OgulniegaInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OgulniegaInstaller.exe
Size 537KB
Sample260905-m32w8ashld
SHA256 8abe5d31cede9bab7e04f09ff8cfce0d5eb2b18f7c4e2c7432bb328a65920cb3
MD5 94f1f88a4a80115e8bf2db77d22d1426
SHA1 16feae48af9d14b54cc72aa4e69496c460b1956c
SHA512 1961c2edb387a6f02540aee49437c66c4534d97f4b6d123e97cbb755d149d1db1d8f0a449471e722f0d22693598a6c16144fd6f6eb9f080d44c1cdca5be91c09
SSDEEP 6144:4P6j0H/9yogIvGv6g8BU3IPob6sFH0BemtsETCIFs92bSkeYe5s+1:7AH/oIzV5sFHZmpR+Eex1
TLSH
T1B9C49E17F69005F5D4A7C178CA524922EB327C4A4772DBCF17E096652E236E09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

OgulniegaInstaller.exe

.exe 537KB

OgulniegaInstaller.exe

IMPHASH c527a4e4a7fcff789b822ce5896d9be4
SHA256 8abe5d31cede9bab7e04f09ff8cfce0d5eb2b18f7c4e2c7432bb328a65920cb3
MD5 94f1f88a4a80115e8bf2db77d22d1426
SHA1 16feae48af9d14b54cc72aa4e69496c460b1956c
SHA512 1961c2edb387a6f02540aee49437c66c4534d97f4b6d123e97cbb755d149d1db1d8f0a449471e722f0d22693598a6c16144fd6f6eb9f080d44c1cdca5be91c09
SSDEEP 6144:4P6j0H/9yogIvGv6g8BU3IPob6sFH0BemtsETCIFs92bSkeYe5s+1:7AH/oIzV5sFHZmpR+Eex1
TLSH
T1B9C49E17F69005F5D4A7C178CA524922EB327C4A4772DBCF17E096652E236E09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

de:b1:62:93:f7:9f:ad:a4:91:f9:a3:ea:0e:85:d8:6c:3e:3f:24:7d:1b:86:be:38:27:cb:67:12:fc:ca:3b:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 25, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 19, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

118572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindResourceW GetCommandLineW RemoveDirectoryW GetTempPathW WaitForSingleObject GetFileAttributesW GetTickCount64 DeleteFileW GetCurrentProcessId CreateProcessW CopyFileW GetExitCodeProcess GetCurrentProcess FindPackagesByPackageFamily GetEnvironmentVariableW OpenEventW CreateEventW GetLastError GetPackagePathByFullName LocalFree SetEvent FormatMessageW LoadResource WriteConsoleW HeapReAlloc HeapSize WideCharToMultiByte GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CreateThread LockResource Sleep GetModuleFileNameW SizeofResource CreateDirectoryW GetLocalTime CloseHandle OutputDebugStringW MultiByteToWideChar CreateFileW SetFilePointerEx LCMapStringW VirtualProtect GetConsoleMode WriteFile ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize QueryPerformanceCounter InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

DefWindowProcW PostMessageW GetWindowRect SetWindowPos GetMessageW CreateWindowExW SendMessageW SetWindowTextW RegisterClassExW GetWindowLongW DispatchMessageW TranslateMessage LoadIconW LoadCursorW SetCursor SetWindowLongW GetClientRect PostQuitMessage SystemParametersInfoW UpdateWindow InvalidateRect ShowWindow FillRect

gdi32

GetStockObject SetTextColor SetBkMode DeleteObject CreateSolidBrush CreateFontW

advapi32

OpenProcessToken IsValidSid ConvertSidToStringSidA GetTokenInformation

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoInitializeEx CreateStreamOnHGlobal CoUnmarshalInterface CoCreateInstance CoCreateFreeThreadedMarshaler CoUninitialize

rpcrt4

RpcBindingFromStringBindingA NdrClientCall2 RpcStringBindingComposeA RpcStringFreeA

comctl32

ord345 InitCommonControlsEx

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

93KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OgulniegaInstaller.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

rpcrt4

comctl32

oleaut32

api-ms-win-core-winrt-error-l1-1-1

generic