ostinstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ostinstaller.exe
Size 386KB
Sample260827-2js8as1ene
SHA256 836eae24edd79ea837c3de64034c102db386f7bc602bc73ecd10e62cc1a7f7e1
MD5 2319fa31fc404b91c04c89d781675be6
SHA1 9b8a26e8a62df701027fd0e036c51d8ac9a350d7
SHA512 3ef7c104c6f90f0cac1e3d1071347d9ac35609129d21548317bc7b6f3a6437e4ad6982c6d3cdc2c8c5af6ebfbd15842cfb237285ea7be0814853efc612077fab
SSDEEP 6144:8fQ7dgw+C5SZfmXOuEulReTQRzWEIbL60i/y5EyxK:8fQJgw+CME+ABFCbLRi/
TLSH
T1DF846D29FAA810FDE1B7D178CD624902E7727C4B0371AADF13A44A561F276D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ostinstaller.exe

File Explorer

ostinstaller.exe

.exe 386KB

ostinstaller.exe

IMPHASH 192d9d76c4795983e958e1458013ac7a
SHA256 836eae24edd79ea837c3de64034c102db386f7bc602bc73ecd10e62cc1a7f7e1
MD5 2319fa31fc404b91c04c89d781675be6
SHA1 9b8a26e8a62df701027fd0e036c51d8ac9a350d7
SHA512 3ef7c104c6f90f0cac1e3d1071347d9ac35609129d21548317bc7b6f3a6437e4ad6982c6d3cdc2c8c5af6ebfbd15842cfb237285ea7be0814853efc612077fab
SSDEEP 6144:8fQ7dgw+C5SZfmXOuEulReTQRzWEIbL60i/y5EyxK:8fQJgw+CME+ABFCbLRi/
TLSH
T1DF846D29FAA810FDE1B7D178CD624902E7727C4B0371AADF13A44A561F276D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

shell32

SHGetFolderPathW ShellExecuteW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteTreeW

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapReAlloc SetFilePointerEx GetFileSizeEx ReadFile GetConsoleOutputCP FlushFileBuffers GetFileType HeapSize WriteConsoleW SetEndOfFile LCMapStringEx CloseHandle WaitForSingleObject Sleep TerminateProcess OpenProcess GetNativeSystemInfo GetModuleFileNameW FreeConsole SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW EnumSystemLocalesW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress CopyFile2 MoveFileExW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer RtlUnwind GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree CreateFileW GetConsoleMode SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID

Name

.text

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ostinstaller.exe

winhttp

bcrypt

shell32

advapi32

kernel32

generic