installer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
installer.exe
Size 7.8MB
Sample261024-dz9m8aeb64
SHA256 fc04ff34c6ffa4f27dcf462bf161895e40a5b46b006a691a1d8c8ce5c70283a7
MD5 1ddba281a30ccbf92cd17d07d8133dc8
SHA1 f0e4bc386a2b05b2bb9ed03b8e8904dda6418cbf
SHA512 8dfd4a22ec5bfbc4b22f8600c0d49f79b21b45fd40cf05242d9647efe542a0caf1cce48da10bac59a8b363808aef67854f766ffc9a159cb352326864f38199df
SSDEEP 196608:Y1uQM6fbOS7v76HtDu4Jok2E8/h1siMfe:YKwzpsY
TLSH
T130869E12D5FE5F39C3EE833A56B74209DF779A4D4303D26B0848BAB59C533362D4262A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
installer.exe

File Explorer

installer.exe

.exe 7.8MB

installer.exe

IMPHASH 70d57643fbdaa94feac8f96078453c9e
SHA256 fc04ff34c6ffa4f27dcf462bf161895e40a5b46b006a691a1d8c8ce5c70283a7
MD5 1ddba281a30ccbf92cd17d07d8133dc8
SHA1 f0e4bc386a2b05b2bb9ed03b8e8904dda6418cbf
SHA512 8dfd4a22ec5bfbc4b22f8600c0d49f79b21b45fd40cf05242d9647efe542a0caf1cce48da10bac59a8b363808aef67854f766ffc9a159cb352326864f38199df
SSDEEP 196608:Y1uQM6fbOS7v76HtDu4Jok2E8/h1siMfe:YKwzpsY
TLSH
T130869E12D5FE5F39C3EE833A56B74209DF779A4D4303D26B0848BAB59C533362D4262A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

21:10:8b:2a:fe:b3:47:05:43:9a:8f:60:2b:00:18:d3:40:44:0d:8a:59:96:e1:36:e0:3e:fd:e6:cf:cd:03:27

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 20, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

4244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysAllocStringLen VariantClear SysStringLen

user32

SetWindowLongPtrW GetWindowLongPtrW GetDlgItem LoadIconW SendMessageW LoadStringW CharUpperW SetWindowTextW EndDialog ShowWindow DestroyWindow PostMessageW MessageBoxW wsprintfW SetTimer KillTimer DialogBoxParamW

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

shell32

ShellExecuteExW

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP FindFirstFileExW LCMapStringW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind WriteConsoleW IsValidCodePage GetFileSize RtlCaptureContext HeapReAlloc GetCommandLineW SetCurrentDirectoryW CreateDirectoryW CreateFileW GetDriveTypeW GetFileAttributesW ReadFile SetFilePointerEx GetTempPathW CloseHandle GetLastError WaitForSingleObject GetCurrentProcessId CreateProcessW GetTickCount GetWindowsDirectoryW MoveFileW CompareFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameW LoadLibraryExW LocalFree FormatMessageW GetCurrentDirectoryW DeleteFileW RemoveDirectoryW SetFileAttributesW SetFileTime SetLastError GetCurrentThreadId GetSystemDirectoryW GetStdHandle FindClose FindFirstFileW FindNextFileW GetFileInformationByHandle FindFirstStreamW FindNextStreamW SetEndOfFile SetFilePointer WriteFile GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetModuleHandleA GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime Sleep VirtualAlloc VirtualFree IsProcessorFeaturePresent GetVersion GetModuleHandleW InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW QueryPerformanceCounter InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapAlloc RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess HeapFree

Sharing

General

Malware Config

Signatures

File Explorer

installer.exe

PE Signature issue

oleaut32

user32

advapi32

shell32

kernel32

generic