X-Plane 11 Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
X-Plane 11 Installer.exe
Size 31.6MB
Sample260910-fn6hjayeke
SHA256 1c669986b2c92eb1de7b664f5a7a5062c40b94c1a947a35b1648218333f6ffdd
MD5 4b0646e24b11e4099c36b0659f16abd3
SHA1 56f05b61da12173b9735d30ef9193c0b880ab0b8
SHA512 fe63623da48448f9246bff2f2de8408153f6b1d91ca663fef80e20071004b82e748be12355803f5629a0ddf3e57af1897d37b9f8d814af4fdcc693d200bb5bee
SSDEEP 786432:H6ffDaCP46f/ZQIykPbruYlvl8F//YhJCnpwX1I:affD7rf/ZQUCYlvleG/S
TLSH
T1D777D03BA2E85364C4C24132A285B656F361756F3717E2F7249FC62527D30AC8B3FA91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
X-Plane 11 Installer.exe

File Explorer

X-Plane 11 Installer.exe

.exe 31.6MB

X-Plane 11 Installer.exe

IMPHASH 5cc92875f98ee2c3d6eea0a97bf9bbef
SHA256 1c669986b2c92eb1de7b664f5a7a5062c40b94c1a947a35b1648218333f6ffdd
MD5 4b0646e24b11e4099c36b0659f16abd3
SHA1 56f05b61da12173b9735d30ef9193c0b880ab0b8
SHA512 fe63623da48448f9246bff2f2de8408153f6b1d91ca663fef80e20071004b82e748be12355803f5629a0ddf3e57af1897d37b9f8d814af4fdcc693d200bb5bee
SSDEEP 786432:H6ffDaCP46f/ZQIykPbruYlvl8F//YhJCnpwX1I:affD7rf/ZQUCYlvleG/S
TLSH
T1D777D03BA2E85364C4C24132A285B656F361756F3717E2F7249FC62527D30AC8B3FA91
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3634028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\design-installer\X-Plane 11 Installer.pdb

opengl32

glDisable glEnable glDepthMask glClearColor glBlendFunc glGetError glGetIntegerv glReadPixels glTexParameteri glTexSubImage2D glDrawArrays glDrawElements wglGetProcAddress glFlush glGetFloatv glGetString glViewport glBindTexture glClearDepth glDepthFunc glDrawBuffer glGetTexLevelParameteriv glIsTexture glReadBuffer glScissor glDeleteTextures glGenTextures glTexImage2D glTexParameterf glAlphaFunc glColorMaterial glCopyTexSubImage2D glCullFace glFogi glFrontFace glHint glLightModelfv glLightModeli glPixelStorei glShadeModel glPolygonMode wglCreateContext wglDeleteContext wglMakeCurrent wglShareLists wglSwapLayerBuffers glClear

iphlpapi

GetAdaptersAddresses

user32

CloseClipboard OpenClipboard MessageBoxW GetUserObjectInformationW GetProcessWindowStation SystemParametersInfoA SetWindowLongPtrA GetWindowLongPtrA SetWindowLongA SetClipboardData SetRectEmpty ScreenToClient ClientToScreen AdjustWindowRect GetWindowRect GetClientRect EndPaint CreateIconIndirect BeginPaint GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetDC ReleaseDC ShowCursor SetCursor LoadCursorA GetWindowLongA DestroyIcon ToUnicode GetKeyboardState SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExA RegisterClassExA DefWindowProcA UnregisterDeviceNotification RegisterDeviceNotificationA GetKeyState SendMessageA EnumDisplayMonitors GetMonitorInfoA EnumDisplaySettingsA ChangeDisplaySettingsExA UnregisterClassA SetProcessDPIAware TranslateMessage DispatchMessageA PeekMessageA GetDoubleClickTime MsgWaitForMultipleObjects MessageBoxA MessageBeep

advapi32

RegCloseKey RegQueryValueExA ReportEventW RegisterEventSourceW DeregisterEventSource RegOpenKeyExA

ws2_32

recv select send setsockopt shutdown socket ntohs WSAStartup WSACleanup WSAGetLastError WSAIoctl getsockopt getaddrinfo freeaddrinfo ntohl listen htons gethostname recvfrom sendto WSASetLastError getsockname getpeername ioctlsocket connect closesocket bind accept __WSAFDIsSet

gdi32

CreateBitmap DeleteObject GetStockObject ChoosePixelFormat SetPixelFormat CreateDIBSection

wldap32

ord301 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143 ord200

normaliz

IdnToAscii

kernel32

GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetACP SetConsoleMode ReadConsoleInputA GetConsoleMode SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread EnumSystemLocalesW GetDriveTypeW GetModuleHandleExW ExitProcess LoadLibraryExW InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead ResetEvent SystemTimeToTzSpecificLocalTime FlushFileBuffers SetEvent GetTimeZoneInformation SetEnvironmentVariableA SetEnvironmentVariableW GetCurrentDirectoryW GetFullPathNameW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree CreateEventW InitializeCriticalSectionAndSpinCount DecodePointer EncodePointer GetStringTypeW SetStdHandle OpenSemaphoreA SearchPathA HeapReAlloc HeapFree HeapAlloc GetModuleFileNameA FindNextFileA FindFirstFileA GetVersion GetLocalTime GetEnvironmentVariableA HeapSize LocalAlloc FlushConsoleInputBuffer GlobalMemoryStatus LoadLibraryW GetTickCount GetCurrentProcessId SystemTimeToFileTime GetSystemTime RtlVirtualUnwind GetModuleHandleW WriteFile VerifyVersionInfoA SetEndOfFile GetSystemDirectoryA VerSetConditionMask ExpandEnvironmentStringsA FreeLibrary WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle WaitForSingleObjectEx SleepEx InitializeCriticalSectionEx GetTickCount64 FindFirstFileExA IsValidCodePage GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc SetThreadAffinityMask GetModuleFileNameW GetCurrentThread GetModuleHandleA CreateSemaphoreA GetSystemInfo TlsAlloc GetExitCodeThread ExitThread GetCurrentThreadId CreateThread Sleep WaitForSingleObject ReleaseSemaphore DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException TlsSetValue LoadLibraryA GetOEMCP GetProcAddress GetCommandLineA GlobalMemoryStatusEx GetCurrentProcess GetProcessHeap GetLogicalDriveStringsA GetDriveTypeA TlsGetValue WideCharToMultiByte MultiByteToWideChar FindResourceA FormatMessageA LocalFree SizeofResource LockResource LoadResource GetTempPathW CreateFileMappingA UnmapViewOfFile MapViewOfFile GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileSize CopyFileW DeviceIoControl SetLastError FileTimeToSystemTime CreateFileA QueryPerformanceCounter QueryPerformanceFrequency SetErrorMode CreateDirectoryW WriteConsoleW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW RemoveDirectoryW SetFileAttributesW CloseHandle GetLastError

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetFolderPathW ShellExecuteW ShellExecuteA

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

374KB

Virtual Size

17.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

26.1MB

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=34, id=241, version=40116,

count=190, id=243, version=40116,

count=42, id=242, version=40116,

count=8, id=199, version=41118,

count=20, id=259, version=24123,

count=66, id=261, version=24123,

count=41, id=260, version=24123,

count=119, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=1, id=262, version=25711,

count=26, id=259, productName=VS2015 UPD1 build 23506, version=23506,

count=556, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=12, id=257, version=25711,

count=86, id=260, version=24234,

count=2, id=206, version=65501,

count=13, id=203, version=65501,

count=385, id=1, productName=Unmarked objects,

count=12, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=99, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,