74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967

Sharing

Copy URL Twitter E-mail

General

Target
74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967
Size 862KB
Sample260825-sdctpabk9x
SHA256 74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967
MD5 1e398d3d07eedc7037bacbe933ea4dd1
SHA1 ef72f9af15430442bd6719c7ae4db983896d0b14
SHA512 be30bd469a3b50a0ee2616ea1f7c75a52a529668b27de1772fbdfc636deff2486b52a571db6144af9ec716566f5985e5548847d1aca18afaac6b9c052acb7ee5
SSDEEP 24576:MtqEG+li6u7GcJQOicJj+8JBUnM3XI1FdZhgLH7ir7dyky7+:MUyXu7fQOpdKMItZhHy57+
TLSH
T1311512099A03D7F1DC1F0733894BD67A12505E6CF254CCD3D7AD7D6AECBA5A23222252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$_3_

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967

.exe 862KB
$PLUGINSDIR/StdUtils.dll

.dll 14KB
$_3_

.exe 1.8MB
$_4_

31KB
$_5_

.png 79KB

74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967
MD5 1e398d3d07eedc7037bacbe933ea4dd1
SHA1 ef72f9af15430442bd6719c7ae4db983896d0b14
SHA512 be30bd469a3b50a0ee2616ea1f7c75a52a529668b27de1772fbdfc636deff2486b52a571db6144af9ec716566f5985e5548847d1aca18afaac6b9c052acb7ee5
SSDEEP 24576:MtqEG+li6u7GcJQOicJj+8JBUnM3XI1FdZhgLH7ir7dyky7+:MUyXu7fQOpdKMItZhHy57+
TLSH
T1311512099A03D7F1DC1F0733894BD67A12505E6CF254CCD3D7AD7D6AECBA5A23222252
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

6a:26:0a:c9:d4:1a:5a:cd:30:f2:48:ec:c2:7d:ac:71:84:8b:3d:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,ST=Isle Of Man,C=IM

Chains

Aug 21, 2026

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,ST=Isle Of Man,C=IM

Minor OS version

Major OS version

Entry point

17191

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/StdUtils.dll

IMPHASH 6aa1fb50f909cdf4bea3d3523348e900
SHA256 0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
MD5 21010df9bc37daffcc0b5ae190381d85
SHA1 a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA512 95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
SSDEEP 192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
TLSH
T1F152A6258D40AAB9F4F1157B71BB2762DA394D04A324FCDB4B2228F91A045FB7C7274E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_3_

IMPHASH ad0c070707e2c3413be9c2aad29f01a4
SHA256 333d9de24a498e6a520c9a0a7085961821febc2bd7e059a881883fd5266ea9a4
MD5 a00cd9d2d4c53263004ad4d50208a58a
SHA1 03e563a1691144255710c424acdcc344205565b1
SHA512 56e224c00ba26d0e8405ecf4bf6d7e325e95293945b586747a1d609375ed83cf92e969e602a2a317ce337ec37a9fc680a7d568008eee2c5eceb6552ff985a756
SSDEEP 49152:rc4u49CbNSFXVJUtSH9zaTRpSWaezjQWLtm5YXld:rz4GFJUtYf
TLSH
T14B858C96F682C030D5610572D078D6FE807A6F74E321A9E753DC3EAA29315C2E939F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

980853

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetConnectW HttpSendRequestW InternetSetOptionW HttpQueryInfoW InternetReadFile InternetGetLastResponseInfoW InternetCloseHandle InternetGetConnectedState InternetCrackUrlW InternetQueryOptionW HttpOpenRequestW InternetOpenW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipDeleteBrush GdipFree GdipDeletePen GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCreatePen1 GdipReleaseDC GdipGetImageWidth GdipCloneImage GdipFillRectangleI GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromFile GdipDisposeImage GdipAlloc GdipCreateSolidFill GdipSetSmoothingMode GdipDrawImageRectI GdipDeleteGraphics GdipSetPenMode GdipGetImageHeight

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose CertGetNameStringW CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam

