installer.exe
First submission 2024-10-14 21:12:01
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| Mime type: | application/x-dosexec |
| File size: | 523.05 KB (535601 bytes) |
| Compile time: | 2009-12-05 23:50:46 |
| MD5: | a332dda934130d9581fea55fd737a474 |
| SHA1: | 998d0cc8d66d54c1c849f36f273d22b97d205c89 |
| SHA256: | 235c7943c7cd48eb749b69bdb488a580e13b42ef5123be170acb7a1c471accdb |
| Import Hash : | 099c0646ea7282d232219f8807883be0 |
| Sections 5 | .text .rdata .data .ndata .rsrc |
| Directories 2 | import resource |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 61/77 VT report date: 2024-10-14 21:01:09 |
| Malware Type 3 | trojan adware virus |
| Threat Type 3 | searchprotect visicom badur |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://download.yourfileinfo.com/installer.exe  |
download.yourfileinfo.com |
2024-10-14 21:12:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5a5a | 23552 | dd2a446014a37556f39173b802c63a4e46e09366 | 0bc2ffd32265a08d72b795b18265828d | |
| .rdata | 0x7000 | 0x1190 | 4608 | 6035d27db526131eb0f29aee60cfcdbb5072ed7d | f179218a059068529bdb4637ef5fa28e | |
| .data | 0x9000 | 0x1af98 | 1024 | 1f65340672c91ffd0f2583ff104beaece43c7855 | 975304d6dd6c4a4f076b15511e2bbbc0 | |
| .ndata | 0x24000 | 0x8000 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .rsrc | 0x2c000 | 0x9e8 | 2560 | 8cac944d46b43f84ee57f87e82cac672b52601a9 | 74b0d2c51e0b3b992e001832690034b7 |
PE Resources 4
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2c190 | 744 | |
| RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2c698 | 96 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2c6f8 | 20 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2c710 | 727 |
Packers detected 1
| Nullsoft PiMP Stub -> SFX |
Anti debug functions 2
| FindWindowExA |
| GetLastError |
Strings analysis - File found
| Temporary |
| ~nsu.tmp |
| Library |
| ADVAPI32.dll |
| VERSION.dll |
| SHELL32.dll |
| COMCTL32.dll |
| USER32.dll |
| GDI32.dll |
| ole32.dll |
| KERNEL32.dll |
Strings analysis - Possible URLs found 1
| http://nsis.sf.net/NSIS_Error |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| 9377chiyue_Y_mgaz.exe | 2022-11-22 08:16:06 | e258e77914272054d942bc9cb27ca477 |