SPGMISFToolkitSetup64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
SPGMISFToolkitSetup64.zip
Size 7.5MB
Sample260802-wt91xayeqe
SHA256 e836236dd22dab3535e3b5981b187f88fef7be4f50aa6b1a3ce42a9c02166d12
MD5 a073e72c71f88d6d12a2567a033f5c9b
SHA1 2db6447c68c8f39779412a21a773528896105b69
SHA512 17fd7004979257dce77d72f1a9b3ae417d87895e01d0e88eaeda6e8c5d8af7a116bcfa228cca8355d676c557b624cda38868eb650e8bfdd3198f436729ae026f
SSDEEP 196608:w16F5+1MZrCqdTQ8wz8LjC+Olhw8Qdq2qO:U1MZeQG4ZO3+q2qO
TLSH
T1B0863390CDFF94BBCDE3E831997663A5C9DA1123495118309D526BFF2B8CD28863D232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned MSI 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SPGlobalRtdServerSetup64.msi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/setup.exe

File Explorer

SPGMISFToolkitSetup64.zip

.zip 7.5MB
SPGlobalRtdServerSetup64.msi

.msi 8.5MB
setup.exe

.exe 421KB

SPGMISFToolkitSetup64.zip

SHA256 e836236dd22dab3535e3b5981b187f88fef7be4f50aa6b1a3ce42a9c02166d12
MD5 a073e72c71f88d6d12a2567a033f5c9b
SHA1 2db6447c68c8f39779412a21a773528896105b69
SHA512 17fd7004979257dce77d72f1a9b3ae417d87895e01d0e88eaeda6e8c5d8af7a116bcfa228cca8355d676c557b624cda38868eb650e8bfdd3198f436729ae026f
SSDEEP 196608:w16F5+1MZrCqdTQ8wz8LjC+Olhw8Qdq2qO:U1MZeQG4ZO3+q2qO
TLSH
T1B0863390CDFF94BBCDE3E831997663A5C9DA1123495118309D526BFF2B8CD28863D232
MD5 SHA1 SHA512 SSDEEP TLSH

setup.exe

IMPHASH faa0bc220f53587aedab9242f4908d7f
SHA256 5720d23a5b11b93fc43be8041e3c51fd5255bdcebf9839a87275c7c032d1e69c
MD5 1e596d5b073234478d79746d0e8cb00c
SHA1 b265d3e383217eb2505e7dbabe283a7aeada3a85
SHA512 d0c222cc87f71e3a5487d93740f900b56727bebbc1a409ec01513937c2784e8776e576f3d264fe09dd8653afd7d334bae768c35d36e98a1b73691aabae381e28
SSDEEP 6144:YDYWR5J+Wnp8JZt1u3s+++yPmhbyonmqZ2TLdwMpvXVQF4WaobRu:YDtPJKQ7v5yamCmwj1R
TLSH
T161942812A7E89035F1B34770AB7693A04BBEBC715D36CA1F63C4490E59B5982FD20B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.pdb

kernel32

GetCurrentProcessId OpenProcess GetNativeSystemInfo EndUpdateResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW ReadFile Sleep GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte GetVersion GetModuleHandleW HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW MulDiv GetTickCount SetEndOfFile GetExitCodeProcess LoadLibraryW SwitchToThread InterlockedCompareExchange GetTempPathW InterlockedExchange FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetEnvironmentVariableA ReadConsoleW WriteConsoleW SetStdHandle HeapReAlloc LCMapStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW OutputDebugStringW LoadLibraryExW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW HeapSize GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent HeapAlloc TlsFree TlsSetValue TlsGetValue FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime QueryPerformanceCounter RaiseException LoadLibraryExA GetCommandLineW RtlUnwind InterlockedDecrement GetCPInfo HeapFree SetLastError InterlockedIncrement GetCurrentThreadId ExitProcess GetModuleHandleExW MultiByteToWideChar GetStdHandle GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW ScreenToClient SetCursor GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA GetWindowRect GetFocus

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord8 ord78 ord150 ord92