installfile1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
installfile1.exe
Size 264KB
Sample260905-pn7v2adh45
SHA256 f6be6ac1650ec83e859631fb538dee0f6846a4901fff3b05ed50007f7192ce31
MD5 93f882c5c76e8f72108b8c2b6032cca0
SHA1 c4fe2614f6144f14bbbf3d7692e923ddc86647b0
SHA512 ebd32e8623d0cf3730c1669acdf9455c9defb8f5f822467384134cfe3e0706f5b8586a740b4b5adc421ceeb1a6691216ec86fcfb63712b3f8f35cf52eb28787b
SSDEEP 6144:fe34/BrS8UDqrGZk/Ezq12ujgIeqQS/kJIk:R9fqq0m2vIeiW
TLSH
T1194412BB56C64277CFABADB41CF34539BE7982AD41E4040F539B6F220D12743AB9640E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$EXEDIR/xlZip.exe
unpack001/$PLUGINSDIR/nsExec.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

installfile1.exe

.exe 264KB
$EXEDIR/xlZip.exe

.exe 624KB
$PLUGINSDIR/nsExec.dll

.dll 6KB

installfile1.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 f6be6ac1650ec83e859631fb538dee0f6846a4901fff3b05ed50007f7192ce31
MD5 93f882c5c76e8f72108b8c2b6032cca0
SHA1 c4fe2614f6144f14bbbf3d7692e923ddc86647b0
SHA512 ebd32e8623d0cf3730c1669acdf9455c9defb8f5f822467384134cfe3e0706f5b8586a740b4b5adc421ceeb1a6691216ec86fcfb63712b3f8f35cf52eb28787b
SSDEEP 6144:fe34/BrS8UDqrGZk/Ezq12ujgIeqQS/kJIk:R9fqq0m2vIeiW
TLSH
T1194412BB56C64277CFABADB41CF34539BE7982AD41E4040F539B6F220D12743AB9640E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

85:47:c3:d9:ba:05:59:32:54:20:4c:0b:23:42:22:b5:3b:64:b8:a4:2c:7a:be:61:ab:be:f6:08:91:b6:db:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=北京数字认证股份有限公司,O=北京数字认证股份有限公司,L=北京,ST=北京,C=CN,1.2.840.113549.1.9.1=#0c106c69756c40626a63612e6f72672e636e

Chains

Apr 25, 2018

CN=北京数字认证股份有限公司,O=北京数字认证股份有限公司,L=北京,ST=北京,C=CN,1.2.840.113549.1.9.1=#0c106c69756c40626a63612e6f72672e636e

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

PE Signature issue

Digest

aa:cf:fe:47:7f:3c:8b:df:21:0e:7d:27:a8:ef:b0:2a:44:8e:8d:f5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京数字认证股份有限公司,OU=技术研发部,O=北京数字认证股份有限公司,L=北京,ST=北京,C=CN,1.2.840.113549.1.9.1=#0c197a68616f796f6e677368656e6740626a63612e6f72672e636e

Chains

Apr 25, 2018

CN=北京数字认证股份有限公司,OU=技术研发部,O=北京数字认证股份有限公司,L=北京,ST=北京,C=CN,1.2.840.113549.1.9.1=#0c197a68616f796f6e677368656e6740626a63612e6f72672e636e

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:15:4b:5a:c3:94

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 1, 1998 - Jan 28, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Serial Number

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Mar 16, 2016 - Mar 16, 2024

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=北京数字认证股份有限公司,OU=技术研发部,O=北京数字认证股份有限公司,L=北京,ST=北京,C=CN,1.2.840.113549.1.9.1=#0c197a68616f796f6e677368656e6740626a63612e6f72672e636e

Serial Number

3e:5e:b2:d3:76:b7:5f:57:b9:4c:76:2a

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 20, 2017 - Feb 21, 2020

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=北京数字认证股份有限公司,O=北京数字认证股份有限公司,L=北京,ST=北京,C=CN,1.2.840.113549.1.9.1=#0c106c69756c40626a63612e6f72672e636e

Serial Number

1f:32:29:e8:22:98:45:5f:0f:c5:dd:ac

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 10, 2017 - Nov 10, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$EXEDIR/xlZip.exe

IMPHASH 9ae21488feff8e0c199cd8680739d001
SHA256 bf137c826988b852fa4a373d50a31d41bab2b35a1f82c4188ecf3521b24df801
MD5 34568c329ccdd6000b265a8fbd24db7a
SHA1 3ad7557549f8556e9e6edd881517fdf6a2257a20
SHA512 888e59ef1da604fe282b7014f9504a9d3fc74acc9510af919a04ae682c69186a4fa50205b9d91d480be393841738774b833ad33e5693db728c3c972cae114a55
SSDEEP 12288:F3rmV1gpyGfTnGuTmzEiOlzF5vVPSI5j4tnX09hKPNGecQbBbquHJVNIrhrJ/44H:F3iYrGuT3PSXVBk0T4
TLSH
T165D45B00B791C035F9B721F469BE937DA82DBAA1572860CBA3D45BEE5B345E06C3134B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

83280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\test\zlib\ZLibWrap-master\ZLibWrap-master\Debug\xlZip.pdb

kernel32

FindResourceExW WideCharToMultiByte ReadFile GetFileSizeEx FileTimeToDosDateTime FileTimeToLocalFileTime GetFileTime CloseHandle CreateFileW GetFileAttributesW FindNextFileW FindClose FindFirstFileW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime WriteFile CreateDirectoryW MultiByteToWideChar InterlockedIncrement InterlockedDecrement RaiseException GetModuleFileNameW RtlUnwind GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetOEMCP GetCPInfo IsValidCodePage GetProcAddress TlsGetValue GetModuleHandleW TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError GetLastError GetCurrentThread GetTimeFormatA GetDateFormatA HeapValidate IsBadReadPtr Sleep ExitProcess DeleteCriticalSection FatalAppExitA GetStringTypeA GetStringTypeW GetLocaleInfoA IsValidLocale FindResourceW GetUserDefaultLCID QueryPerformanceCounter GetTickCount GetCurrentProcessId FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStdHandle GetFileType GetStartupInfoA HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW SetConsoleCtrlHandler LoadLibraryW GetConsoleCP GetConsoleMode SetFilePointer LCMapStringW LCMapStringA GetTimeZoneInformation HeapAlloc HeapSize HeapReAlloc VirtualAlloc FreeLibrary InterlockedExchange LoadLibraryA InitializeCriticalSectionAndSpinCount CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers lstrlenA GetLocaleInfoW SetEndOfFile GetProcessHeap VirtualQuery CompareStringA CompareStringW SetEnvironmentVariableA SetEvent OpenEventA InitializeCriticalSection UnmapViewOfFile GetSystemInfo MapViewOfFile CreateFileMappingA OpenFileMappingA LoadResource LockResource EnumSystemLocalesA SizeofResource

advapi32

RevertToSelf SetThreadToken OpenThreadToken

Name

.text

Size

493KB

Virtual Size

493KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
TLSH
T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

installfile1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$EXEDIR/xlZip.exe

kernel32

advapi32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic