Patch Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Patch Installer.exe
Size 447KB
Sample260714-31hcssfw5j
SHA256 3f968ec97c6d56104e494820598a9d3b4a7d4fb3ba7ee5d92f74b0cbf1225c06
MD5 b4af8cca71127d21bc871a553bf15091
SHA1 5d06b0616edf7e046a299e3d74adc3dd6f531b5f
SHA512 caf378e321f64c9c1fb21743a4cdac995c6924686289c81cc3dabcc7c3af6581af5f883409fdb61b1420a9aa45dc36283652de5088c71c68306cc74adeb20bd4
SSDEEP 6144:RMjKkBhfMOqXlih5Y3XQGbSXt/pD2w0SwrVSs0TRzcIc4n1IjHPd:RMjKkBhfMOqVignr4puATRz1
TLSH
T10EA47B75659408ADFAA383FD8F8E9619E6617C329F60F68B035301820FD7ADD7D3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Patch Installer.exe

File Explorer

Patch Installer.exe

.exe 447KB

Patch Installer.exe

IMPHASH fe19ea0e42ed777df914eb01e29203af
SHA256 3f968ec97c6d56104e494820598a9d3b4a7d4fb3ba7ee5d92f74b0cbf1225c06
MD5 b4af8cca71127d21bc871a553bf15091
SHA1 5d06b0616edf7e046a299e3d74adc3dd6f531b5f
SHA512 caf378e321f64c9c1fb21743a4cdac995c6924686289c81cc3dabcc7c3af6581af5f883409fdb61b1420a9aa45dc36283652de5088c71c68306cc74adeb20bd4
SSDEEP 6144:RMjKkBhfMOqXlih5Y3XQGbSXt/pD2w0SwrVSs0TRzcIc4n1IjHPd:RMjKkBhfMOqVignr4puATRz1
TLSH
T10EA47B75659408ADFAA383FD8F8E9619E6617C329F60F68B035301820FD7ADD7D3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SendMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow ShowWindow SetWindowPos SetTimer TranslateMessage EnableWindow DrawTextW UpdateWindow GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetWindowTextW GetWindowTextW DispatchMessageW KillTimer GetClientRect SystemParametersInfoW LoadCursorW FillRect SetCursor MessageBoxW GetMessageW

gdi32

SelectObject GetTextExtentPoint32W DeleteObject DeleteDC CreateSolidBrush CreateFontW CreateCompatibleDC BitBlt CreateCompatibleBitmap

shell32

ShellExecuteW

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

crypt32

CryptStringToBinaryA

advapi32

CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptDestroyHash

gdiplus

GdipDisposeImage GdipDrawImageRectI GdipSetInterpolationMode GdipDeleteGraphics GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipLoadImageFromFile GdipCreateFromHDC GdipCloneImage GdipGetImageWidth GdipGetImageHeight

urlmon

URLDownloadToFileW

kernel32

ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID GetProcessHeap LCMapStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW HeapReAlloc LoadLibraryExW VirtualProtect HeapAlloc FreeEnvironmentStringsW GetLocaleInfoW SetStdHandle HeapSize WriteConsoleW SetEndOfFile IsValidLocale GetModuleFileNameW HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetProcAddress GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent FlsFree FlsSetValue CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetTempFileNameW ReadFile GetTempPathW CloseHandle GetLastError GetTickCount RtlUnwind MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FlsGetValue RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc

Name

.text

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Patch Installer.exe

user32

gdi32

shell32

ole32

crypt32

advapi32

gdiplus

urlmon

kernel32

generic