bestwindowsinstall[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bestwindowsinstall.exe
Size 18KB
Sample260602-zz7draft9p
SHA256 556035bbe102d0e82c4017eb7e071078a38f4f867b4faf936caa50b3cc65cce4
MD5 a43c5cf5e5d3c8dadcae5773c94a74fe
SHA1 37e0e3bd60b7a70f2e3bd5304de4efe89272b68e
SHA512 adcf7234213e958d09204df59119b9c4406b828e0af439da2b9bc5a0e105c3d26a2b5b1f87354655e2ac99f3930f3622679e3b09ebe3b0fdee165e9e789a20ce
SSDEEP 384:Z9j2CbNey/IfeiSApKRB4sXD40qqm2H4Tqm796H3O:Z9Cyp/M7/6XD3qWHxH3O
TLSH
T1C5822A57BFAB18E5D9B5C2B489734A25EF327A520F22A28F1350002C0FB57D1797AF46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bestwindowsinstall.exe

File Explorer

bestwindowsinstall.exe

.exe 18KB

bestwindowsinstall.exe

IMPHASH fb2ab36870375e180a1e2b0646171519
SHA256 556035bbe102d0e82c4017eb7e071078a38f4f867b4faf936caa50b3cc65cce4
MD5 a43c5cf5e5d3c8dadcae5773c94a74fe
SHA1 37e0e3bd60b7a70f2e3bd5304de4efe89272b68e
SHA512 adcf7234213e958d09204df59119b9c4406b828e0af439da2b9bc5a0e105c3d26a2b5b1f87354655e2ac99f3930f3622679e3b09ebe3b0fdee165e9e789a20ce
SSDEEP 384:Z9j2CbNey/IfeiSApKRB4sXD40qqm2H4Tqm796H3O:Z9Cyp/M7/6XD3qWHxH3O
TLSH
T1C5822A57BFAB18E5D9B5C2B489734A25EF327A520F22A28F1350002C0FB57D1797AF46
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\x84z\source\repos\bestwindowsinstall\x64\Release\bestwindowsinstall.pdb

kernel32

Sleep RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlCaptureContext GetModuleHandleW

advapi32

ControlService RegCloseKey OpenServiceW ChangeServiceConfigW RegOpenKeyExW RegSetValueExW OpenSCManagerW RegCreateKeyExW CloseServiceHandle

msvcp140

?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler __std_terminate memcpy memset

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _crt_atexit _register_thread_local_exe_atexit_callback __p___argv _c_exit __p___argc _cexit _exit exit _initterm_e _initterm _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _seh_filter_exe system _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode