www.eyqw474.com_sample.bin
- SHA256 6eade4497de1522b4afda9d0e9a377baf079f6cae8eefd40a7586bd167e47243
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appnstaller.5.3.02.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
appnstaller.5.3.02.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target www.eyqw474.com_sample.bin
- Size 3.5MB
- Sample261011-yghf8set7k
- SHA256 6eade4497de1522b4afda9d0e9a377baf079f6cae8eefd40a7586bd167e47243
- MD5 542665a9989997769cd084b6373ef568
- SHA1 f0c71de1a141d3d36118246464b894917c4db70e
- SHA512 8e57ae2644ac2b77326988cba49f24a8e5132e18a8d2f7d897878fc6c252a86fc7abfb9312e2ff0c2d82909b05aaf6bf8c37989542fa793f2ba0ca70763e3803
- SSDEEP 98304:JAUfrDHRXxtoK7cfNKtnO7mQX0WeqHl8FG1gAeYUEEWMjxg:WUfrjRhtoKg1Eel7b1gDitke
- TLSH T144F5336799FF1605F9488135CD33048C298A0B4C9EA172E9CA3BD735EFE1DA05F4DA68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/appnstaller.5.3.02.exe
File Explorer
-
www.eyqw474.com_sample.bin.zip 3.5MB
-
appnstaller.5.3.02.exe.exe 37.0MB
appnstaller.5.3.02.exe
- IMPHASH 26f935865eba0923e01e5dc5bec4d5a0
- SHA256 9848345645d4e39e23f638b0998f53b5f60e76d612539c047a00bb95378ab0b0
- MD5 1ae827feada3bda82cc335bb74c0b33b
- SHA1 856185d5f47cf6b06f9f87b16704e16361f083fb
- SHA512 4780462ea6d646c8806e2934e33b9966bad309d13b84a35ce97677683ed1ca33b1082c072575944afe6608ec953edae8c9f991dc97f3a134c9b56eeb179357f0
- SSDEEP 98304:YrLI1O0lK10ixQeMiiSFKXO0DMQEKtgUK6nAwTYkrhRqlNvREqE6rn03dl2AC:V+TMixcXO0QpeNI
- TLSH T1E187E826FE518CE7E92811325A8F4B712371BC724291671732B57329BFBF3441EDA9A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
79836
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gdiplus
GdipDisposeImage
GdipCreateFromHDC
GdipAlloc
GdiplusStartup
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdiplusShutdown
GdipFree
GdipCloneImage
kernel32
EnterCriticalSection
DeleteCriticalSection
TlsGetValue
QueryPerformanceCounter
WaitForSingleObject
GetTickCount
TlsSetValue
WideCharToMultiByte
Sleep
QueryPerformanceFrequency
TlsAlloc
CloseHandle
TlsFree
CreateThread
MultiByteToWideChar
lstrlenW
OutputDebugStringA
CreateFileW
GetLocalTime
GetCurrentThreadId
WriteFile
GetLastError
CreateMutexW
OpenProcess
GetExitCodeProcess
K32GetProcessImageFileNameW
K32EnumProcesses
GetModuleHandleW
GetCurrentProcessId
K32EnumProcessModules
K32GetModuleBaseNameA
TerminateProcess
MapViewOfFile
UnmapViewOfFile
FreeLibrary
HeapAlloc
SetDllDirectoryW
HeapFree
SetEvent
GetProcessHeap
LoadLibraryW
TerminateThread
GetProcAddress
GetExitCodeThread
CreateEventW
OpenFileMappingW
OpenEventW
FindResourceW
LoadResource
CreateProcessW
LeaveCriticalSection
GlobalAlloc
SizeofResource
GlobalUnlock
GlobalFree
CreateFileMappingW
LockResource
GetFullPathNameW
PeekNamedPipe
GetFileType
GetFileInformationByHandle
HeapSize
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlUnwindEx
GetStartupInfoW
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleExW
ExitProcess
SetLastError
RaiseException
RtlPcToFileHeader
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineA
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
LoadLibraryExW
ExitThread
DecodePointer
EncodePointer
GetCurrentDirectoryW
GetModuleFileNameA
InitializeCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointerEx
HeapReAlloc
GetFileAttributesExW
SetStdHandle
GetTimeZoneInformation
SetEndOfFile
ReadFile
ReadConsoleW
WriteConsoleW
FlushFileBuffers
SetEnvironmentVariableW
GlobalLock
SetEnvironmentVariableA
GetSystemTimeAsFileTime
GetEnvironmentStringsW
LCMapStringW
CompareStringW
OutputDebugStringW
VirtualAlloc
user32
EndPaint
SetWindowRgn
TrackMouseEvent
LoadCursorW
FindWindowW
BeginPaint
SetLayeredWindowAttributes
CloseWindow
UpdateWindow
SendInput
SystemParametersInfoW
wsprintfW
UnregisterClassW
DestroyWindow
PeekMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
DisplayConfigGetDeviceInfo
DefWindowProcW
SetTimer
KillTimer
PostMessageW
GetMessageW
CallNextHookEx
GetIconInfo
TranslateMessage
GetCursorInfo
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
DispatchMessageW
EnumDisplayMonitors
EnumDisplayDevicesW
ChangeDisplaySettingsExW
QueryDisplayConfig
GetSystemMetrics
GetDisplayConfigBufferSizes
GetMonitorInfoW
EnumDisplaySettingsW
PostQuitMessage
gdi32
CreateSolidBrush
DeleteDC
GetDIBits
DeleteObject
CreateCompatibleDC
CreateRoundRectRgn
advapi32
RegGetValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
shell32
ShellExecuteW
ole32
CoInitialize
CoCreateInstance
PropVariantClear
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
wlanapi
WlanEnumInterfaces
WlanFreeMemory
WlanCloseHandle
WlanOpenHandle
Name
.text
Size
203KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36.5MB
Virtual Size
36.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=158, version=20921,
count=36, productName=Unmarked objects (old),
count=60, id=207, version=50929,
count=156, id=206, version=50929,
count=10, id=205, version=50929,
count=1, id=189, version=30716,
count=19, id=185, version=30716,
count=225, id=1, productName=Unmarked objects,
count=9, id=211, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,