flow-setup-1[.]0[.]0-windows-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
flow-setup-1.0.0-windows-x64.exe
Size 24.9MB
Sample261110-zpyc4aba96
SHA256 b626a3d6196b351c67581656f85f9105706695c202bb83694f4d399fd64ad90e
MD5 8f091e3ed4ef8fa54b84ea514426703d
SHA1 392e0b2fb2582c182cc5e7791bf25a1d461dbdbb
SHA512 0886e450cd9cfb13967e0d897bbc46979f630d8b7b03e705e83c61d3133487797dc3861aef0335169d05793e4ca3ba6cc3ac58367ee65f5154a56d9b258489bd
SSDEEP 393216:UAkjL4+34JL5oKbb6CdxwZia8/B/t7fhtc++JUVZN:UbjB34DoKbbBDwj8/BG
TLSH
T13D47E153A1A250E9C237D039C74B9522FA3178190724B5FB79AC46262F77FD0AB3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
flow-setup-1.0.0-windows-x64.exe

File Explorer

flow-setup-1.0.0-windows-x64.exe

.exe 24.9MB

flow-setup-1.0.0-windows-x64.exe

IMPHASH c83289d6db06196512ed2fb079ec6d15
SHA256 b626a3d6196b351c67581656f85f9105706695c202bb83694f4d399fd64ad90e
MD5 8f091e3ed4ef8fa54b84ea514426703d
SHA1 392e0b2fb2582c182cc5e7791bf25a1d461dbdbb
SHA512 0886e450cd9cfb13967e0d897bbc46979f630d8b7b03e705e83c61d3133487797dc3861aef0335169d05793e4ca3ba6cc3ac58367ee65f5154a56d9b258489bd
SSDEEP 393216:UAkjL4+34JL5oKbb6CdxwZia8/B/t7fhtc++JUVZN:UbjB34DoKbbBDwj8/BG
TLSH
T13D47E153A1A250E9C237D039C74B9522FA3178190724B5FB79AC46262F77FD0AB3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3600384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

flow_setup.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtReadFile NtOpenFile RtlNtStatusToDosError NtWriteFile RtlGetVersion

kernel32

LoadLibraryA GetCurrentThreadId lstrlenW ReleaseSRWLockExclusive FreeEnvironmentStringsW GetEnvironmentStringsW GetUserDefaultUILanguage LCIDToLocaleName ReadFile AcquireSRWLockExclusive GetOverlappedResult CancelIo CreateEventW CreateDirectoryW CreateFileW QueryPerformanceFrequency HeapReAlloc SetThreadStackGuarantee GetCurrentThread SetWaitableTimer WakeAllConditionVariable WriteFileEx ReadFileEx GetEnvironmentVariableW SleepConditionVariableSRW CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext CreateWaitableTimerExW AddVectoredExceptionHandler GetCommandLineW SetEnvironmentVariableW CreateThread GetSystemTimeAsFileTime SwitchToThread QueryPerformanceCounter GetFinalPathNameByHandleW CopyFileExW DeleteFileW RtlPcToFileHeader CreateProcessW RaiseException FlsGetValue GetFileAttributesW EncodePointer GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime FindFirstFileExW GetFullPathNameW SetFileInformationByHandle WriteConsoleW InitializeSListHead LoadLibraryW GetConsoleOutputCP RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte ReleaseMutex FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree HeapAlloc SetUnhandledExceptionFilter SleepEx ExitProcess GetExitCodeProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetConsoleMode WaitForSingleObject GetStdHandle FindNextFileW GetDiskFreeSpaceW GetVolumePathNameW FindClose RtlUnwindEx GetTempPathW GetModuleHandleW HeapFree GetProcessHeap FreeLibrary LoadLibraryExW OutputDebugStringW GetModuleHandleA Sleep OutputDebugStringA GetSystemTimePreciseAsFileTime GetProcAddress GetSystemInfo CloseHandle LoadLibraryExA GetLastError InitializeCriticalSectionEx GetCurrentProcessId DeleteCriticalSection

user32

GetWindowTextW GetWindowTextLengthW RegisterWindowMessageA GetSystemMenu SetWindowLongW IsProcessDPIAware TrackPopupMenu AppendMenuW InsertMenuW CreatePopupMenu CreateMenu GetClipCursor DrawIconEx GetDC SetMenuItemInfoW EnableMenuItem VkKeyScanW CheckMenuItem CreateIcon DrawTextW ReleaseDC GetWindowDC OffsetRect SetWindowTextW GetMenuBarInfo ShowWindow PostQuitMessage CreateAcceleratorTableW SystemParametersInfoA ClipCursor DestroyAcceleratorTable DestroyMenu RemoveMenu GetForegroundWindow GetActiveWindow GetKeyboardState InvalidateRect SetCursorPos GetWindowRect EnumChildWindows DispatchMessageA GetMessageA GetAsyncKeyState GetKeyState FindWindowExW SetMenu GetMenuItemInfoW TranslateAcceleratorW MapWindowPoints FlashWindowEx InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW ShowCursor DestroyIcon GetIconInfo LoadImageW GetMonitorInfoW SystemParametersInfoW SetCursor LoadCursorW MapVirtualKeyExW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture ReleaseCapture FillRect ClientToScreen GetWindowLongW ScreenToClient GetKeyboardLayout GetUpdateRect ValidateRect GetRawInputData SetWindowDisplayAffinity SetWindowLongPtrW ToUnicodeEx GetMenu RegisterTouchWindow GetSystemMetrics DefWindowProcW SetPropW SetParent SetFocus MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW DestroyWindow UpdateWindow SendInput MapVirtualKeyW SetForegroundWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW DispatchMessageW TranslateMessage GetMessageW IsWindowEnabled EnableWindow MonitorFromWindow IsIconic IsWindowVisible RedrawWindow RegisterRawInputDevices SendMessageW GetCursorPos GetWindowLongPtrW GetClientRect GetWindow PostMessageW AdjustWindowRect EnumDisplayMonitors MonitorFromPoint GetParent DrawMenuBar SetWindowRgn

comctl32

SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass DefSubclassProc

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

DragQueryFileW SHGetKnownFolderPath ShellExecuteW DragFinish SHAppBarMessage SHGetStockIconInfo SHCreateItemFromParsingName

combase

CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler

advapi32

EventUnregister RegDeleteTreeW RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW EventRegister EventSetInformation RegGetValueW RegCreateKeyExW EventWriteTransfer

gdi32

GetDeviceCaps CreateCompatibleDC DeleteDC SelectObject SetTextColor SetBkMode BitBlt GetDIBits DeleteObject CreateSolidBrush CombineRgn CreateDIBSection CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

ole32

CoInitializeEx CoCreateInstance RegisterDragDrop CoUninitialize OleInitialize RevokeDragDrop

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

shlwapi

SHCreateMemStream

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-crt-math-l1-1-0

floor roundf round pow trunc __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initialize_onexit_table __p___argv _c_exit _initterm _get_initial_narrow_environment exit _initialize_narrow_environment _exit _configure_narrow_argv _register_onexit_function abort _set_app_type _seh_filter_exe _cexit terminate _initterm_e __p___argc _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh calloc malloc free