appnstaller[.]5[.]3[.]14[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
appnstaller.5.3.14.exe
Size 31.8MB
Sample261009-tekflaca24
SHA256 1fedb2020d45fe0c9f806896481c2c2d59a9b5b95714923430eb6e0c58107d96
MD5 76534fc397889c303882838d41ecddac
SHA1 bc0f920048267eb2c318685424f911e230a7d0f5
SHA512 84a5118d10735544c8e330ed674945aa230238d1d8319de49ed77dad3ff2c81466266e92e0f5507b1d3064286f62d70453b9c01877ba437794f4c1b15aeef889
SSDEEP 98304:5rLI1oWL50E5AF3EJeqliffMeDK/9m2g1iQfMJPPK6nAwTYkrhRqlNvREqE6rn0X:W50kACE2+fMeDKVm2G5fMJPPz
TLSH
T184771857F7418DD3F855523488D68BD063B2FCB58A61872722A8B339BFFE2881ED1494
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
appnstaller.5.3.14.exe

File Explorer

appnstaller.5.3.14.exe

.exe 31.8MB

appnstaller.5.3.14.exe

IMPHASH 26f935865eba0923e01e5dc5bec4d5a0
SHA256 1fedb2020d45fe0c9f806896481c2c2d59a9b5b95714923430eb6e0c58107d96
MD5 76534fc397889c303882838d41ecddac
SHA1 bc0f920048267eb2c318685424f911e230a7d0f5
SHA512 84a5118d10735544c8e330ed674945aa230238d1d8319de49ed77dad3ff2c81466266e92e0f5507b1d3064286f62d70453b9c01877ba437794f4c1b15aeef889
SSDEEP 98304:5rLI1oWL50E5AF3EJeqliffMeDK/9m2g1iQfMJPPK6nAwTYkrhRqlNvREqE6rn0X:W50kACE2+fMeDKVm2G5fMJPPz
TLSH
T184771857F7418DD3F855523488D68BD063B2FCB58A61872722A8B339BFFE2881ED1494
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipDisposeImage GdipCreateFromHDC GdipAlloc GdiplusStartup GdipDrawImageRectI GdipDeleteGraphics GdipCreateBitmapFromStream GdiplusShutdown GdipFree GdipCloneImage

kernel32

EnterCriticalSection DeleteCriticalSection TlsGetValue QueryPerformanceCounter WaitForSingleObject GetTickCount TlsSetValue WideCharToMultiByte Sleep QueryPerformanceFrequency TlsAlloc CloseHandle TlsFree CreateThread MultiByteToWideChar lstrlenW OutputDebugStringA CreateFileW GetLocalTime GetCurrentThreadId WriteFile GetLastError CreateMutexW OpenProcess GetExitCodeProcess K32GetProcessImageFileNameW K32EnumProcesses GetModuleHandleW GetCurrentProcessId K32EnumProcessModules K32GetModuleBaseNameA TerminateProcess MapViewOfFile UnmapViewOfFile FreeLibrary HeapAlloc SetDllDirectoryW HeapFree SetEvent GetProcessHeap LoadLibraryW TerminateThread GetProcAddress GetExitCodeThread CreateEventW OpenFileMappingW OpenEventW FindResourceW LoadResource CreateProcessW LeaveCriticalSection GlobalAlloc SizeofResource GlobalUnlock GlobalFree CreateFileMappingW LockResource GetFullPathNameW PeekNamedPipe GetFileType GetFileInformationByHandle HeapSize GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage RtlUnwindEx GetStartupInfoW GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleExW ExitProcess SetLastError RaiseException RtlPcToFileHeader GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineA FileTimeToSystemTime GetDriveTypeW FindFirstFileExW FindClose FileTimeToLocalFileTime LoadLibraryExW ExitThread DecodePointer EncodePointer GetCurrentDirectoryW GetModuleFileNameA InitializeCriticalSection GetConsoleMode GetConsoleCP SetFilePointerEx HeapReAlloc GetFileAttributesExW SetStdHandle GetTimeZoneInformation SetEndOfFile ReadFile ReadConsoleW WriteConsoleW FlushFileBuffers SetEnvironmentVariableW GlobalLock SetEnvironmentVariableA GetSystemTimeAsFileTime GetEnvironmentStringsW LCMapStringW CompareStringW OutputDebugStringW VirtualAlloc

user32

EndPaint SetWindowRgn TrackMouseEvent LoadCursorW FindWindowW BeginPaint SetLayeredWindowAttributes CloseWindow UpdateWindow SendInput SystemParametersInfoW wsprintfW UnregisterClassW DestroyWindow PeekMessageW ShowWindow CreateWindowExW RegisterClassExW DisplayConfigGetDeviceInfo DefWindowProcW SetTimer KillTimer PostMessageW GetMessageW CallNextHookEx GetIconInfo TranslateMessage GetCursorInfo PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx DispatchMessageW EnumDisplayMonitors EnumDisplayDevicesW ChangeDisplaySettingsExW QueryDisplayConfig GetSystemMetrics GetDisplayConfigBufferSizes GetMonitorInfoW EnumDisplaySettingsW PostQuitMessage

gdi32

CreateSolidBrush DeleteDC GetDIBits DeleteObject CreateCompatibleDC CreateRoundRectRgn

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ShellExecuteW

ole32

CoInitialize CoCreateInstance PropVariantClear CoTaskMemFree CoUninitialize CreateStreamOnHGlobal

wlanapi

WlanEnumInterfaces WlanFreeMemory WlanCloseHandle WlanOpenHandle

Name

.text

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31.3MB

Virtual Size

31.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

appnstaller.5.3.14.exe

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

wlanapi

generic