TAL_RSA1024_KeyGen[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TAL_RSA1024_KeyGen.exe
Size 868KB
Sample260809-pcafdsz1a1
SHA256 b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957
MD5 d2dc39d83adcce20de74147958e29e77
SHA1 79efc36f702722aa7bce5143726e71d00251874a
SHA512 f4df6e5ad8f3e65b869bcc3f06389303649c3d814ab03d7b875d1a8d2106819dfa78b1813f6ae46fd9b430858f8972ba9bd80f4ced3d8ae14b562e3ee231d8be
SSDEEP 12288:sc9t2SllUsgxJJahnsQDdC4+J/fLYBrmxMWXl4g+rQPscchI7:scLysgxJJknsQDuXyrCMeArQD
TLSH
T1BA152313B8E186C7D3F64BF264B7B8226A3DAC058477164B3BA433757933353120B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
TAL_RSA1024_KeyGen.exe
unpack001/$TEMP/BASSMOD.dll
unpack001/$TEMP/R2RJUCE.dll
unpack001/$TEMP/keygen.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

TAL_RSA1024_KeyGen.exe

.exe 868KB
$TEMP/BASSMOD.dll

.dll 33KB
$TEMP/R2RJUCE.dll

.dll 308KB
$TEMP/bgm.xm

415KB
$TEMP/keygen.exe

.exe 771KB

TAL_RSA1024_KeyGen.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957
MD5 d2dc39d83adcce20de74147958e29e77
SHA1 79efc36f702722aa7bce5143726e71d00251874a
SHA512 f4df6e5ad8f3e65b869bcc3f06389303649c3d814ab03d7b875d1a8d2106819dfa78b1813f6ae46fd9b430858f8972ba9bd80f4ced3d8ae14b562e3ee231d8be
SSDEEP 12288:sc9t2SllUsgxJJahnsQDdC4+J/fLYBrmxMWXl4g+rQPscchI7:scLysgxJJknsQDuXyrCMeArQD
TLSH
T1BA152313B8E186C7D3F64BF264B7B8226A3DAC058477164B3BA433757933353120B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$TEMP/BASSMOD.dll

SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

73795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/R2RJUCE.dll

IMPHASH 3b61f8cc5cac4f90ec78e8ac6d8a2538
SHA256 56d2fe3beb3c57e3ccb8e7e1feda4cf37145f2f949881abae4a472289cb18b1e
MD5 43816a9f9bc418b0c728c123d22ab3e3
SHA1 74848859db7d6ad2c31be428aaad14859daef221
SHA512 94842c4250b9e1cfa5c74f5498c48e45da604fc7b4ca4d23b0d216f66bdd0bcbfb34b8513a8bc4fede02f2cd3fdcbf304b1d638190065fc41ed57e61a7daabd6
SSDEEP 6144:4whivqdhFlt1/aGA1rplhQgnN5Ytjjy2KeAOd4TBmE/S3x:4Pq/lRaGA1r/N5Qjj1HT4TIP3x
TLSH
T19B64AE00B593C076D27E093019B5AB661B7DB9300EB0CDBB6BD81F1D0FB95C19B62E66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

64824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

EnterCriticalSection GetCurrentProcess WriteFile GetModuleHandleExW TerminateProcess LeaveCriticalSection FindClose GetLocaleInfoW CreateFileW GetCurrentThreadId CreateEventW SetEvent QueryPerformanceFrequency CloseHandle LoadLibraryW ResetEvent GetProcAddress DeleteCriticalSection ExitProcess FreeLibrary QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP GetLastError HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileA FindFirstFileExA GetOEMCP IsValidCodePage GetFileType GetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc HeapFree GetModuleFileNameA GetACP GetTimeZoneInformation LoadLibraryExW InterlockedFlushSList RaiseException RtlUnwind InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringW CompareStringW MultiByteToWideChar DecodePointer EncodePointer GetModuleHandleW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError WideCharToMultiByte

