:dxUD5s7C9dqthlD9uOm48i6W
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\010100\source\repos\postinstall\x64\Release\postinstall.pdb

kernel32

SetConsoleTitleA Sleep RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlCaptureContext GetModuleHandleW

msvcp140

?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memcpy __std_terminate __std_exception_destroy memset __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _c_exit _cexit _exit exit _initterm_e _initterm _initialize_narrow_environment _configure_narrow_argv __p___argv _set_app_type _seh_filter_exe __p___argc terminate _invalid_parameter_noinfo_noreturn system

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale