ii-windows-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ii-windows-setup.exe
Size 7.6MB
Sample261104-3jtpha1v9k
SHA256 687d409c0c8ca25dbf07a6d29e362ea9f5ca9904f5f303691f50e57dc8719a6c
MD5 6f0ac94bfa775027e2bc6a68f5c6c826
SHA1 6a778010a4d43e0acc8524ce77e69f89d0cf035b
SHA512 975b43c66eb2b33b0edf8d461c4c35c3425213da6dba38713eca7d2d17cd44e6e177bbe997efbef6a6c3dea0d3a8751daa42b1219893e27af93af417f49e6b80
SSDEEP 98304:NHQfan7P0U7+zgjLJBpBuZNcND+YfGugR4y:NH2U7BruZNcND5Gky
TLSH
T1CB8628016F8A6899D08DCC74C34B8AA34E1130DB1A36F9BF48D652292F7E7F55F29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ii-windows-setup.exe

File Explorer

ii-windows-setup.exe

.exe 7.6MB

ii-windows-setup.exe

IMPHASH d3a23c4a9ee9832ba62d6562c0b92cc6
SHA256 687d409c0c8ca25dbf07a6d29e362ea9f5ca9904f5f303691f50e57dc8719a6c
MD5 6f0ac94bfa775027e2bc6a68f5c6c826
SHA1 6a778010a4d43e0acc8524ce77e69f89d0cf035b
SHA512 975b43c66eb2b33b0edf8d461c4c35c3425213da6dba38713eca7d2d17cd44e6e177bbe997efbef6a6c3dea0d3a8751daa42b1219893e27af93af417f49e6b80
SSDEEP 98304:NHQfan7P0U7+zgjLJBpBuZNcND+YfGugR4y:NH2U7BruZNcND5Gky
TLSH
T1CB8628016F8A6899D08DCC74C34B8AA34E1130DB1A36F9BF48D652292F7E7F55F29319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4909728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ii_windows_setup.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileW CreateMutexA CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserDefaultUILanguage GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionEx InitializeSListHead LCIDToLocaleName LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

gdi32

AddFontResourceW BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps RemoveFontResourceW SelectObject SetBkMode SetTextColor

user32

AdjustWindowRect AdjustWindowRectEx AppendMenuW ChangeDisplaySettingsExW CheckMenuItem ClientToScreen ClipCursor CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors EnumWindows FillRect FindWindowExW FindWindowW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClassNameW GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InsertMenuW InvalidateRect InvalidateRgn IsIconic IsProcessDPIAware IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MessageBoxW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageTimeoutW SendMessageW SetCapture SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect VkKeyScanW

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

ole32

CoCreateInstance CoInitializeEx CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shell32

DragFinish DragQueryFileW SHAppBarMessage SHGetKnownFolderPath SHGetStockIconInfo ShellExecuteW

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

oleaut32

GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear

shlwapi

SHCreateMemStream

advapi32

ConvertSidToStringSidW CredDeleteW EventRegister EventSetInformation EventUnregister EventWriteTransfer GetTokenInformation LookupAccountSidW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo getpeername getsockopt ioctlsocket recv select send setsockopt

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s wcscmp wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow round roundf trunc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

299KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

413B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ii-windows-setup.exe

bcryptprimitives

ntdll

kernel32

gdi32

user32

combase

ole32

comctl32

shell32

dwmapi

oleaut32

shlwapi

advapi32

imm32

rstrtmgr

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-2-0

bcrypt

ws2_32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic