installer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
installer.exe
Size 17.3MB
Sample260908-sdlrlaswbt
SHA256 0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f
MD5 9878c275a40bd2d6f63698b36c65890b
SHA1 a8eef4f895067616efa923b072fa0cf98b65b2a5
SHA512 a493ceefb2b37d568cfb871b393b15cc364f499cd88a8672859bd6ef63b4020e6813990ff62c85174b9274e266b32a8114a9b18d718998cedd4176076d6da1ee
SSDEEP 49152:hZ5Wre+Zk4phU3MJ7CAsGllFvmSD4O//eDP66y8rpxxqn9HsWORudliSFgQ0JA8U:hZ5v+2wZtPpiZps
TLSH
T1E3073A17FA9110D9C45EE338866B17527B30BC4D9B3273E32E916A743E66BE2AC75700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
installer.exe

File Explorer

installer.exe

.exe 17.3MB

installer.exe

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f
MD5 9878c275a40bd2d6f63698b36c65890b
SHA1 a8eef4f895067616efa923b072fa0cf98b65b2a5
SHA512 a493ceefb2b37d568cfb871b393b15cc364f499cd88a8672859bd6ef63b4020e6813990ff62c85174b9274e266b32a8114a9b18d718998cedd4176076d6da1ee
SSDEEP 49152:hZ5Wre+Zk4phU3MJ7CAsGllFvmSD4O//eDP66y8rpxxqn9HsWORudliSFgQ0JA8U:hZ5v+2wZtPpiZps
TLSH
T1E3073A17FA9110D9C45EE338866B17527B30BC4D9B3273E32E916A743E66BE2AC75700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.2MB

Virtual Size

10.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

85KB

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

installer.exe

kernel32

generic