mas-installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mas-installer.exe
Size 8.5MB
Sample260624-m73djsbx2n
SHA256 45b5c979ced0d8dedba20ece189f013c586327e7bbef8d182ae09def08b820f7
MD5 6962d32444229cdc11323587d082ba81
SHA1 7e638070bcfae7e882304cb670377d430cd10232
SHA512 577662ba8037423d0f51341f8246c4a6817b0e20014f76d8fd38a38e8e474a5c5b8c3aca6f6cb214c1dd86cc880282686f80c79f6f01f6e4372eb701ea62005a
SSDEEP 98304:TpeNHxRQYzIXyIBdb61U3075godTyjGjcYquydjE0gX450la16+FS6Zk:T4bsPBdbbSSodTySjXy1E0gXVa16
TLSH
T1BF969D167B4A99E9C09AC074C24647626A3234CA0B35BAFF71CC95793F26AF41F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mas-installer.exe

File Explorer

mas-installer.exe

.exe 8.5MB

mas-installer.exe

IMPHASH 6f0bce50244f5dbfb022ae778c3abecd
SHA256 45b5c979ced0d8dedba20ece189f013c586327e7bbef8d182ae09def08b820f7
MD5 6962d32444229cdc11323587d082ba81
SHA1 7e638070bcfae7e882304cb670377d430cd10232
SHA512 577662ba8037423d0f51341f8246c4a6817b0e20014f76d8fd38a38e8e474a5c5b8c3aca6f6cb214c1dd86cc880282686f80c79f6f01f6e4372eb701ea62005a
SSDEEP 98304:TpeNHxRQYzIXyIBdb61U3075godTyjGjcYquydjE0gX450la16+FS6Zk:T4bsPBdbbSSodTySjXy1E0gXVa16
TLSH
T1BF969D167B4A99E9C09AC074C24647626A3234CA0B35BAFF71CC95793F26AF41F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4024376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError NtCreateFile RtlCaptureContext

kernel32

GetCurrentProcessId GetModuleHandleA GetTempPathW SetFilePointerEx GetStdHandle WaitForSingleObject TerminateProcess QueryPerformanceCounter WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency GetSystemTimeAsFileTime HeapAlloc GetProcessHeap HeapFree HeapReAlloc WaitForSingleObjectEx CreateMutexA CreateFileW GetFileInformationByHandle DeviceIoControl CreateDirectoryW DeleteFileW GetEnvironmentVariableW CreateEventW GetModuleHandleW GetFullPathNameW CreateThread TlsGetValue TlsSetValue GetConsoleMode WriteConsoleW SetHandleInformation GetSystemInfo GetCurrentDirectoryA SetCurrentDirectoryA SleepConditionVariableSRW GetLocaleInfoA WaitForMultipleObjectsEx CreateEventA AcquireSRWLockShared GetCurrentDirectoryW GetCurrentProcess Sleep SwitchToThread GetProcAddress MultiByteToWideChar GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler ReleaseMutex LoadLibraryA GlobalAlloc WideCharToMultiByte FindNextFileW FindFirstFileW FindClose MulDiv GetFileAttributesW GetLogicalDrives InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId LoadLibraryW GetComputerNameA GetACP GlobalLock ExitProcess FormatMessageW LocalFree GlobalUnlock UnhandledExceptionFilter SetUnhandledExceptionFilter TryAcquireSRWLockExclusive GetLastError GetFinalPathNameByHandleW SetLastError SetFileInformationByHandle SetFileAttributesW SetEvent CloseHandle AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent InitializeSListHead SetFileCompletionNotificationModes PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateIoCompletionPort IsDebuggerPresent ReleaseSRWLockShared

ws2_32

getsockopt ioctlsocket connect bind WSASocketW getpeername getsockname send shutdown setsockopt WSAIoctl WSAGetLastError __WSAFDIsSet select WSAStartup closesocket WSACleanup freeaddrinfo recv getaddrinfo WSASend

secur32

InitializeSecurityContextW DecryptMessage ApplyControlToken DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle EncryptMessage FreeContextBuffer AcceptSecurityContext AcquireCredentialsHandleA

crypt32

CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertCloseStore CertDuplicateStore CertOpenStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertAddCertificateContextToStore

advapi32

SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW RegOpenKeyW

ole32

RegisterDragDrop OleInitialize CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize DoDragDrop ReleaseStgMedium

shell32

ShellExecuteA SHBrowseForFolderW SHGetPathFromIDListW SHGetPathFromIDListA SHGetMalloc ShellExecuteW DragQueryFileW

