Edit tour
Windows
Analysis Report
Instalador.exe
Overview
General Information
| Sample Name: | Instalador.exe |
| Analysis ID: | 1303080 |
| MD5: | 2078132c606b0df087c06f7ec2aeeee4 |
| SHA1: | 8af2babe436649baf9d836b4f51489980349612f |
| SHA256: | ffa4922c794fe0f803ffe555e10b4c66a18f624098c83ac6a6cf7e8d7bc46cd6 |
 | |
Detection
| Score: | 0 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Uses 32bit PE files
Classification
- System is w10x64_ra
Instalador.exe (PID: 3212 cmdline: C:\Users\u ser\Deskto p\Instalad or.exe MD5: 2078132C606B0DF087C06F7EC2AEEEE4)
- cleanup
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
- • Compliance
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File read: | ||
| Source: | File read: | ||
| Source: | Key value queried: | ||
| Source: | File created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | ||
| Source: | Classification label: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Process information set: | ||
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | Direct Volume Access | OS Credential Dumping | 1 File and Directory Discovery | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Data Obfuscation | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 1 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
⊘No contacted IP infos
| Joe Sandbox Version: | 38.0.0 Beryl |
| Analysis ID: | 1303080 |
| Start date and time: | 2023-09-04 19:20:50 +02:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip) |
| Number of analysed new started processes analysed: | 5 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Sample file name: | Instalador.exe |
| Detection: | CLEAN |
| Classification: | clean0.winEXE@1/0@0/0 |
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): WMIADAP.exe, SI HClient.exe, svchost.exe - Excluded domains from analysis
(whitelisted): slscr.update.m icrosoft.com - VT rate limit hit for: Instal
ador.exe
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.971912902766881 |
| TrID: |
|
| File name: | Instalador.exe |
| File size: | 2'537'856 bytes |
| MD5: | 2078132c606b0df087c06f7ec2aeeee4 |
| SHA1: | 8af2babe436649baf9d836b4f51489980349612f |
| SHA256: | ffa4922c794fe0f803ffe555e10b4c66a18f624098c83ac6a6cf7e8d7bc46cd6 |
| SHA512: | e025dad6afeb007ea07eebe2e1125e06c951eda4da616dc79c984e6f907c240ee96541797322e60c031e177edc6afeae2a8e692dbad2aa719ddb9847354dd719 |
| SSDEEP: | 49152:TTfL5C/wZ1dQWfGyZKIBeDpEkena4nggDin8EgpZ/FhkQyINnahjIIJc:Pf4sDQGGGWpELzn1Di8EgLFKQhtYZJc |
| TLSH: | 6EC5334B75E1984BD21253F42CA4AE782682BC9CC118CF6BBB0D5F9ED071952C93BB17 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...@.$_.................h......... |
 | |
| Icon Hash: | 0771ccf8d84d2907 |
| Entrypoint: | 0x4034c5 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x5F24D740 [Sat Aug 1 02:45:20 2020 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 6e7f9a29f2c85394521a08b9f31f6275 |
| Instruction |
|---|
| sub esp, 000002D4h |
| push ebx |
| push esi |
| push edi |
| push 00000020h |
| pop edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+14h], ebx |
| mov dword ptr [esp+10h], 0040A2E0h |
| mov dword ptr [esp+1Ch], ebx |
| call dword ptr [004080CCh] |
| call dword ptr [004080D0h] |
| and eax, BFFFFFFFh |
| cmp ax, 00000006h |
| mov dword ptr [00434F0Ch], eax |
| je 00007FE0106B18E3h |
| push ebx |
| call 00007FE0106B4BD1h |
| cmp eax, ebx |
| je 00007FE0106B18D9h |
| push 00000C00h |
| call eax |
| mov esi, 004082B0h |
| push esi |
| call 00007FE0106B4B4Bh |
| push esi |
| call dword ptr [00408154h] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], 00000000h |
| jne 00007FE0106B18BCh |
| push 0000000Bh |
| call 00007FE0106B4BA4h |
| push 00000009h |
| call 00007FE0106B4B9Dh |
| push 00000007h |
| mov dword ptr [00434F04h], eax |
| call 00007FE0106B4B91h |
| cmp eax, ebx |
| je 00007FE0106B18E1h |
| push 0000001Eh |
| call eax |
| test eax, eax |
| je 00007FE0106B18D9h |
| or byte ptr [00434F0Fh], 00000040h |
| push ebp |
| call dword ptr [00408038h] |
| push ebx |
| call dword ptr [00408298h] |
| mov dword ptr [00434FD8h], eax |
| push ebx |
| lea eax, dword ptr [esp+34h] |
| push 000002B4h |
| push eax |
| push ebx |
| push 0042B228h |
| call dword ptr [0040818Ch] |
| push 0040A2C8h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8610 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x57000 | 0x4a90 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x2b0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6793 | 0x6800 | False | 0.6720628004807693 | data | 6.495258513279076 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x14a4 | 0x1600 | False | 0.4385653409090909 | data | 5.01371465125838 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x2b018 | 0x600 | False | 0.5240885416666666 | data | 4.155579717739458 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x36000 | 0x21000 | 0x0 | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x57000 | 0x4a90 | 0x4c00 | False | 0.5733963815789473 | data | 5.794242665804941 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_BITMAP | 0x57358 | 0x666 | Device independent bitmap graphic, 96 x 16 x 8, image size 1538, resolution 2868 x 2868 px/m, 15 important colors | English | United States | 0.18192918192918192 |
| RT_ICON | 0x579c0 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.7213883677298312 |
| RT_ICON | 0x58a68 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors | English | United States | 0.6751066098081023 |
| RT_ICON | 0x59910 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors | English | United States | 0.7851985559566786 |
| RT_ICON | 0x5a1b8 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors | English | United States | 0.6560693641618497 |
| RT_ICON | 0x5a720 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.8031914893617021 |
| RT_ICON | 0x5ab88 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 640 | English | United States | 0.3118279569892473 |
| RT_ICON | 0x5ae70 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | United States | 0.36824324324324326 |
| RT_DIALOG | 0x5af98 | 0x120 | data | English | United States | 0.5138888888888888 |
| RT_DIALOG | 0x5b0b8 | 0x158 | data | English | United States | 0.5261627906976745 |
| RT_DIALOG | 0x5b210 | 0x202 | data | English | United States | 0.4085603112840467 |
| RT_DIALOG | 0x5b418 | 0xf8 | data | English | United States | 0.6290322580645161 |
| RT_DIALOG | 0x5b510 | 0xee | data | English | United States | 0.6260504201680672 |
| RT_GROUP_ICON | 0x5b600 | 0x68 | data | English | United States | 0.6634615384615384 |
| RT_MANIFEST | 0x5b668 | 0x425 | XML 1.0 document, ASCII text, with very long lines (1061), with no line terminators | English | United States | 0.5136663524976437 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW |
| SHELL32.dll | SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW |
| ole32.dll | OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree |
| COMCTL32.dll | ImageList_Create, ImageList_Destroy, ImageList_AddMasked |
| USER32.dll | GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu |
| GDI32.dll | SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject |
| KERNEL32.dll | GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node