047387ef00f205fe395e5c016b252f295940c59f8ac7b9d1ac263d5877a27115

Sharing

Copy URL Twitter E-mail

General

Target

047387ef00f205fe395e5c016b252f295940c59f8ac7b9d1ac263d5877a27115
Size

112KB
MD5

c45c763357a5ca1edf694990976dd870
SHA1

6c94319796e5af9de7e5c3ab51feca3cf5cbb78c
SHA256

047387ef00f205fe395e5c016b252f295940c59f8ac7b9d1ac263d5877a27115
SHA512

381f49ae8ad3e09275a66b77da501b906173ab8c7f9c9551673607cdfd8004b9430b9bfd7451c6ad9827c59714234d2a394551341fd9febaf686f284fe91e1d0
SSDEEP

3072:YaSx6Jl3wFFtDxd6Hl+3GOWRoiLLgbc+ld:DSxulgXtqZdFiL

Score

1^/10

Malware Config

Signatures

Files

047387ef00f205fe395e5c016b252f295940c59f8ac7b9d1ac263d5877a27115
.zip
PC_inst_online_202410103y-12.exe
.exe windows:4 windows x64 arch:x64

dc33869d93edfccf45d608ebddeff743

Code Sign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:21:c0:5f:19:ed:c1:a1:d2:e5:05:66:dc:f0:24:9b:a9:c4:16:c3:36:68:07:63:04:d9:4c:d7:2c:a4:ae:99
Signer

Actual PE Digest

63:21:c0:5f:19:ed:c1:a1:d2:e5:05:66:dc:f0:24:9b:a9:c4:16:c3:36:68:07:63:04:d9:4c:d7:2c:a4:ae:99

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetWindowsDirectoryA
DeviceIoControl
CloseHandle
GetSystemInfo
GetVersionExA
GetCurrentProcess
GetModuleHandleA
Sleep
lstrlenA
LocalAlloc
LoadLibraryExA
GetProcAddress
FreeLibrary
GetLastError
FormatMessageA
LocalFree
GetFullPathNameA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
HeapAlloc
RtlUnwindEx
FlsSetValue
FlsGetValue
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetVersionExW
HeapSetInformation
HeapCreate
OutputDebugStringA
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
RaiseException
RtlPcToFileHeader
HeapReAlloc
HeapSize
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetFilePointer
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetStringTypeW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
FlushFileBuffers
SetStdHandle
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
CreateFileW
ReadConsoleInputA
SetConsoleMode

advapi32

DeleteService
ControlService
OpenServiceA
CreateServiceA
OpenSCManagerA
CloseServiceHandle
RegCreateKeyExA
RegCloseKey
StartServiceA

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
install.ini

Sharing

General

Malware Config

Signatures

Files

dc33869d93edfccf45d608ebddeff743

Code Sign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

63:21:c0:5f:19:ed:c1:a1:d2:e5:05:66:dc:f0:24:9b:a9:c4:16:c3:36:68:07:63:04:d9:4c:d7:2c:a4:ae:99Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 105KB - Virtual size: 105KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 66KB - Virtual size: 79KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

63:21:c0:5f:19:ed:c1:a1:d2:e5:05:66:dc:f0:24:9b:a9:c4:16:c3:36:68:07:63:04:d9:4c:d7:2c:a4:ae:99
Signer

.text
Size: 105KB - Virtual size: 105KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 66KB - Virtual size: 79KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB