2eef62668e8a3ef3124b823f990809c8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2eef62668e8a3ef3124b823f990809c8.exe
Size 2.8MB
Sample261114-d65b3sct2y
SHA256 46080f459577529059ace98473cfd80693744444c8ef828ff5f7377eb10906a0
MD5 2eef62668e8a3ef3124b823f990809c8
SHA1 9f920216394dd90e679fc00760ac1b1d7f1bf74d
SHA512 10b45bae7737964a295b8f9fd6971e9b0760cbae3fe9e05ba18481f993d4f55ab0dcaf03cab77bed96c5de9fa5d5efada06c1edff0fc4baa1228286e14b1e05c
SSDEEP 49152:mBeVODQk/79BnSuoI09+HhyFGwf1HmznWRmxel/+q4Dp:MeVORZEHI0QHgswfBoesq4Dp
TLSH
T100D5333F8244DE5DCB51753C0B66E2FAF6161C0724016F92D26BBAFA8F5415BEE242C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2eef62668e8a3ef3124b823f990809c8.exe
unpack001/Torrent (1).exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

2eef62668e8a3ef3124b823f990809c8.exe

.exe 2.8MB
Torrent (1).exe

.exe 1.5MB
Torrent (1).js

.js 67KB
Torrent (1).vbs

.vbs 951KB
Torrent (2).js

.js 913KB
Torrent (3).JS

.js 481KB
Torrent+ Installer.exe

.exe 794KB

2eef62668e8a3ef3124b823f990809c8.exe

IMPHASH ab6770b0a8635b9d92a5838920cfe770
SHA256 46080f459577529059ace98473cfd80693744444c8ef828ff5f7377eb10906a0
MD5 2eef62668e8a3ef3124b823f990809c8
SHA1 9f920216394dd90e679fc00760ac1b1d7f1bf74d
SHA512 10b45bae7737964a295b8f9fd6971e9b0760cbae3fe9e05ba18481f993d4f55ab0dcaf03cab77bed96c5de9fa5d5efada06c1edff0fc4baa1228286e14b1e05c
SSDEEP 49152:mBeVODQk/79BnSuoI09+HhyFGwf1HmznWRmxel/+q4Dp:MeVORZEHI0QHgswfBoesq4Dp
TLSH
T100D5333F8244DE5DCB51753C0B66E2FAF6161C0724016F92D26BBAFA8F5415BEE242C8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA CreateDirectoryA lstrcmpiA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject ExitProcess GetWindowsDirectoryA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Torrent (1).exe

IMPHASH 16ba878ce1b94deb57ae402c4a36488c
SHA256 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d
MD5 9ebc7984d684450c079c969765859ad8
SHA1 cb42fb2cc41eff4c92e82ef876b8cba3a36c6d19
SHA512 ec95ce8d03b601f2b7dc6e35cb7098e149693dc12b8824cf672bdaf2c130c37f4c29f895ddd178000313f8d373082ee37134d7e6313ad1497c4291e968b39ceb
SSDEEP 24576:KDv9SSETPi8Z/n8MLuCnAavJaY+aAQM66XvGFUtNwpoV6Xjt9vmQ:KDREji8BnBuaHvPFMNeFuwXPvmQ
TLSH
T14275339DD1488EDCD75FB3BE45EF87F13629348A15008E99F0F7B17A5B2821E9A2018C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA

kernel32

CloseHandle CopyFileA DeleteCriticalSection EnterCriticalSection GetConsoleWindow GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress InitializeCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WinExec

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fflush puts setvbuf

api-ms-win-crt-string-l1-1-0

strlen strncmp

shell32

SHGetFolderPathA

user32

ShowWindow wsprintfA

Name

.text

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Torrent+ Installer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 053b86ed48c5a1b1aa1617979a010a868e3dedfdf9555df08ea12c022b578476
MD5 681b320ed24590a910112ec048fc4d07
SHA1 78d9cdaf5c2ba167c7d5e8177db09153655e1058
SHA512 5b0f429b1b79dfcdf9e90d613b9a4713ac654cbc92667179b35a17b6a009ec0a61caf375633b487162bdf6f7c2624e99c824e17351fdac5d04547f600bd406fd
SSDEEP 12288:dVFH26FQk+k+De/3JTTKR0SkhNcp3IGx/YMC9+Xy34l1OsfzGPne:xIwcpYGJYF92y3w1O06Pne
TLSH
T18D05AE8063E4602AE3BF5BB6B4F24E1687B5F90368B9EBAD47D4505D2CE67438C00767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ba:9f:71:55:73:6b:7a:7e:18:54:1f:c9:d5:e2:ee:6c:af:e6:e8:97:3a:a6:6b:09:11:e2:26:20:e8:70:c4:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 24, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Marketplace CA G 023,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:58:29:9c:57:c4:0c:63:f0:c2:96:86:00:01:00:58:29:9c

Issuer

CN=Microsoft Marketplace CA G 023,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2026 - Sep 27, 2026

Subject

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:12:44:a2:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 28, 2011 - Mar 28, 2031

Subject

CN=Microsoft Marketplace CA G 023,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:0d:7b:1f:c6:4f:d4:4e:7b:00:00:00:00:00:57

Issuer

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 11, 2024 - Apr 11, 2029

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

731306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb

2eef62668e8a3ef3124b823f990809c8.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

Torrent (1).exe

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

shell32

user32

generic

Torrent (1).js

Torrent (1).vbs

Torrent (2).js

Torrent (3).JS

Torrent+ Installer.exe

mscoree

dotnet