ExLoader_Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader_Installer.exe
Size 16.1MB
Sample261030-ngme3sysft
SHA256 9aafe10ad953ac74db5220afcb6cc4393ef60aad67ecdc8871416f1c234ed797
MD5 9832577b195006851fa33a572c9adeae
SHA1 99797696d47c4e8e67519ef509edff9428ef9a5a
SHA512 ef76928dff9abc39b68f275413a82fa55a290a7e3c6a628a6136aaadb1b07f51e4229de393b7ba51e9abb1f4ae58aa7b71a4f1efb3b9605a8ed5123dad5886a4
SSDEEP 393216:kJ4XMWUTZdX/nk62xkMx9+En1ZvXncyRrazU7OQpnFik1wd:k2X2tdNwYE1ZvXnvReYnyd
TLSH
T1DC07336AD6E4D891DE292473447B87C8E537B9B0B470A72EF70C904CBAB32D0F62651D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExLoader_Installer.exe

File Explorer

ExLoader_Installer.exe

.exe 16.1MB

ExLoader_Installer.exe

IMPHASH 5f5c4d3663cd5c9660ea403fe416cb2f
SHA256 9aafe10ad953ac74db5220afcb6cc4393ef60aad67ecdc8871416f1c234ed797
MD5 9832577b195006851fa33a572c9adeae
SHA1 99797696d47c4e8e67519ef509edff9428ef9a5a
SHA512 ef76928dff9abc39b68f275413a82fa55a290a7e3c6a628a6136aaadb1b07f51e4229de393b7ba51e9abb1f4ae58aa7b71a4f1efb3b9605a8ed5123dad5886a4
SSDEEP 393216:kJ4XMWUTZdX/nk62xkMx9+En1ZvXncyRrazU7OQpnFik1wd:k2X2tdNwYE1ZvXnvReYnyd
TLSH
T1DC07336AD6E4D891DE292473447B87C8E537B9B0B470A72EF70C904CBAB32D0F62651D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxzip64\Release\sfxzip.pdb

comctl32

ord17

kernel32

SetFileAttributesW GetFullPathNameA MoveFileA DeleteFileA DeleteFileW CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetTickCount WideCharToMultiByte MultiByteToWideChar GetVersionExA GlobalAlloc lstrlenA GetModuleFileNameA FindResourceA GetModuleHandleA HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess SetFileAttributesA GetNumberFormatA lstrcmpiA GetProcAddress DosDateTimeToFileTime GetDateFormatA GetTimeFormatA FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsA WaitForSingleObject SetCurrentDirectoryA Sleep GetTempPathA MoveFileExA GetModuleFileNameW SetEnvironmentVariableA GetCommandLineA LocalFileTimeToFileTime SystemTimeToFileTime IsDBCSLeadByte GetCPInfo FreeLibrary LoadLibraryA GetCurrentDirectoryA GetFileAttributesW GetFileAttributesA WriteFile SetFileTime GetStdHandle ReadFile CreateFileW SetLastError CreateFileA GetFileType SetFilePointer CloseHandle SetEndOfFile GetLastError GetLocaleInfoA

user32

LoadStringA CharToOemBuffA OemToCharBuffA CharLowerA wvsprintfA FindWindowExA GetClassNameA ReleaseDC GetDC SendMessageA wsprintfA SetDlgItemTextA EndDialog DestroyIcon SendDlgItemMessageA GetDlgItemTextA DialogBoxParamA IsWindowVisible WaitForInputIdle GetSysColor PostMessageA SetMenu SetFocus SetWindowPos LoadIconA CharToOemA OemToCharA MapWindowPoints CreateWindowExA UpdateWindow SetWindowTextA LoadCursorA RegisterClassExA SetWindowLongPtrA GetWindowLongPtrA DefWindowProcA PeekMessageA GetMessageA DispatchMessageA DestroyWindow GetClientRect CopyRect IsWindow MessageBoxA ShowWindow GetDlgItem GetWindowTextA GetSystemMetrics GetWindow GetWindowLongA SetWindowLongA CharUpperA GetWindowRect LoadBitmapA GetParent EnableWindow TranslateMessage

gdi32

GetDeviceCaps CreateCompatibleDC GetObjectA CreateCompatibleBitmap SelectObject StretchBlt DeleteObject DeleteDC

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA

shell32

ShellExecuteExA SHFileOperationA SHGetFileInfoA SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA SHChangeNotify

ole32

CreateStreamOnHGlobal OleInitialize CoCreateInstance OleUninitialize CLSIDFromString

oleaut32

VariantInit