61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07

Sharing

Copy URL Twitter E-mail

General

Target
61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07
Size 4.8MB
Sample261011-p14ddaax5p
SHA256 61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07
MD5 31bab07f8505161af6d7bf2bd7af79ea
SHA1 bddacef12e4eacca302cad5085e6a8a79f98f187
SHA512 519e895b6ae8604fca361ab32736eb0d31feb769691808a9c6c88e16a7b5e2ad81bbc5c45462dfbe11cd31f3f0f27360a631652c9e58024b096506edf81388a8
SSDEEP 98304:5gHlly95UKqut+DmtbqqSfjfLA79NxRjcKPhQ:GQEuJqqSfjfsxZcKpQ
TLSH
T12636010AFF8280B1E8C6093851EB877F8E356D14877599D39FA1B96E8C315C1963F398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07

.exe 4.8MB

61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07

IMPHASH ce01e0331d490a8fa9043286fd275465
SHA256 61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07
MD5 31bab07f8505161af6d7bf2bd7af79ea
SHA1 bddacef12e4eacca302cad5085e6a8a79f98f187
SHA512 519e895b6ae8604fca361ab32736eb0d31feb769691808a9c6c88e16a7b5e2ad81bbc5c45462dfbe11cd31f3f0f27360a631652c9e58024b096506edf81388a8
SSDEEP 98304:5gHlly95UKqut+DmtbqqSfjfLA79NxRjcKPhQ:GQEuJqqSfjfsxZcKpQ
TLSH
T12636010AFF8280B1E8C6093851EB877F8E356D14877599D39FA1B96E8C315C1963F398
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

Major OS version

Entry point

1528253

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\source\repos\94gaYR3JP4OwftuYcu37_(channelcode)\Release\73ucYutfwO4PJ3RYag49_(channelcode).pdb

shlwapi

PathStripPathW

kernel32

GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FreeLibrary GetProcAddress LoadLibraryA FormatMessageA GetStdHandle GetFileType WriteFile GetModuleHandleW GetEnvironmentVariableW VirtualFree GetModuleHandleExW GetACP GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryW FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA DeleteCriticalSection HeapAlloc SetEndOfFile HeapSize GetTimeZoneInformation GetProcessHeap GetStringTypeW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError lstrcpyW WideCharToMultiByte DecodePointer FindResourceW LoadResource CloseHandle DeleteFileW LockResource lstrcatW GetLastError FormatMessageW MultiByteToWideChar HeapFree FileTimeToSystemTime SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA SystemTimeToTzSpecificLocalTime GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetFullPathNameW GetCurrentDirectoryW SetStdHandle FlushFileBuffers HeapReAlloc LCMapStringW CompareStringW SetFilePointerEx GetFileSizeEx GetConsoleCP SetFileAttributesW CreateMutexW GetTempPathW GetModuleFileNameW SizeofResource CreateDirectoryW WriteConsoleW ReadConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException EncodePointer LoadLibraryExW ExitProcess SetConsoleCtrlHandler ReadFile CreateFileW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe

user32

MessageBoxW GetProcessWindowStation GetUserObjectInformationW FindWindowW

advapi32

CryptGetProvParam RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetUserKey CryptExportKey CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt DeregisterEventSource

shell32

ShellExecuteW

ws2_32

closesocket send recv WSASetLastError getservbyname getservbyport gethostbyaddr inet_ntoa gethostbyname htonl WSAGetLastError WSACleanup WSAStartup select ntohs getsockopt ioctlsocket connect setsockopt socket shutdown inet_addr htons

crypt32

CertEnumCertificatesInStore CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore

Sharing

General

Malware Config

Signatures

File Explorer

61ae1e4acb1159cff122a95191d9b63c76c8ffb3078e187f1cbad5c85bbd4f07

shlwapi

kernel32

user32

advapi32

shell32

ws2_32

crypt32

generic