CoreInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CoreInstaller.exe
Size 307KB
Sample260731-sgcyvsvfpf
SHA256 9019f7e902544bb969d55af5771538b1f382e3946d300dea1ac187c5d96a04da
MD5 79aeac62773b6826b3654af5c6142388
SHA1 f00f6e9b90462ffa8107ea619ee41ebe9f192a18
SHA512 5a540ceacb83e756d5c1e1d1e9ff2615f51b0d33a385911f8220486aed0503911fa0276f840220d2a457f0df12a6fa745e863ce4be17b0fe5bed339c8d81a868
SSDEEP 6144:a9wq1LaFn1byuDYD3DyJVUIa8Hey2ph0lhSMXlBXBWntDA1LX:bDTYph0lhSMXlitD
TLSH
T1AE64BE26F79580FDE255C6B988A70A44EB337C8503816BCF136498963F27BD55E3BB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CoreInstaller.exe

File Explorer

CoreInstaller.exe

.exe 307KB

CoreInstaller.exe

IMPHASH 2a6b529e4746c840e1151090dff99fdd
SHA256 9019f7e902544bb969d55af5771538b1f382e3946d300dea1ac187c5d96a04da
MD5 79aeac62773b6826b3654af5c6142388
SHA1 f00f6e9b90462ffa8107ea619ee41ebe9f192a18
SHA512 5a540ceacb83e756d5c1e1d1e9ff2615f51b0d33a385911f8220486aed0503911fa0276f840220d2a457f0df12a6fa745e863ce4be17b0fe5bed339c8d81a868
SSDEEP 6144:a9wq1LaFn1byuDYD3DyJVUIa8Hey2ph0lhSMXlBXBWntDA1LX:bDTYph0lhSMXlitD
TLSH
T1AE64BE26F79580FDE255C6B988A70A44EB337C8503816BCF136498963F27BD55E3BB02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\spamt\source\repos\CoreHelper\x64\Release\CoreHelper.pdb

kernel32

GetConsoleScreenBufferInfo GetStdHandle SetConsoleMode Sleep GetConsoleMode FillConsoleOutputCharacterW FillConsoleOutputAttribute SetConsoleOutputCP SetConsoleCursorPosition FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockShared AcquireSRWLockShared GetCurrentThreadId LocalFree

user32

MessageBoxW

shell32

SHChangeNotify SHGetKnownFolderPath

ole32

CoInitializeEx CoCreateInstance CoTaskMemFree CoUninitialize CoInitialize

msvcp140_atomic_wait

__std_tzdb_delete_current_zone __std_tzdb_get_leap_seconds __std_tzdb_get_time_zones __std_tzdb_get_current_zone __std_tzdb_delete_sys_info __std_tzdb_delete_time_zones __std_calloc_crt __std_tzdb_get_sys_info __std_tzdb_delete_leap_seconds __std_free_crt

msvcp140

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??1_Lockit@std@@QEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0_Lockit@std@@QEAA@H@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xruntime_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Xtime_get_ticks ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_XGetLastError@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z

urlmon

URLDownloadToFileW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __C_specific_handler __std_terminate __current_exception __current_exception_context memset memcpy _CxxThrowException memmove memcmp __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc fsetpos fgetc fwrite fflush fread _fseeki64 _get_stream_buffer_pointers fputc fclose __p__commode _set_fmode fgetpos

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free _callnewh

api-ms-win-crt-math-l1-1-0

_dsign sinf __setusermatherr _ldsign _fdsign

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type abort terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc system _exit exit _initterm_e _initterm _seh_filter_exe _get_initial_narrow_environment

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen wcslen