meetily-x64-setup[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
meetily-x64-setup.7z
Size 72.3MB
Sample261012-1t935a1xes
SHA256 ea7bb5a992e96d74ddbe091361497149476b0d923e7b8649c3ac7b435115741f
MD5 9bd61a96792f266d52e23a30a393aab6
SHA1 35bf3e580c1f4cf246a04ff0edfff5013122ebf6
SHA512 df479115c11da9fd9e76f35cb691e84a85b7929446352ac03a09d34f0b5d5a398ed2a19efc9664e3bc1e0c4498535465ccf986690c8d2685af90ab0123b91986
SSDEEP 1572864:Tf+SbqnKKVQyJv1mXBceelc4aCY0XbRSJIYl8GklszrGDmEPLrtFXMeKyBto:6kgeyv1WXOXYKhGGiEPXtBMejE
TLSH
T181F7339BACA4CDCACE5AD9626C7F2A3C51D4322542AD0C355317CEB8D2F8FDC951A780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/meetily-x64-setup.exe

File Explorer

meetily-x64-setup.7z

.7z 72.3MB
meetily-x64-setup.exe

.exe 83.1MB

meetily-x64-setup.7z

SHA256 ea7bb5a992e96d74ddbe091361497149476b0d923e7b8649c3ac7b435115741f
MD5 9bd61a96792f266d52e23a30a393aab6
SHA1 35bf3e580c1f4cf246a04ff0edfff5013122ebf6
SHA512 df479115c11da9fd9e76f35cb691e84a85b7929446352ac03a09d34f0b5d5a398ed2a19efc9664e3bc1e0c4498535465ccf986690c8d2685af90ab0123b91986
SSDEEP 1572864:Tf+SbqnKKVQyJv1mXBceelc4aCY0XbRSJIYl8GklszrGDmEPLrtFXMeKyBto:6kgeyv1WXOXYKhGGiEPXtBMejE
TLSH
T181F7339BACA4CDCACE5AD9626C7F2A3C51D4322542AD0C355317CEB8D2F8FDC951A780
MD5 SHA1 SHA512 SSDEEP TLSH

meetily-x64-setup.exe

IMPHASH 093a6cd038fd14a54e7d359b46cb8dab
SHA256 7b68565b58a6698fe90e4dabf2b9323bdb944a7aeb7a7e15bc346ab64db1ec0b
MD5 3959b325e05f3fa1002445067238ae53
SHA1 330b2afeae73d600e380c4694b8c04a10c083c4c
SHA512 a3c66e455bfc2ec3d77bfc2370a6e006e35c7574bde88a970c45508b57d714de34237b1aaa14ba5f0e7a582e0df784104c187cbc28cdcfb5cd8e79bab2a0b683
SSDEEP 1572864:y++HO1ogV4egZ6t5K8RIXGKXuDgEyIUeSLAsrqxhps8Fsaq9L:yJzgVGI7K+byIY3exh+8FsLp
TLSH
T1BD182301BB5B5569D05AC874D2074A534F2270EB123AE8BF51E941683F9B3F48F3E35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6120496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Updater.pdb

kernel32

SetFileTime GetModuleHandleW VirtualProtect LoadLibraryExA FormatMessageW GetDiskFreeSpaceExW GetLastError GetTickCount64 GetConsoleWindow LoadLibraryA HeapAlloc HeapFree GetProcessHeap FreeConsole GetConsoleMode GetConsoleOutputCP Sleep DeleteFileW SetLastError WriteConsoleW GetModuleFileNameW LoadLibraryExW GetProcAddress CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW HeapReAlloc GetSystemTimePreciseAsFileTime GetTempPathW FindClose GlobalLock SetHandleInformation SetFileInformationByHandle GetFileInformationByHandleEx GetPhysicallyInstalledSystemMemory SetFileCompletionNotificationModes GlobalUnlock GetFileInformationByHandle GetModuleHandleA WriteFileEx ReadFileEx CreateFileMappingW MapViewOfFile CancelIo GetSystemInfo GetOverlappedResult GetStdHandle ReadFile GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetFilePointerEx CreateIoCompletionPort FindNextFileW PostQueuedCompletionStatus GlobalSize GlobalAlloc GlobalFree GetSystemTimeAsFileTime FreeLibrary GetQueuedCompletionStatusEx DuplicateHandle SetThreadErrorMode CloseHandle GetFinalPathNameByHandleW UnmapViewOfFile SetUnhandledExceptionFilter InitializeSListHead AddVectoredExceptionHandler GetCurrentProcess SetWaitableTimer CreateWaitableTimerExW Process32Next Process32First CreateToolhelp32Snapshot SwitchToThread GetCurrentThreadId GetCurrentThread WideCharToMultiByte GetUserPreferredUILanguages RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency CreateThread SleepEx QueryPerformanceCounter ExitProcess CreateEventW CompareStringOrdinal CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW WaitForMultipleObjects GetExitCodeProcess CreateEventA RemoveVectoredExceptionHandler SetThreadStackGuarantee

advapi32

ImpersonateAnonymousToken RevertToSelf GetTokenInformation RegCloseKey RegEnumKeyExW RegQueryValueExW SystemFunction036 RegOpenKeyExW OpenProcessToken

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile

ws2_32

WSAIoctl WSASocketW ioctlsocket connect getsockopt getsockname WSAGetLastError shutdown bind closesocket getpeername WSAStartup WSACleanup getaddrinfo freeaddrinfo send setsockopt recv WSASend

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertDuplicateStore

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC DestroyIcon CreateIcon MapVirtualKeyW SetWindowLongW GetCursorPos SendInput CloseClipboard GetWindowLongPtrW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW RegisterRawInputDevices SetWindowLongPtrW ShowWindow MessageBoxW GetSystemMetrics RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW TrackPopupMenu SetMenuDefaultItem EnableMenuItem PostMessageW GetForegroundWindow GetActiveWindow EmptyClipboard SetWindowPos GetSystemMenu ClientToScreen IsWindowVisible SetClipboardData LoadCursorW SetCursor ReleaseCapture ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetMonitorInfoW MonitorFromWindow DefWindowProcW GetRawInputData GetWindowLongW GetMenu AdjustWindowRectEx MapVirtualKeyExW GetKeyboardState GetKeyboardLayout ToUnicodeEx TrackMouseEvent ScreenToClient GetTouchInputInfo MonitorFromRect CloseTouchInputHandle GetWindowRect SetCapture SystemParametersInfoA GetClipCursor ClipCursor ShowCursor GetKeyState IsIconic SetForegroundWindow SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware DestroyCursor RegisterWindowMessageA InvalidateRgn SendMessageW VkKeyScanW

shell32

ShellExecuteW DragQueryFileW DragFinish

gdi32

SelectObject CreateDIBSection SetPixelFormat DeleteDC GetDeviceCaps CreateRectRgn DescribePixelFormat BitBlt GetPixelFormat ChoosePixelFormat SwapBuffers DeleteObject CreateCompatibleDC

opengl32

wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglCreateContext

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

memset memcmp __CxxFrameHandler3 _CxxThrowException __C_specific_handler memcpy __current_exception __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

fmod pow ceil tan round sin cos exp2f exp2 truncf ceilf roundf _hypotf powf tanf fmax fminf acos floor acosf fmaxf fmodf sinf floorf trunc __setusermatherr cosf fmaf atan2

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit strerror _set_app_type _register_thread_local_exe_atexit_callback _crt_atexit __p___argv __p___argc _configure_narrow_argv _exit terminate exit _initterm_e _initterm _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode