6505e52820be8e71deaf087b379fdaf9d9af5940da1e917a66180f20b0d81a90N

Sharing

Copy URL Twitter E-mail

General

Target

6505e52820be8e71deaf087b379fdaf9d9af5940da1e917a66180f20b0d81a90N
Size

445KB
MD5

1fd4c187ea404864b9916c93fc06b780
SHA1

ebd6c0d2b710db30deed77d3618537ad54765e1f
SHA256

6505e52820be8e71deaf087b379fdaf9d9af5940da1e917a66180f20b0d81a90
SHA512

2fbbd5c9aed9b73bfe868c2b12c40ae601f8c5e40307b6e9220a52436205e1b09944c05fbb1ad32d4f03d92a360778f5716c1c3574080abfd82505404f1a40b8
SSDEEP

6144:HYsm62bL/d5F6MXUiQdfTAnNXqOUFCzXNpQsJM7ebDf+OtgPAM50HWEu6W:QWfTAngOgIXNquMmD2OteAC0H1m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6505e52820be8e71deaf087b379fdaf9d9af5940da1e917a66180f20b0d81a90N

Files

6505e52820be8e71deaf087b379fdaf9d9af5940da1e917a66180f20b0d81a90N
.exe windows:6 windows x86 arch:x86

8ca7d9df6dc5ce2fead64f0b7ac90133

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

spinstall.pdb

Imports

advapi32

GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
MakeSelfRelativeSD
GetSecurityDescriptorLength
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegLoadKeyW
RegOpenKeyExW
ConvertSidToStringSidW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
LookupAccountNameW
AddAce
InitializeAcl
SetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
RegFlushKey
InitiateShutdownW
GetLengthSid
IsValidSid
CopySid
GetAclInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetTokenInformation
RegEnumKeyExW
QueryServiceConfigW
OpenServiceW
CloseServiceHandle
EnumServicesStatusW
OpenSCManagerW
EventRegister
EventUnregister
EventWrite

kernel32

WaitForSingleObject
CreateProcessW
ReleaseMutex
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
GetFileAttributesW
GetWindowsDirectoryW
GetUILanguageInfo
EnumUILanguagesW
GetProductInfo
GetVersionExW
DeviceIoControl
LocalFree
LocalAlloc
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
SetLastError
Sleep
GetExitCodeProcess
MultiByteToWideChar
CreateEventW
SetEvent
InterlockedDecrement
GetSystemPowerStatus
GetFileMUIPath
CreateDirectoryW
CreateThread
SystemTimeToFileTime
GetSystemTime
GetFileSizeEx
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
GetSystemWindowsDirectoryW
GetFullPathNameW
FormatMessageW
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrlenW
WideCharToMultiByte
GlobalFree
ReadFile
GetFileSize
WriteFile
SetEndOfFile
SetFilePointer
OutputDebugStringA
GetEnvironmentVariableW
SearchPathW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
CreateFileW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateMutexW
CloseHandle
GetLastError
HeapSize
InterlockedExchange
InterlockedCompareExchange
HeapDestroy
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
DeleteFileW
CompareFileTime
SetFileTime
MoveFileExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedIncrement
GetFileAttributesExW

user32

UnregisterClassA
MessageBoxW

msvcrt

vsprintf_s
_vscprintf
iswdigit
_wtoi
memcpy
wcstoul
_vsnwprintf
__wgetmainargs
_cexit
wcsncmp
wcsstr
_wcsnicmp
isdigit
_wtol
_purecall
wcschr
_wcslwr_s
towupper
wcsrchr
calloc
_resetstkoflw
_ftol2
wcscspn
memset
memmove_s
malloc
free
vswprintf_s
_exit
_XcptFilter
_vscwprintf
_wcsicmp
_CxxThrowException
memcpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
??_U@YAPAXI@Z
exit
_vsnprintf
_controlfp
?terminate@@YAXXZ
??3@YAXPAX@Z
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
??2@YAPAXI@Z

shell32

SHFileOperationW
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoCreateInstance
CoSetProxyBlanket
CoGetMalloc
CoInitializeEx
CoInitializeSecurity
CoUninitialize
StringFromGUID2

oleaut32

VariantInit
SysFreeString
SysAllocStringLen
VariantChangeType
VariantClear

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ntdll

RtlInitializeBitMap
RtlNumberOfClearBits
RtlAreBitsClear
RtlAreBitsSet
RtlSetBits

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

shlwapi

PathCombineW
PathRemoveFileSpecW
PathIsURLW
SHCreateStreamOnFileW
PathFileExistsW
PathFindFileNameW

xmllite

CreateXmlReader

crypt32

CertCreateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore

userenv

UnloadUserProfile

sqmapi

SqmCreateNewId
SqmSetMachineId
SqmSet
SqmIsWindowsOptedIn
SqmStartUpload
SqmWaitForUploadComplete
SqmEndSession
SqmReadSharedMachineId
SqmSetBits
SqmSetString
SqmSetAppId
SqmSetEnabled
SqmGetSession
SqmAddToStreamV
SqmWriteSharedMachineId

winbrand

BrandingFormatString

wer

WerReportSetUIOption
WerReportSetParameter
WerpSetCallBack
WerReportCreate
WerReportCloseHandle
WerReportSubmit

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash

Sections

.text
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8ca7d9df6dc5ce2fead64f0b7ac90133

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

oleaut32

version

ntdll

wtsapi32

shlwapi

xmllite

crypt32

userenv

sqmapi

winbrand

wer

wintrust

Sections

.text Size: 410KB - Virtual size: 410KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 57KB - Virtual size: 58KB

.text
Size: 410KB - Virtual size: 410KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 57KB - Virtual size: 58KB