winmm

timeBeginPeriod

$TEMP/keygen.exe

IMPHASH 9afd408c16ad749aaf647af5f1acf3a7
SHA256 4ad17ef1cc0445aca66988d7be356cb9e95089eee57926e42d57c0e7902a0b7f
MD5 52daa5d93e30df314b36b154e11cc9d8
SHA1 e8d5e90731f1ae392ade5412b5afc676110607d9
SHA512 81c35fe6fa32cdf2f3993a4e7ecc193b5d04965b18bfc431c3001ade158e8411826ec96c7adba179fb05a820b9d73896f0608331ca0e11daaa04e15e7c2efffc
SSDEEP 12288:tpGVQ4KQonRBVrzRNUhYDKCZYQlfmA6A0w+NT:tp1QonRBVrzTKbQcA6AE
TLSH
T1E1F46298DA1285EFF4FA433C9145A214D058B3BCC226E0AFC1EFED69507915F24F91EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

98518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

_TrackMouseEvent ord17

kernel32

MultiByteToWideChar SetEndOfFile InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA GetLocaleInfoA CreateFileA FlushFileBuffers SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter VirtualQuery VirtualProtect GetCPInfo GetOEMCP GetACP HeapSize SetUnhandledExceptionFilter WriteFile GetFileType GetStdHandle SetHandleCount IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy ReadFile CloseHandle LCMapStringW LCMapStringA SetFilePointer GetCurrentProcess TerminateProcess ExitProcess GetVersionExA GetStartupInfoA GetModuleHandleA SetCurrentDirectoryA SetEnvironmentVariableA CreateDirectoryA GetLastError GetFullPathNameA GetCurrentDirectoryA GetDriveTypeA HeapReAlloc RtlUnwind RaiseException HeapFree GetLocalTime FindFirstFileA FindNextFileA FindClose DeleteFileA GetShortPathNameA GlobalLock GlobalUnlock MulDiv GlobalAlloc GlobalFree GetCommandLineA GetSystemInfo GlobalMemoryStatus GetVersion GetComputerNameA GetWindowsDirectoryA GetSystemDirectoryA WinExec GetProcAddress LoadLibraryA FreeLibrary WideCharToMultiByte Sleep HeapAlloc GetModuleFileNameA GetTickCount

user32

MessageBoxA ShowCursor ChangeDisplaySettingsA SetClassLongA EnumDisplaySettingsA SetCursorPos GetCursorPos GetAsyncKeyState GetSystemMetrics SetWindowPos SetActiveWindow ShowWindow ReleaseDC DestroyWindow SendMessageA AdjustWindowRectEx UnregisterClassA LoadIconA LoadCursorA RegisterClassA PostQuitMessage InvalidateRect DefWindowProcA BeginPaint EndPaint FillRect TabbedTextOutA GetSysColor MoveWindow GetActiveWindow GetClassLongA CreateWindowExA SetWindowLongA IsWindowEnabled EnableWindow SetFocus GetFocus GetWindowLongA GetClientRect InflateRect DrawFocusRect DrawTextA PostMessageA SetWindowTextA GetDlgItemTextA GetDlgCtrlID IsDlgButtonChecked CallWindowProcA FindWindowA MsgWaitForMultipleObjects PeekMessageA GetMessageA TranslateMessage DispatchMessageA MapVirtualKeyA GetWindowRect GetDC

gdi32

CreateDIBSection CreateCompatibleDC Rectangle DeleteDC SetStretchBltMode StretchBlt Ellipse MoveToEx LineTo SetPixel GetPixel GetTextExtentPoint32A SetDIBColorTable CreatePalette CreateSolidBrush CreatePen GetTextMetricsA SelectPalette RealizePalette BitBlt SelectObject SetBkMode SetTextColor GetStockObject CreateFontIndirectA DeleteObject GetDeviceCaps

comdlg32

GetOpenFileNameA ChooseColorA GetSaveFileNameA

advapi32

GetUserNameA

shell32

ShellExecuteA ShellExecuteExA SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

winmm

sndPlaySoundA mciSendStringA timeEndPeriod timeGetDevCaps timeGetTime timeBeginPeriod

TAL_RSA1024_KeyGen.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$TEMP/BASSMOD.dll

generic

$TEMP/R2RJUCE.dll

kernel32

winmm

generic

$TEMP/bgm.xm

$TEMP/keygen.exe

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

winmm

generic