kernel32

ReadConsoleInputA SetConsoleMode IsValidCodePage GetACP DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetVersionExW WriteFile ReadFile GetStdHandle GetLastError LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects WideCharToMultiByte MultiByteToWideChar GetFullPathNameW CreateDirectoryW SetFileTime CreateFileW lstrlenW RemoveDirectoryW CloseHandle DeleteFileW SetFileAttributesW FindFirstFileW FindClose FindNextFileW GetFileSize SetFilePointer SetEndOfFile GlobalMemoryStatus GetModuleHandleW GetProcAddress GetSystemInfo VirtualFree VirtualAlloc WaitForSingleObject SetEvent InitializeCriticalSection ResetEvent CreateEventW FindResourceExW FindResourceW LoadResource SizeofResource GetOEMCP InterlockedDecrement OutputDebugStringW GetCurrentThreadId GetCurrentProcessId GetSystemDefaultLCID CreateThread CopyFileW GetFileAttributesW lstrlenA GetEnvironmentVariableW FlushFileBuffers GetLongPathNameW GetVersion MapViewOfFile UnmapViewOfFile FlushViewOfFile Sleep GetModuleFileNameW CreateFileMappingW GetCurrentProcess OpenProcess TerminateProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot HeapAlloc HeapFree GetProcessHeap InterlockedIncrement GlobalLock GlobalAlloc MulDiv lstrcmpW GlobalUnlock FlushInstructionCache RaiseException SetLastError GetTickCount GetExitCodeProcess EnumSystemLanguageGroupsW GetProcessId LocalAlloc LocalFree GlobalFree GlobalHandle FreeLibrary LoadLibraryExW lstrcmpiW GetModuleHandleA GetFileType QueryPerformanceCounter LoadLibraryA GetVersionExA FlushConsoleInputBuffer UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW HeapSize RtlUnwind GetConsoleCP SetFilePointerEx GetStringTypeW LoadLibraryW GetEnvironmentStringsW FreeEnvironmentStringsW ReadConsoleW SetStdHandle GetLocaleInfoW IsValidLocale GetUserDefaultLCID EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent HeapReAlloc ExitThread GetSystemTimeAsFileTime GetLocalTime GetTimeZoneInformation GetCPInfo GetModuleHandleExW WriteConsoleW GetCommandLineW ExitProcess AreFileApisANSI SetConsoleCtrlHandler GetConsoleMode EnumSystemLocalesW CompareStringW LCMapStringW SetEnvironmentVariableA HeapDestroy InterlockedCompareExchange InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList LockResource

user32

GetMessageW GetUserObjectInformationW GetProcessWindowStation MessageBoxA AnimateWindow CallNextHookEx GetMenuItemInfoW TranslateMessage IsDialogMessageW GetWindowPlacement CreateDialogIndirectParamW CheckMenuRadioItem PeekMessageW SetMenuDefaultItem SetWindowsHookExW UnhookWindowsHookEx GetSystemMetrics SetDlgItemTextW EnableWindow SetMenuItemInfoW DispatchMessageW GetLastInputInfo SwitchToThisWindow UpdateLayeredWindow PostQuitMessage UnregisterClassW LoadIconW FindWindowExW MessageBoxW RegisterClassW ValidateRect EndPaint ClientToScreen DestroyWindow GetWindowTextLengthW DestroyAcceleratorTable SetWindowRgn SetTimer ScreenToClient GetWindowRect MapDialogRect CharNextW GetWindowDC RegisterWindowMessageW FillRect IsChild SetCapture KillTimer GetFocus GetParent InvalidateRgn LoadCursorW GetClientRect CreateAcceleratorTableW SetFocus BeginPaint GetClassInfoExW GetDC SetWindowContextHelpId RegisterClassExW InvalidateRect GetWindowLongW GetWindowTextW SystemParametersInfoW GetClassNameW ReleaseDC GetDlgItem SetWindowLongW EndDialog RedrawWindow SendDlgItemMessageW GetDesktopWindow GetSysColor SetWindowPos SetLayeredWindowAttributes ShowWindow IsWindow CreateWindowExW ReleaseCapture SendMessageW SetWindowTextW CallWindowProcW DefWindowProcW GetWindow MoveWindow EnumWindows GetWindowThreadProcessId CharUpperW PostMessageW

gdi32

DeleteDC CreateDIBSection GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CombineRgn CreateSolidBrush BitBlt CreateRectRgn GetObjectW CreateCompatibleBitmap GetStockObject

advapi32

RegisterEventSourceA RegOpenKeyExW RegCloseKey ReportEventA DeregisterEventSource RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegEnumKeyExW LookupAccountSidW RegDeleteKeyW RegSetValueW OpenProcessToken LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges RegQueryValueExW

shell32

ShellExecuteExW ExtractIconW SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW SHGetDesktopFolder SHCreateDirectoryExW SHFileOperationW

ole32

CoCreateInstance OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal StringFromGUID2 OleSetContainedObject OleInitialize OleUninitialize StgCreateDocfile OleCreate OleDraw CoTaskMemFree CoGetClassObject CoTaskMemAlloc CoCreateGuid CoUninitialize CoTaskMemRealloc CoInitialize

oleaut32

GetErrorInfo VarUI4FromStr DispCallFunc LoadRegTypeLi OleCreateFontIndirect SysAllocStringLen SysAllocString SysFreeString VariantClear VariantCopy SysStringLen VariantInit LoadTypeLi

shlwapi

ord176 UrlEscapeW PathIsDirectoryEmptyW

comctl32

InitCommonControlsEx

74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

kernel32

user32

shell32

ole32

oleaut32

generic

$_3_

wininet

version

gdiplus

psapi

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic

$_4_

$_5_