Oxygen Installer - SmartFix Service v5[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Oxygen Installer - SmartFix Service v5.2.exe
Size 509KB
Sample260623-3qkeeag151
SHA256 b9189cf732a376e2d9cd3304d385cbd3836cfac83efb729045d5608e6f21b7ba
MD5 0b9e6e312c2e4bee3f40328c6e594c41
SHA1 1b206f045b347b877de138b4a6d55fdadc1fae8c
SHA512 eb16dcfd9d5d18c4219839f0b53628f9a6360453ebbeebc374b91117d42183369b898071a98b8c55c9fd15b092ebcb5cb9c7c81c6fe09e2c978e854e179d977c
SSDEEP 6144:rHaVDOg4rkvz1LwychVV5WlJIgLU00OZzb0yJB1QO7HiWsOhV+VRmXMAuP46E+Z/:rHaPcychVrwJOKBBCWsmnXBwnZ
TLSH
T138B4AE17B3B705FCC52BD07C43D697729931B4251716FA1B21A4EB322C93A106FBAA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Oxygen Installer - SmartFix Service v5.2.exe

File Explorer

Oxygen Installer - SmartFix Service v5.2.exe

.exe 509KB

Oxygen Installer - SmartFix Service v5.2.exe

IMPHASH 37b41e35a41679d26aecfd1a53703c37
SHA256 b9189cf732a376e2d9cd3304d385cbd3836cfac83efb729045d5608e6f21b7ba
MD5 0b9e6e312c2e4bee3f40328c6e594c41
SHA1 1b206f045b347b877de138b4a6d55fdadc1fae8c
SHA512 eb16dcfd9d5d18c4219839f0b53628f9a6360453ebbeebc374b91117d42183369b898071a98b8c55c9fd15b092ebcb5cb9c7c81c6fe09e2c978e854e179d977c
SSDEEP 6144:rHaVDOg4rkvz1LwychVV5WlJIgLU00OZzb0yJB1QO7HiWsOhV+VRmXMAuP46E+Z/:rHaPcychVrwJOKBBCWsmnXBwnZ
TLSH
T138B4AE17B3B705FCC52BD07C43D697729931B4251716FA1B21A4EB322C93A106FBAA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext FreeSid RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

AddVectoredExceptionHandler CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateEventA CreateFileW CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoW GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount64 InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenMutexW OpenProcess OutputDebugStringA Process32FirstW Process32NextW RaiseException ReadFile ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesW SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _onexit _read _setjmp _snprintf_s _strdup _stricmp _ultoa _vsnprintf_s _wcmdln _wcsicmp _wtoi abort calloc exit fprintf fputc fputs fputwc free fwprintf fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc signal strchr strcmp strerror strlen strncmp strncpy_s strtoul vfprintf wcscmp wcscpy_s wcslen wcsrchr

ole32

CoInitializeEx CoUninitialize

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

urlmon

URLDownloadToFileW

user32

MessageBoxW

Name

.text

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.!qY

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.?&A

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Oxygen Installer - SmartFix Service v5.2.exe

advapi32

kernel32

msvcrt

ole32

shell32

urlmon

user32

generic