de564afef3296dcd015d6752f3f0f26da2c69431531ed4b7512ce27172324d1eN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de564afef3296dcd015d6752f3f0f26da2c69431531ed4b7512ce27172324d1eN
Size

8.6MB
MD5

0ff79c7267563d86c3d18cf3d75ed100
SHA1

88d2641a6c14cbbe855eb07ce18315e8874c5bf6
SHA256

de564afef3296dcd015d6752f3f0f26da2c69431531ed4b7512ce27172324d1e
SHA512

b5052bc6bbdf0f053cd6e679b8487ec7c39bb728b713715d164710023edb12c0b58f40271fe140f7a1d2080a381e2c543193a52bb7987c24b1a703f8242439c7
SSDEEP

3072:CRl2sRPH1+ao4MpVuAt0r03fwNEFpc5n3pag5:WIa1+2uzt0r0PdFpc5nT5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de564afef3296dcd015d6752f3f0f26da2c69431531ed4b7512ce27172324d1eN

Files

de564afef3296dcd015d6752f3f0f26da2c69431531ed4b7512ce27172324d1eN
.exe windows:4 windows x86 arch:x86

8e5e2eb068d303a72252fb9c94095513

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mini_installer_patch_3stage.pdb

Imports

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

LocalFree
LockResource
SizeofResource
LoadResource
FindResourceW
lstrcmpiW
GetCommandLineW
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
CloseHandle
SetFilePointer
CreateFileW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
LoadLibraryExW
ExpandEnvironmentStringsW
lstrlenW
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
MoveFileExW
EnumResourceNamesW
GetTempPathW
FindFirstFileExW
SetProcessWorkingSetSize
GetCurrentProcess
ExitProcess
GetModuleHandleW

shell32

CommandLineToArgvW

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