Kaspersky Installer[.]exe

General

Target
Kaspersky Installer.exe
Size 4.5MB
Sample260816-eepyracn7v
SHA256 bc8526519ba3ab695fa8659774f5c93d7d12fe0af43402f2f60682f30c7cefb3
MD5 ddb6b05d76fe3b5e01ccc60a44ea0f18
SHA1 8f4c16963e0ab16b1e5cab461ce632786390d744
SHA512 33756f883960c43e09470b91f36f0558a4bf10844f808c521873178d2787b7e56b9b75366803fff63615a584f0c71856964629fbf125cb920c348ec07078b0de
SSDEEP 98304:RUA459jvgsJEMiVfDzdEs8jFEq5NrlV6WVM:ujvgBnB8lMF
TLSH
T18126EF11AE7D9062F422453D4A5D9273C5BBBBECB71F019762B4267B0B237808A2D377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Kaspersky Installer.exe

.exe 4.5MB

Kaspersky Installer.exe

IMPHASH 3b629027afbe60960e4099d322d33917
SHA256 bc8526519ba3ab695fa8659774f5c93d7d12fe0af43402f2f60682f30c7cefb3
MD5 ddb6b05d76fe3b5e01ccc60a44ea0f18
SHA1 8f4c16963e0ab16b1e5cab461ce632786390d744
SHA512 33756f883960c43e09470b91f36f0558a4bf10844f808c521873178d2787b7e56b9b75366803fff63615a584f0c71856964629fbf125cb920c348ec07078b0de
SSDEEP 98304:RUA459jvgsJEMiVfDzdEs8jFEq5NrlV6WVM:ujvgBnB8lMF
TLSH
T18126EF11AE7D9062F422453D4A5D9273C5BBBBECB71F019762B4267B0B237808A2D377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

73:53:7c:27:e0:8c:46:07:42:56:d4:b2:d4:c1:08:5a:64:34:6f:7a:00:91:fc:8c:f9:7b:4b:1a:6c:84:e3:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoye\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 14, 2026

SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoye\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Minor OS version

0

Major OS version

6

Entry point

15088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\b\d_00000000_\b\b\execroot\k\bazel-out\x86_32-windows-opt-ST-bd47c771e5d9\bin\product\kavkis\PPP\Install\Setup\starter\setup.pdb

kernel32

LocalAlloc OpenProcess WaitForSingleObject CloseHandle DeleteFileW RemoveDirectoryW GetModuleFileNameW GetLastError CreateDirectoryW CompareStringW GetTempPathW ExpandEnvironmentStringsW CreateProcessW CreateFileW GetSystemWindowsDirectoryW GetExitCodeProcess GetCurrentProcessId ReadFile FormatMessageW GetModuleHandleW GetFileAttributesW SetCurrentDirectoryW LoadLibraryExW GetProcAddress FreeLibrary LocalFree HeapFree GetProcessHeap MultiByteToWideChar GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleA GetCurrentProcess GetCurrentDirectoryW MoveFileW HeapAlloc RaiseException GetCurrentThreadId Sleep GetModuleHandleExW GetLocalTime SetUnhandledExceptionFilter SetEnvironmentVariableW GetWindowsDirectoryW GetLongPathNameW LoadLibraryW SetDllDirectoryW SetLastError FindResourceExW LoadResource LockResource SizeofResource WriteFile GetModuleFileNameA GetModuleHandleExA SetFilePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent ResetEvent DeleteCriticalSection FindNextFileW FindClose MoveFileExW GetTempFileNameW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx AreFileApisANSI CopyFileW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer LCMapStringEx GetCPInfo VirtualQuery RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapReAlloc HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW VirtualProtect VirtualAlloc GetSystemInfo FlushInstructionCache GetTickCount LoadLibraryExA

Name

.text

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kaspersky Installer.exe

kernel32

generic