TreeSimplifier-1[.]0-beta-1-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TreeSimplifier-1.0-beta-1-setup.exe
Size 14.4MB
Sample260930-wwpsratsfz
SHA256 283d33947775fbe112708b38665b1b69d9c497d31370081104d717f1778b0032
MD5 1c178fd0e897618d9ef964e6dee32e70
SHA1 43e150b00084d6551ba05ffa1d1772d0de448605
SHA512 d5bf2a1dc981dc4794ae0c27425ca13727307714aadab4ae7372f15cb26e172ec923c4e21e97b463f1e500d35485d96fddb8b51b23a1f9615d52f73bc3773c0e
SSDEEP 393216:THoCeN9tld1qiN2taNMhry82ArIh6KG24I2ifFque6RY5nF:THoFhldUidYy8DrIwKG2NXdqueKq
TLSH
T1BFE6237F6298D52DD91EC13AC5A29A14B833B1B14B33C6EFD1E102299F079E05F7E660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TreeSimplifier-1.0-beta-1-setup.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

TreeSimplifier-1.0-beta-1-setup.exe

.exe 14.4MB

TreeSimplifier-1.0-beta-1-setup.exe

IMPHASH 1c8abb0d55065ed8370628959ce78804
SHA256 283d33947775fbe112708b38665b1b69d9c497d31370081104d717f1778b0032
MD5 1c178fd0e897618d9ef964e6dee32e70
SHA1 43e150b00084d6551ba05ffa1d1772d0de448605
SHA512 d5bf2a1dc981dc4794ae0c27425ca13727307714aadab4ae7372f15cb26e172ec923c4e21e97b463f1e500d35485d96fddb8b51b23a1f9615d52f73bc3773c0e
SSDEEP 393216:THoCeN9tld1qiN2taNMhry82ArIh6KG24I2ifFque6RY5nF:THoFhldUidYy8DrIwKG2NXdqueKq
TLSH
T1BFE6237F6298D52DD91EC13AC5A29A14B833B1B14B33C6EFD1E102299F079E05F7E660
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

Major OS version

Entry point

1037776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

RtlUnwindEx GetACP GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW CompareStringOrdinal RtlUnwind SetFilePointerEx GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

comctl32

InitCommonControls

user32

CreateWindowExW TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW SetWindowLongPtrW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW

oleaut32

SafeArrayPutElement VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid EqualSid RegQueryValueExW GetTokenInformation ConvertSidToStringSidW RegCloseKey

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

54KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

568B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TreeSimplifier-1.0-beta-1-setup.exe

kernel32

comctl32

user32

oleaut32

advapi32

generic