netstumblerinstaller_0_4_0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
netstumblerinstaller_0_4_0.exe
Size 1.3MB
Sample261023-hexv5swzb1
SHA256 f3caa479809e3fa7cf4e71e75c63075ec53bc69343500b178edce4b9e3c6f384
MD5 86e7586e4e45444f23ef2b71e2a93bfb
SHA1 f61b0f2f6b59c46a59984a316c34282e3c936a8a
SHA512 01980eb9c871506f7ef3db721275053fbf859b52656939df3d8a2efe44b7ea3d230cd6e54fb18f9d325bc0063ced6e0918099fc0682913aefcda6f80baa050d8
SSDEEP 24576:kC9g4JTxVha/fH2t/dt3lvzcxPXdZ4VpwkAXT1Tcw0P2N9H0/:qUVsf2vtVvzcxX4wkApwwC2N9H0/
TLSH
T1AE553324F9D09E97C6E03473D978D07BD26A4906D6446B5BA2C90FBBBDEB7CA1100F18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
netstumblerinstaller_0_4_0.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

File Explorer

netstumblerinstaller_0_4_0.exe

.exe 1.3MB
$PLUGINSDIR/modern-header.bmp

25KB

netstumblerinstaller_0_4_0.exe

IMPHASH dae718ca7c0da2949ad685c2d593ec7a
SHA256 f3caa479809e3fa7cf4e71e75c63075ec53bc69343500b178edce4b9e3c6f384
MD5 86e7586e4e45444f23ef2b71e2a93bfb
SHA1 f61b0f2f6b59c46a59984a316c34282e3c936a8a
SHA512 01980eb9c871506f7ef3db721275053fbf859b52656939df3d8a2efe44b7ea3d230cd6e54fb18f9d325bc0063ced6e0918099fc0682913aefcda6f80baa050d8
SSDEEP 24576:kC9g4JTxVha/fH2t/dt3lvzcxPXdZ4VpwkAXT1Tcw0P2N9H0/:qUVsf2vtVvzcxX4wkApwwC2N9H0/
TLSH
T1AE553324F9D09E97C6E03473D978D07BD26A4906D6446B5BA2C90FBBBDEB7CA1100F18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

16264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

kernel32

FindNextFileA DeleteFileA FindFirstFileA CloseHandle SetFileTime GetFileAttributesA CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount CopyFileA ExitProcess lstrcpynA GetCommandLineA lstrcmpiA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GetVersion GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA MulDiv FindClose SetFilePointer ReadFile WriteFile GetPrivateProfileStringA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree WritePrivateProfileStringA WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA

user32

CharNextA DialogBoxParamA GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA PostQuitMessage InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ExitWindowsEx

gdi32

GetDeviceCaps CreateFontIndirectA DeleteObject CreateBrushIndirect CreateFontA SetBkMode SetTextColor SetBkColor SelectObject

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegDeleteKeyA RegOpenKeyExA RegDeleteValueA RegCreateKeyA RegCloseKey

shell32

ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHFileOperationA

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA