utility-inst.exe

First submission 2024-10-13 07:39:02

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 1723.02 KB (1764368 bytes)
Compile time: 2023-02-15 15:54:16
MD5: 0d43698dffc5ee744f805a699df25c00
SHA1: c914a0238381f03d2558bedd423228ba3e4e0040
SHA256: de14c3b860519dc781aaee813d4fa3adc67d7653c544327f8d26d5b386564712
Import Hash : e569e6f445d32ba23766ad67d1e3787f
Sections 10 .text .itext .data .bss .idata .didata .edata .tls .rdata .rsrc
Directories 4 import export resource tls

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 36/77 VT report date: 2024-10-13 01:52:56
Malware Type 2 trojan downloader
Threat Type 3 offloader amadey yxejkz

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://185.215.113.16/inc/utility-inst.exe VirusTotal Report 185.215.113.16 VirusTotal Report 2024-10-13 07:39:02

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0xb39e4 735744 343a0e7ec6c87dae257270b90b9988a3ff95a078 43af0a9476ca224d8e8461f1e22c94da
.itext 0xb5000 0x1688 6144 171aebbe52333ffd36593522a712b96644b565e5 185e04b9a1f554e31f7f848515dc890c
.data 0xb7000 0x37a4 14336 7a25edc4b9ed265b2ce19bbb507bad1985c6793e cab2107c933b696aa5cf0cc6c3fd3980
.bss 0xbb000 0x6de8 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0xc2000 0xfdc 4096 b7d043cca31864ef4b86887de77ebb3db089c2bd e7d1635e2624b124cfdce6c360ac21cd
.didata 0xc3000 0x1a4 512 fc7a6c0a1f7068ea13be23c825b3ea7a9f3ea676 8ced971d8a7705c98b173e255d8c9aa7
.edata 0xc4000 0x9a 512 f602c8394c4325ebe7c172a76ee1b74fa463888b 8d4e1e508031afe235bf121c80fd7d5f
.tls 0xc5000 0x18 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.rdata 0xc6000 0x5d 512 735078338d2c5f1b3f162ce296611076a9ddcf02 8f2f090acd9622c88a6a852e72f94e96
.rsrc 0xc7000 0x11000 69632 e9c66de8c642620a11b3ee6b7a523e1e7fd7a6c1 dc6585b5b13c096f53bc11051443b78f

PE Resources 6

Name Language Sublanguage Offset Size Data
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0xd4998 1128
RT_STRING LANG_NEUTRAL SUBLANG_NEUTRAL 0xd6ac4 676
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0xd703c 44
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0xd7068 188
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0xd7124 1412
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0xd76a8 1960

Meta infos 9

LegalCopyright:
OriginalFileName:
FileVersion:
CompanyName:
ProductVersion: 1.0
FileDescription: UtilityInst Setup
Translation: 0x0000 0x04b0
Comments: This installation was built with Inno Setup.
ProductName: UtilityInst

Packers detected 2

Borland Delphi 3.0 (???)
Borland Delphi 4.0

Anti debug functions 3

GetLastError
RaiseException
UnhandledExceptionFilter

Strings analysis - File found

Library
USERENV.dll
ntmarta.dll
comres.dll
propsys.dll
KERNEL32.dll
OLEAUT32.dll
cryptbase.dll
UxTheme.dll
OLEACC.dll
profapi.dll
VERSION.dll
dwmapi.dll
apphelp.dll
ntdll.dll
clbcatq.dll
SHELL32.dll
SETUPAPI.dll
USER32.dll
NETAPI32.dll
COMCTL32.dll
ADVAPI32.dll

Strings analysis - Possible URLs found 2

https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
http://schemas.microsoft.com/SMI/2005/WindowsSettings

Import functions

PE Exports 3 suspicious

Function Address
TMethodImplementationIntercept 0x4541a8
__dbk_fcall_wrapper 0x40d0a0
dbkFCallWrapperAddr 0x4be63c
Name Latest seen MD5
unknown.exe 2022-10-04 20:08:02 49dc8a730f78a0fbd887d897b6b0b0d9
TradingVIew.exe 2023-03-30 21:00:19 c7c8ceb388bcd30a71d6bc892713d4e2
SecHorST.exe 2023-05-11 08:21:02 bec821cc9ca7762dd50f48d0cf4344cd
clnsetup.exe 2023-05-15 09:55:05 a5087cf0193854a455afcc4533fd7acf
setup.exe 2023-06-20 16:13:04 c44f108197b7b0b2a1f5fe5ffe1e8743
setup%E8%87%AA%E6%9F%A5%E5%85%A5%E5%8F%A3.exe 2024-05-29 11:13:52 068fb7605542cd8350ed34ec2d767856
utility-installer.exe 2024-10-03 21:31:16 05bf0fb13746875a2b7b9082200f7dc0
2927.exe 2024-10-16 21:33:02 f734d3c885625d361b085cfc8af1fc25