user32

SendMessageW SetWindowRgn SetWindowTextW SetRect SetWindowLongA SystemParametersInfoA CreateIconIndirect DestroyIcon LoadIconA LoadCursorA GetWindowLongA MapWindowPoints ClientToScreen GetCursorPos SetCursor AdjustWindowRectEx GetWindowRect CallWindowProcA ValidateRgn InvalidateRect GetUpdateRgn ReleaseDC GetParent GetSystemMetrics MsgWaitForMultipleObjects ReleaseCapture SetCapture GetAsyncKeyState GetKeyState SetFocus GetForegroundWindow EmptyClipboard GetClipboardData SetClipboardData ChangeClipboardChain SetClipboardViewer GetClipboardOwner CloseClipboard OpenClipboard BringWindowToTop IsIconic GetWindowPlacement SetWindowPos OpenIcon DestroyWindow IsWindow CreateWindowExW CreateWindowExA RegisterClassExW DefWindowProcW SendMessageA PeekMessageW PeekMessageA DispatchMessageW TranslateMessage RegisterWindowMessageW GetKeyboardLayout SetWindowLongPtrA GetWindowLongPtrA SetLayeredWindowAttributes ShowWindow GetWindowLongPtrW GetWindow SetActiveWindow MessageBeep GetSysColor SetForegroundWindow WindowFromPoint IsClipboardFormatAvailable PostThreadMessageA MessageBoxA PostMessageA FillRect GetKeyboardState GetDC GetClientRect

gdi32

SetWindowOrgEx SetStretchBltMode CreateDIBSection PlayEnhMetaFile GetEnhMetaFileHeader UpdateColors SetTextAlign SetDIBitsToDevice SetBkMode OffsetRgn GetDCOrgEx LPtoDP SelectObject SaveDC RestoreDC GetRgnBox GetDeviceCaps DeleteObject GetDIBits GetObjectA CreatePolygonRgn CreateRectRgn SetPixel SelectPalette GetWindowOrgEx CreateFontA EnumFontFamiliesW GetGlyphOutlineW GetTextExtentPoint32W GetCharacterPlacementW SetTextColor GetTextMetricsA TextOutW DPtoLP CreatePalette CreatePen CreateSolidBrush GetStockObject RealizePalette ExtCreatePen GetRegionData CreateBitmap ExtCreateRegion DeleteDC CreateCompatibleDC CreateCompatibleBitmap CombineRgn BitBlt StretchBlt StretchDIBits EqualRgn LineTo RectInRegion SelectClipRgn MoveToEx Polygon GdiFlush Arc Pie PolyPolygon Polyline

comctl32

_TrackMouseEvent

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

bcrypt

BCryptGenRandom

gdiplus

GdipSetPenDashStyle GdipGetPenWidth GdipSetPenWidth GdipFillPieI GdipDrawArcI GdipAddPathPolygonI GdipFillPath GdipDrawPath GdipDrawLineI GdipScaleWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetPenColor GdipSetSolidFillColor GdipAddPathLine2I GdipAddPathLineI GdipAddPathLine2 GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusStartup GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdipFree GdipAlloc GdipSetPenDashArray

vcruntime140

memcpy memmove memset memcmp _purecall strrchr longjmp strchr __current_exception_context __current_exception __intrinsic_setjmp __C_specific_handler _CxxThrowException strstr __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen _stricmp islower isspace isdigit isalnum strncpy strcmp wcsncpy isxdigit strcspn tolower toupper isupper _strdup isalpha strncmp

api-ms-win-crt-math-l1-1-0

tanf sqrtf sqrt fmaf fmodf acos roundf pow ceilf atan2f acosf expf exp2f cosf sin cos floor atanf floorf sinf ceil round log __setusermatherr

api-ms-win-crt-heap-l1-1-0

realloc malloc free calloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_wfopen ftell _set_fmode _write fopen __stdio_common_vsprintf fclose __p__commode fread fwrite _read _close _open __stdio_common_vsscanf __stdio_common_vfprintf fgets getc fflush __acrt_iob_func _wsopen_dispatch fputc _lseeki64 ferror _wopen __stdio_common_vfscanf feof fseek

api-ms-win-crt-time-l1-1-0

_time64 _ftime64

api-ms-win-crt-runtime-l1-1-0

__p___argc _wsystem __p___argv abort terminate _crt_atexit _exit _cexit _register_onexit_function _initterm_e _errno _initterm _initialize_onexit_table _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback exit raise strerror

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

mbstowcs wcstombs _strtoi64 atol strtol atoi

api-ms-win-crt-locale-l1-1-0

setlocale _create_locale _configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrmdir _wstat64i32 _stat64i32 _wchdir _wmkdir _wrename _wunlink _wchmod _waccess

api-ms-win-crt-environment-l1-1-0

_wgetcwd _wgetenv getenv _wputenv

api-ms-win-crt-process-l1-1-0

_wexecvp