GameInstallerSetup-a2865349[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GameInstallerSetup-a2865349.exe
Size 8.6MB
Sample260925-vx44dssbkg
SHA256 cb870e6c4e91ceadf8401d96b460c4662d4a9a473ca46ba4eafea37d26d74755
MD5 769019089277d03abd1a44218962eb8a
SHA1 ef4757a26909677fd08370cbb49f3fe749ef47fb
SHA512 d287bae238999e7b65b5d07e006c20a91c3819e2f8d3302dccd3159ee80e4707c1aafab55cbf436d2459e4bc07a233b5794c98addc9215f82daf500956662c7d
SSDEEP 196608:TNfKa7tfOb1JCF1TesQ2EsL4fAJS3l4DSnBMLXKIXXdJv3ZA:7fnPTeHjsMfAJS3E5tJv3a
TLSH
T13D9633CF411611A2E645C2F4658134EF9B0EAC31A691556AFFF7F0C12AF23F16B812A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

GameInstallerSetup-a2865349.exe

.exe 8.6MB
out.upx

.exe 21.2MB

GameInstallerSetup-a2865349.exe

SHA256 cb870e6c4e91ceadf8401d96b460c4662d4a9a473ca46ba4eafea37d26d74755
MD5 769019089277d03abd1a44218962eb8a
SHA1 ef4757a26909677fd08370cbb49f3fe749ef47fb
SHA512 d287bae238999e7b65b5d07e006c20a91c3819e2f8d3302dccd3159ee80e4707c1aafab55cbf436d2459e4bc07a233b5794c98addc9215f82daf500956662c7d
SSDEEP 196608:TNfKa7tfOb1JCF1TesQ2EsL4fAJS3l4DSnBMLXKIXXdJv3ZA:7fnPTeHjsMfAJS3E5tJv3a
TLSH
T13D9633CF411611A2E645C2F4658134EF9B0EAC31A691556AFFF7F0C12AF23F16B812A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

75:d9:91:fb:ba:95:85:0e:22:40:39:5c:05:ec:fc:68:e0:d0:cd:60:fb:be:c7:10:a6:3d:3b:59:04:21:d8:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Yaroslavski Anton Andreevich IP,O=Yaroslavski Anton Andreevich IP,L=Petrozavodsk,ST=Republic of Karelia,C=RU,1.2.840.113549.1.9.1=#0c1666756e646f726167616d65734079616e6465782e7275

Chains

Jul 27, 2026

CN=Yaroslavski Anton Andreevich IP,O=Yaroslavski Anton Andreevich IP,L=Petrozavodsk,ST=Republic of Karelia,C=RU,1.2.840.113549.1.9.1=#0c1666756e646f726167616d65734079616e6465782e7275

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Yaroslavski Anton Andreevich IP,O=Yaroslavski Anton Andreevich IP,L=Petrozavodsk,ST=Republic of Karelia,C=RU,1.2.840.113549.1.9.1=#0c1666756e646f726167616d65734079616e6465782e7275

Serial Number

ba:96:bc:01:54:7b:82:83:73:22:6d

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 9, 2026 - Jul 10, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

22439280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

out.upx

SHA256 08debeed0cd9c8309b6e3acd4a75790f087b5d7bb616415e296bc7fa63e994f9
MD5 54c46ab76560089e47d38a31cb03892a
SHA1 325b340fab1cfefb814761a51c738758b75bfe31
SHA512 8552f1a4e8dc8234e08fd1a57e06427b14f29fb2ba13fac0feb77c691e49d7dc48d4d323c7978daa0396f1359f9c3eea7253d4cea095ecea16cc2a60525f049d
SSDEEP 393216:7mBEecSdBPFwt50tm7Gg/uTRwlwNB43TKDwfuDVXJsv6tWKFdu9CGUhhz:7HPAeeoUfz
TLSH
T198278C5BB2A501A8C476C07CCA93C217EB71781657F156DF266596EA1F33BF02A3BB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13802176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

13.5MB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

463KB

Virtual Size

561KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

632KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

GameInstallerSetup-a2865349.exe

generic

out.upx

generic