t9_mod_manager_installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
t9_mod_manager_installer.exe
Size 37.5MB
Sample260919-ysbstsbe96
SHA256 4930707269d02fd5654170c2c01a12c33ccbf38687bfae501310ab353209f856
MD5 6f2c2fe12680a3945d1f5c10ce2391a8
SHA1 0959f6ad7b3cefb20ce82f350cd1ed9ac2e6b124
SHA512 265ab04f8ca8b40cf6ca0f39bbaa55d6151735e669b30cc66eba000b2fcdc4be51e1f14a987f5a9ce332431d8c090f751092037d5f38f9996ef95d5d3d911e48
SSDEEP 786432:9skQI04pHo2HPqhb5/5T7kUEKRl2V+30a1t24mGiBg8dfzBP0ExR9eXPSqSb/mM:CkXFo/nHkUEKf+A0aD2TNp9z9TEP3M
TLSH
T1C8873354F264B3EED9AF493745895AA2D3B37C141721628FB281C3683D722D2ED7E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
t9_mod_manager_installer.exe

File Explorer

t9_mod_manager_installer.exe

.exe 37.5MB

t9_mod_manager_installer.exe

IMPHASH 38b15e6eeaeb2c79e3e3cbbc98577a40
SHA256 4930707269d02fd5654170c2c01a12c33ccbf38687bfae501310ab353209f856
MD5 6f2c2fe12680a3945d1f5c10ce2391a8
SHA1 0959f6ad7b3cefb20ce82f350cd1ed9ac2e6b124
SHA512 265ab04f8ca8b40cf6ca0f39bbaa55d6151735e669b30cc66eba000b2fcdc4be51e1f14a987f5a9ce332431d8c090f751092037d5f38f9996ef95d5d3d911e48
SSDEEP 786432:9skQI04pHo2HPqhb5/5T7kUEKRl2V+30a1t24mGiBg8dfzBP0ExR9eXPSqSb/mM:CkXFo/nHkUEKf+A0aD2TNp9z9TEP3M
TLSH
T1C8873354F264B3EED9AF493745895AA2D3B37C141721628FB281C3683D722D2ED7E702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cabinet

ord23 ord22 ord20

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

shell32

SHCreateDirectoryExW SHFileOperationW SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateSolidBrush DeleteObject SetBkColor SetBkMode SetTextColor DeleteDC CreateFontW

user32

ScreenToClient SendMessageW GetSystemMetrics SetWindowTextW ShowWindow DispatchMessageW SetTimer IsDialogMessageW RegisterClassW TrackMouseEvent FillRect LoadIconW LoadCursorW MessageBoxW GetClientRect DrawTextW KillTimer PostQuitMessage PtInRect InvalidateRect BeginPaint EndPaint GetWindowTextW CreateWindowExW PostMessageW DefWindowProcW TranslateMessage GetMessageW SetCursor

advapi32

RegDeleteKeyW RegOpenKeyExW RegSetValueExW RegCloseKey RegQueryValueExW RegCreateKeyExW

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetProcessHeap HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc HeapFree GetFileType SetStdHandle HeapSize WriteConsoleW SetEndOfFile ReadFile FindFirstFileW GetFileSizeEx EnterCriticalSection FindNextFileW WriteFile RemoveDirectoryW SetFileTime GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess MultiByteToWideChar Sleep LocalFileTimeToFileTime GetLastError DeleteFileW CloseHandle CreateThread SetFilePointerEx LocalFree MoveFileExW CreateProcessW CopyFileW WideCharToMultiByte DosDateTimeToFileTime InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStdHandle RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW RtlUnwind

Name

.text

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

t9_mod_manager_installer.exe

cabinet

ole32

shell32

gdi32

user32

advapi32

kernel32

generic