Deep Malware Analysis of 4ed27613cbb9ca2571e7b2f813f6e06e | md5: 4ed27613cbb9ca2571e7b2f813f6e06e | NSIS Installer | Executable | PE (Portable Executable) | PE File Layout | Win 32 Exe | x86 | PDB Path | Managed .NET | .Net | SOS: 0.26 | SOS: 0.21 | SOS: 0.39 | SOS: 0.24 | SOS: 0.31 | SOS: 0.25 | SOS: 0.36 | SOS: 0.27

[NSIS Installer] @ #00009808

agent.msi

Root Entry

䡀䆒䑲

䡀䌏䈯

䡀䈖䌧䠤

䡀䌋䄱䜵

䡀㬿䏲䐸䖱

䡀㽿䅤䈯䠶

䡀䈏䗤䕸䠨

䡀䈛䌪䗶䜵

䡀䓞䕪䇤䠨

䡀䕙䓲䕨䜷

䈍䄩䏸䞷䄦䠥

CAB:COMPRESSION:LZX

CAB:COMPRESSION:NONE

䌋䄱䜵䀾䛬㪌

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

RT_MANIFEST

ID:0002

ID:1033

䡀䈛㵪䆲䗤䕲

䡀䌍䈵䗦䕲䠼

䡀䒌䓰䑲䑨䠷

䡀䓊㼳䄨䆵䠫

䡀㼿䕷䑬㭪䗤䠤

䡀㼿䕷䑬㹪䒲䠯

䡀㿿䏤䇬䗤䒬䠱

䡀䘌䗶䐲䆊䌷䑲

䆒䑲㭾䉨䘤䗯䆒䑲

䡀䈜䙵䆬㬨䑲䌩䠪

䡀䈜䙵䆬㬨䑲䕷䏲

䡀䈜䙵䆬㲨䖱䄷䏯

䡀䄕䑸䋦䒌䇱䗬䒬䠱

䡀䇊䌰㾱㼒䔨䈸䆱䠨

䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

䌋䄱䜵㬾䖸䒷㪰䗦䒬㵱䅬䄵䜵

[Authenticode]_bbfb552b.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ID:1033

RT_MANIFEST

ID:0002

ID:1033

DigitalSignature

SummaryInformation

MsiDigitalSignatureEx

ScreenConnect.InstallerActions.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Microsoft.Deployment.WindowsInstaller.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

Microsoft.Deployment.WindowsInstaller.Errors.resources

Microsoft.Deployment.WindowsInstaller.Package.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ScreenConnect.Core.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

[Authenticode]_bf95cbe7.p7b

ScreenConnect.Windows.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ScreenConnect.Properties.libwebp.x64.dll

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.gxfg

.gehcont

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

ScreenConnect.Properties.libwebp.x86.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

_RDATA

.rsrc

.reloc

ScreenConnect.Properties.libz.x64.dll

PE File Layout

Win 64 Exe

x64

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1036

ScreenConnect.Properties.libz.x86.dll

PE File Layout

Win 32 Exe

x86

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

ScreenConnect.Properties.libzstd.x64.dll

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.reloc

ScreenConnect.Properties.libzstd.x86.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.reloc

[Authenticode]_a3a1febf.p7b

Microsoft.Deployment.Compression.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

Microsoft.Deployment.Compression.Cab.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

Microsoft.Deployment.Compression.Cab.Errors.resources

CustomAction.config

ScreenConnect.Client.dll

[Authenticode]_400f5a3c.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ScreenConnect.Properties.ApplicationIcon16.png

ScreenConnect.Properties.ApplicationIcon16.png-preview.png

ScreenConnect.Properties.ApplicationIcon256.png

ScreenConnect.Properties.ApplicationIcon256.png-preview.png

ScreenConnect.Properties.ApplicationIcon32.png

ScreenConnect.Properties.ApplicationIcon32.png-preview.png

ScreenConnect.Properties.ApplicationIcon48.png

ScreenConnect.Properties.ApplicationIcon48.png-preview.png

ScreenConnect.Properties.ApplicationIconBlank16.png

ScreenConnect.Properties.ApplicationIconBlank16.png-preview.png

ScreenConnect.Properties.ApplicationIconMac22.png

ScreenConnect.Properties.ApplicationIconMac22.png-preview.png

ScreenConnect.Properties.ApplicationIconOpaque192.png

ScreenConnect.Properties.ApplicationIconOpaque192.png-preview.png

ScreenConnect.Properties.ApplicationIconTitle16.png

ScreenConnect.Properties.ApplicationIconTitle16.png-preview.png

ScreenConnect.Properties.BlankMonitorBackgroundImage.png

ScreenConnect.Properties.BlankMonitorBackgroundImage.png-preview.png

ScreenConnect.Properties.CommandChangeFolder.png

ScreenConnect.Properties.CommandChangeFolder.png-preview.png

ScreenConnect.Properties.CommandClearAnnotations.png

ScreenConnect.Properties.CommandClearAnnotations.png-preview.png

ScreenConnect.Properties.CommandClose.png

ScreenConnect.Properties.CommandClose.png-preview.png

ScreenConnect.Properties.CommandDisconnectParticipant.png

ScreenConnect.Properties.CommandDisconnectParticipant.png-preview.png

ScreenConnect.Properties.CommandDockControlPanel.png

ScreenConnect.Properties.CommandDockControlPanel.png-preview.png

ScreenConnect.Properties.CommandManageCredentialsClearCredentials.png

ScreenConnect.Properties.CommandManageCredentialsClearCredentials.png-preview.png

