c62dad0d6bf52660b59481500ea602d2db7240572f308deb77a5d460a546e6de
- SHA256 c62dad0d6bf52660b59481500ea602d2db7240572f308deb77a5d460a546e6de
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
installer_r2.0.07.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target c62dad0d6bf52660b59481500ea602d2db7240572f308deb77a5d460a546e6de
- Size 3.5MB
- Sample260908-efgzja1elf
- SHA256 c62dad0d6bf52660b59481500ea602d2db7240572f308deb77a5d460a546e6de
- MD5 c27505e3cbeb1b40c301e1fabf2571e0
- SHA1 98c1a9f9bdae8716a5c72540c9465466dd93123d
- SHA512 fca7628461d6e665d0d819a3bf46e145d1d519c89cb78c7364f4e2f12171fc5d1163a4df8863ad6f80cc36f825f235d2c5e08d8fae6208e3a944a35f6090d4ea
- SSDEEP 98304:4Z20d/qIgrpQ11p0xEQa/9VNwoqop7GIYKo7GsEbM1JN1RBhQ:4ZjgrpQ12EQanioqop7G3BGRY5/Q
- TLSH T17FF533CB667D5F95F33D8A3AA2F6A1875E2E513253D8B822C670C4969F073E0790058F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/installer_r2.0.07.exe
File Explorer
-
c62dad0d6bf52660b59481500ea602d2db7240572f308deb77a5d460a546e6de.zip 3.5MB
-
installer_r2.0.07.exe.exe 30.3MB
installer_r2.0.07.exe
- IMPHASH c329cfdce996b315359260e710fbdc76
- SHA256 55feacf47c59a7131e9970429a0aec53950e5d37cf229849775db9bdd099d1fd
- MD5 457e40d3294261fba35b27965451c012
- SHA1 6a9628d7e49eb88b15d576246e0409b88d36fa0d
- SHA512 a0c358cfab1fee4cb5312c6cf92f4593bca34804d357df21003b3c4f80a6ed058b9f732b51c2f1109c9dbe586abdb4ce3abe26af62fc923e204da81ccafbe9cb
- SSDEEP 98304:lClvSImXQ9EkE6uzJdQ2Orf8wsGF4tVjibVpOMOaci583EGsGFCJNlv0:klvSIkQu5TcT4PILhAxTCxv0
- TLSH T17367EA46B605C98AE0265274D8878FF4A722ECB1C6B1976733A93F1D7FFA30C4E92454
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
42864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
EventWriteTransfer
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
EventUnregister
EventRegister
OpenThreadToken
OpenProcessToken
GetLengthSid
CheckTokenMembership
FreeSid
CopySid
AllocateAndInitializeSid
kernel32
CloseHandle
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThread
GetCurrentThreadId
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
LoadLibraryExW
CompareStringW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
ExitProcess
GetModuleHandleW
GetModuleHandleExW
GetProcessHeap
WideCharToMultiByte
HeapSize
HeapReAlloc
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
EncodePointer
RaiseException
InitializeCriticalSectionEx
CallNamedPipeW
InitializeProcThreadAttributeList
CreateToolhelp32Snapshot
UpdateProcThreadAttribute
Process32NextW
Process32FirstW
DeleteProcThreadAttributeList
WaitNamedPipeW
VirtualQuery
FlushFileBuffers
GetProcessId
GetProcessTimes
GetCommandLineW
GetThreadTimes
GetModuleFileNameW
GetEnvironmentVariableW
GetSystemDirectoryW
HeapSetInformation
CreateProcessW
GetExitCodeProcess
FindNextFileW
WriteFile
SetEnvironmentVariableW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
OpenProcess
CreateEventW
SetEvent
WaitForSingleObjectEx
ResetEvent
SetFilePointerEx
QueryFullProcessImageNameW
VirtualLock
GetStdHandle
GetCommandLineA
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
VirtualAlloc
rpcrt4
UuidCreate
ntdll
RtlNtStatusToDosError
RtlGetVersion
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwind
Name
.text
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29.8MB
Virtual Size
29.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
236KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=260, version=32595,
count=17, id=259, version=32595,
count=207, id=261, version=32595,
count=9, id=257, version=32595,
count=295, id=1, productName=Unmarked objects,
count=74, id=265, version=32595,
count=1, id=255, version=32595,
count=1, id=258, version=32595,