utility-inst.exe
First submission 2024-10-13 07:39:02
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 1723.02 KB (1764368 bytes) |
Compile time: | 2023-02-15 15:54:16 |
MD5: | 0d43698dffc5ee744f805a699df25c00 |
SHA1: | c914a0238381f03d2558bedd423228ba3e4e0040 |
SHA256: | de14c3b860519dc781aaee813d4fa3adc67d7653c544327f8d26d5b386564712 |
Import Hash : | e569e6f445d32ba23766ad67d1e3787f |
Sections 10 | .text .itext .data .bss .idata .didata .edata .tls .rdata .rsrc |
Directories 4 | import export resource tls |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
Virus Total: | 36/77 VT report date: 2024-10-13 01:52:56 |
Malware Type 2 | trojan downloader |
Threat Type 3 | offloader amadey yxejkz |
URLs, FQDN and IP indicators 1
PE Sections 2 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0xb39e4 | 735744 | 343a0e7ec6c87dae257270b90b9988a3ff95a078 | 43af0a9476ca224d8e8461f1e22c94da | |
.itext | 0xb5000 | 0x1688 | 6144 | 171aebbe52333ffd36593522a712b96644b565e5 | 185e04b9a1f554e31f7f848515dc890c | |
.data | 0xb7000 | 0x37a4 | 14336 | 7a25edc4b9ed265b2ce19bbb507bad1985c6793e | cab2107c933b696aa5cf0cc6c3fd3980 | |
.bss | 0xbb000 | 0x6de8 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.idata | 0xc2000 | 0xfdc | 4096 | b7d043cca31864ef4b86887de77ebb3db089c2bd | e7d1635e2624b124cfdce6c360ac21cd | |
.didata | 0xc3000 | 0x1a4 | 512 | fc7a6c0a1f7068ea13be23c825b3ea7a9f3ea676 | 8ced971d8a7705c98b173e255d8c9aa7 | |
.edata | 0xc4000 | 0x9a | 512 | f602c8394c4325ebe7c172a76ee1b74fa463888b | 8d4e1e508031afe235bf121c80fd7d5f | |
.tls | 0xc5000 | 0x18 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.rdata | 0xc6000 | 0x5d | 512 | 735078338d2c5f1b3f162ce296611076a9ddcf02 | 8f2f090acd9622c88a6a852e72f94e96 | |
.rsrc | 0xc7000 | 0x11000 | 69632 | e9c66de8c642620a11b3ee6b7a523e1e7fd7a6c1 | dc6585b5b13c096f53bc11051443b78f |
PE Resources 6
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xd4998 | 1128 | |
RT_STRING | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xd6ac4 | 676 | |
RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xd703c | 44 | |
RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xd7068 | 188 | |
RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xd7124 | 1412 | |
RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xd76a8 | 1960 |
Meta infos 9
LegalCopyright: | |
OriginalFileName: | |
FileVersion: | |
CompanyName: | |
ProductVersion: | 1.0 |
FileDescription: | UtilityInst Setup |
Translation: | 0x0000 0x04b0 |
Comments: | This installation was built with Inno Setup. |
ProductName: | UtilityInst |
Packers detected 2
Borland Delphi 3.0 (???) |
Borland Delphi 4.0 |
Anti debug functions 3
GetLastError |
RaiseException |
UnhandledExceptionFilter |
Strings analysis - File found
Library |
USERENV.dll |
ntmarta.dll |
comres.dll |
propsys.dll |
KERNEL32.dll |
OLEAUT32.dll |
cryptbase.dll |
UxTheme.dll |
OLEACC.dll |
profapi.dll |
VERSION.dll |
dwmapi.dll |
apphelp.dll |
ntdll.dll |
clbcatq.dll |
SHELL32.dll |
SETUPAPI.dll |
USER32.dll |
NETAPI32.dll |
COMCTL32.dll |
ADVAPI32.dll |
Strings analysis - Possible URLs found 2
https://jrsoftware.org/ishelp/index.php?topic=setupcmdline |
http://schemas.microsoft.com/SMI/2005/WindowsSettings |
Import functions
PE Exports 3 suspicious
Function | Address |
---|---|
TMethodImplementationIntercept | 0x4541a8 |
__dbk_fcall_wrapper | 0x40d0a0 |
dbkFCallWrapperAddr | 0x4be63c |
Name | Latest seen | MD5 |
---|---|---|
unknown.exe | 2022-10-04 20:08:02 | 49dc8a730f78a0fbd887d897b6b0b0d9 |
TradingVIew.exe | 2023-03-30 21:00:19 | c7c8ceb388bcd30a71d6bc892713d4e2 |
SecHorST.exe | 2023-05-11 08:21:02 | bec821cc9ca7762dd50f48d0cf4344cd |
clnsetup.exe | 2023-05-15 09:55:05 | a5087cf0193854a455afcc4533fd7acf |
setup.exe | 2023-06-20 16:13:04 | c44f108197b7b0b2a1f5fe5ffe1e8743 |
setup%E8%87%AA%E6%9F%A5%E5%85%A5%E5%8F%A3.exe | 2024-05-29 11:13:52 | 068fb7605542cd8350ed34ec2d767856 |
utility-installer.exe | 2024-10-03 21:31:16 | 05bf0fb13746875a2b7b9082200f7dc0 |
2927.exe | 2024-10-16 21:33:02 | f734d3c885625d361b085cfc8af1fc25 |