YandexDisk4Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
YandexDisk4Setup.exe
Size 5.2MB
Sample261017-vbk4dsax8x
SHA256 5a47d915224d3648cad6760badba788defafde34a6158cf8188df2d9893e96d0
MD5 2f7fb4e5f0ece3ea5860dfb21aff71b3
SHA1 738c6c4a481eee932e16c5c2889d9049ef437a96
SHA512 4c48a48904de89d9f1428db42cfb98888bf87475d93966688f1d5418c777da805a428194282d6e0cdfe4be0ea5c92f388fad652840772356779ae9fd42ae0a50
SSDEEP 98304:rgW+Y7IDWvNu1DdVfwBPsWxNJNlj99LPA:Tz7IKvNul3WvBNlH
TLSH
T1FD467B067B6480E9C1BAC474C6564B67DB71FC8A4EB2978B0291737D2F336B85F2E214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YandexDisk4Setup.exe

File Explorer

YandexDisk4Setup.exe

.exe 5.2MB

YandexDisk4Setup.exe

IMPHASH d93f09bd4e1bdc8ee65e583cb40d67a1
SHA256 5a47d915224d3648cad6760badba788defafde34a6158cf8188df2d9893e96d0
MD5 2f7fb4e5f0ece3ea5860dfb21aff71b3
SHA1 738c6c4a481eee932e16c5c2889d9049ef437a96
SHA512 4c48a48904de89d9f1428db42cfb98888bf87475d93966688f1d5418c777da805a428194282d6e0cdfe4be0ea5c92f388fad652840772356779ae9fd42ae0a50
SSDEEP 98304:rgW+Y7IDWvNu1DdVfwBPsWxNJNlj99LPA:Tz7IKvNul3WvBNlH
TLSH
T1FD467B067B6480E9C1BAC474C6564B67DB71FC8A4EB2978B0291737D2F336B85F2E214
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3228020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

gdiplus

GdipCreateFromHDC GdipCreateSolidFill GdipDeleteBrush GdipDeleteGraphics GdipFillRectangleI GdiplusShutdown GdiplusStartup

advapi32

CheckTokenMembership CreateWellKnownSid CredDeleteW CredFree CredReadW CredWriteW CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEnumProvidersW CryptExportKey CryptGetProvParam CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeregisterEventSource DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

user32

AdjustWindowRectEx BeginPaint CallWindowProcW CharNextW ClientToScreen CreateAcceleratorTableW CreateDialogIndirectParamW CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect GetClassInfoExW GetClassLongW GetClassNameW GetClientRect GetDC GetDesktopWindow GetDlgItem GetFocus GetMenu GetMessageW GetMonitorInfoW GetParent GetProcessWindowStation GetSysColor GetSystemMetrics GetUserObjectInformationW GetWindow GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect InvalidateRgn IsChild IsWindow LoadCursorW LoadImageW MapWindowPoints MessageBoxW MonitorFromWindow MoveWindow PeekMessageW PostMessageW PostQuitMessage RedrawWindow RegisterClassExW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetClassLongW SetFocus SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TranslateMessage UnregisterClassW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CompareFileTime CompareStringEx CompareStringW ConvertFiberToThread ConvertThreadToFiber CreateDirectoryW CreateEventW CreateFiber CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateWaitableTimerW DecodePointer DeleteCriticalSection DeleteFiber DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalDriveStringsW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTime GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetVersionExW GetVolumeInformationW GlobalAlloc GlobalFree GlobalLock GlobalReAlloc GlobalUnlock HeapAlloc HeapDestroy HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree MoveFileExW MulDiv MultiByteToWideChar OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadConsoleA ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetDefaultDllDirectories SetDllDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetSearchPathMode SetStdHandle SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SleepConditionVariableSRW SleepEx SwitchToFiber SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile lstrcmpW lstrcmpiW lstrlenW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetObjectW GetStockObject SelectObject SetBkMode SetTextColor SetViewportOrgEx

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CreateStreamOnHGlobal OleInitialize OleLockRunning OleUninitialize StringFromGUID2

oleaut32

LoadRegTypeLi LoadTypeLi OleCreateFontIndirect SysAllocString SysAllocStringLen SysFreeString SysStringLen VarUI4FromStr VariantClear VariantInit

comctl32

InitCommonControlsEx

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

msi

ord8 ord32 ord92 ord118 ord159 ord160

shlwapi

PathAppendW

iphlpapi

if_nametoindex

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenStore CertOpenSystemStoreA CertOpenSystemStoreW

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

115KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

12B

Characteristics

Name

.tls

Size

512B

Virtual Size

369B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

YandexDisk4Setup.exe

ws2_32

gdiplus

advapi32

user32

kernel32

gdi32

shell32

ole32

oleaut32

comctl32

bcrypt

msi

shlwapi

iphlpapi

crypt32

generic