CosmosInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CosmosInstaller.exe
Size 1.2MB
Sample260803-e3b2ssca42
SHA256 933fb70dd5def61193478b165f49d26dff49a22d142232621b81dd72531decff
MD5 e5556073f919ece173b1e20a4801f060
SHA1 bdac818c72e89d89311ab43d22b3638eaeb102f9
SHA512 923defc034f86d5247cefbae1d5a927b83cd63391e231e0f2a38b54d14f6824490de1c846d0664deaa7fcbde3ba91f2c2fec189ab09e5e3002b5a6989ad8435e
SSDEEP 12288:EANAeJh+kbApjZaPg1m6E8JA9nDjG6FTjwDi62wfJYSjqJ++pT/Vz1c:3A4AQ4U6E8SnnZFocJ++pT/Vz1c
TLSH
T11155188131D65CE7EEA75B7862C3B235A639FE60CB7ACF278104C53024236C17E6BA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CosmosInstaller.exe

File Explorer

CosmosInstaller.exe

.exe 1.2MB

CosmosInstaller.exe

IMPHASH 16c89f9dca4add8e67790cf75a29abea
SHA256 933fb70dd5def61193478b165f49d26dff49a22d142232621b81dd72531decff
MD5 e5556073f919ece173b1e20a4801f060
SHA1 bdac818c72e89d89311ab43d22b3638eaeb102f9
SHA512 923defc034f86d5247cefbae1d5a927b83cd63391e231e0f2a38b54d14f6824490de1c846d0664deaa7fcbde3ba91f2c2fec189ab09e5e3002b5a6989ad8435e
SSDEEP 12288:EANAeJh+kbApjZaPg1m6E8JA9nDjG6FTjwDi62wfJYSjqJ++pT/Vz1c:3A4AQ4U6E8SnnZFocJ++pT/Vz1c
TLSH
T11155188131D65CE7EEA75B7862C3B235A639FE60CB7ACF278104C53024236C17E6BA55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateRoundRectRgn DeleteDC DeleteObject GetStockObject SelectObject

gdiplus

GdipAddPathArc GdipAlloc GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreateLineBrush GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawImageRect GdipDrawLine GdipDrawPath GdipDrawString GdipFillPath GdipFree GdipLoadImageFromStream GdipSetInterpolationMode GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdiplusShutdown GdiplusStartup

kernel32

AddVectoredExceptionHandler CloseHandle CreateDirectoryW CreateEventA CreateFileW CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount64 GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LoadResource LockResource MultiByteToWideChar OpenProcess OutputDebugStringA RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _ismbblead _onexit _read _setjmp _strdup _ultoa abort calloc exit fprintf fputc fputs fputwc free fwprintf fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc signal strchr strcmp strerror strlen strncmp strtoul vfprintf wcscmp wcslen

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal

shell32

SHGetKnownFolderPath ShellExecuteW

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW EndPaint GetClientRect GetCursorPos GetMessageW GetSystemMetrics InvalidateRect LoadCursorW LoadIconW PostMessageW PostQuitMessage PtInRect RegisterClassExW ScreenToClient SetCursor SetWindowRgn TrackMouseEvent TranslateMessage

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

Name

.text

Size

203KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CosmosInstaller.exe

dwmapi

gdi32

gdiplus

kernel32

msvcrt

ole32

shell32

user32

winhttp

generic