ScreenConnect.Properties.CommandManageCredentialsPromptForStorage.png

ScreenConnect.Properties.CommandManageCredentialsPromptForStorage.png-preview.png

ScreenConnect.Properties.CommandManageCredentialsSendToScreen.png

ScreenConnect.Properties.CommandManageCredentialsSendToScreen.png-preview.png

ScreenConnect.Properties.CommandManageSharedToolbox.png

ScreenConnect.Properties.CommandManageSharedToolbox.png-preview.png

ScreenConnect.Properties.CommandMaximize.png

ScreenConnect.Properties.CommandMaximize.png-preview.png

ScreenConnect.Properties.CommandMinimize.png

ScreenConnect.Properties.CommandMinimize.png-preview.png

ScreenConnect.Properties.CommandMuteMicrophoneFalse.png

ScreenConnect.Properties.CommandMuteMicrophoneFalse.png-preview.png

ScreenConnect.Properties.CommandMuteMicrophoneTrue.png

ScreenConnect.Properties.CommandMuteMicrophoneTrue.png-preview.png

ScreenConnect.Properties.CommandMuteSpeakersFalse.png

ScreenConnect.Properties.CommandMuteSpeakersFalse.png-preview.png

ScreenConnect.Properties.CommandMuteSpeakersTrue.png

ScreenConnect.Properties.CommandMuteSpeakersTrue.png-preview.png

ScreenConnect.Properties.CommandOpenFolder.png

ScreenConnect.Properties.CommandOpenFolder.png-preview.png

ScreenConnect.Properties.CommandOpenMonitor.png

ScreenConnect.Properties.CommandOpenMonitor.png-preview.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopFalse.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopFalse.png-preview.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopTrue.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopTrue.png-preview.png

ScreenConnect.Properties.CommandRebootToNormalMode.png

ScreenConnect.Properties.CommandRebootToNormalMode.png-preview.png

ScreenConnect.Properties.CommandRebootToSafeMode.png

ScreenConnect.Properties.CommandRebootToSafeMode.png-preview.png

ScreenConnect.Properties.CommandReceiveFiles.png

ScreenConnect.Properties.CommandReceiveFiles.png-preview.png

ScreenConnect.Properties.CommandReceiveFolder.png

ScreenConnect.Properties.CommandReceiveFolder.png-preview.png

ScreenConnect.Properties.CommandRegenerateParticipantColor.png

ScreenConnect.Properties.CommandRegenerateParticipantColor.png-preview.png

ScreenConnect.Properties.CommandRequestParticipantShare.png

ScreenConnect.Properties.CommandRequestParticipantShare.png-preview.png

ScreenConnect.Properties.CommandReshareMyDesktop.png

ScreenConnect.Properties.CommandReshareMyDesktop.png-preview.png

ScreenConnect.Properties.CommandRestore.png

ScreenConnect.Properties.CommandRestore.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeAllDraw.png

ScreenConnect.Properties.CommandSelectAnnotationModeAllDraw.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeHostDraw.png

ScreenConnect.Properties.CommandSelectAnnotationModeHostDraw.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeInvisible.png

ScreenConnect.Properties.CommandSelectAnnotationModeInvisible.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeViewOnly.png

ScreenConnect.Properties.CommandSelectAnnotationModeViewOnly.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessMedium.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessMedium.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThick.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThick.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThin.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThin.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationToolEllipse.png

ScreenConnect.Properties.CommandSelectAnnotationToolEllipse.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationToolLine.png

ScreenConnect.Properties.CommandSelectAnnotationToolLine.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationToolRectangle.png

ScreenConnect.Properties.CommandSelectAnnotationToolRectangle.png-preview.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolCross.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolCross.png-preview.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolLasso.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolLasso.png-preview.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolNone.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolNone.png-preview.png

ScreenConnect.Properties.CommandSelectQualityHigh.png

ScreenConnect.Properties.CommandSelectQualityHigh.png-preview.png

ScreenConnect.Properties.CommandSelectQualityLow.png

ScreenConnect.Properties.CommandSelectQualityLow.png-preview.png

ScreenConnect.Properties.CommandSelectQualityMedium.png

ScreenConnect.Properties.CommandSelectQualityMedium.png-preview.png

ScreenConnect.Properties.CommandSelectSharePrinterModeAll.png

ScreenConnect.Properties.CommandSelectSharePrinterModeAll.png-preview.png

ScreenConnect.Properties.CommandSelectSharePrinterModeDefaultOnly.png

ScreenConnect.Properties.CommandSelectSharePrinterModeDefaultOnly.png-preview.png

ScreenConnect.Properties.CommandSelectSharePrinterModeNone.png

ScreenConnect.Properties.CommandSelectSharePrinterModeNone.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeAllMicrophones.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeAllMicrophones.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeHostMicrophone.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeHostMicrophone.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSilent.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSilent.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSpeakers.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSpeakers.png-preview.png

ScreenConnect.Properties.CommandSendClipboardKeystrokes.png

ScreenConnect.Properties.CommandSendClipboardKeystrokes.png-preview.png

ScreenConnect.Properties.CommandSendFiles.png

ScreenConnect.Properties.CommandSendFiles.png-preview.png

ScreenConnect.Properties.CommandSendFolder.png

ScreenConnect.Properties.CommandSendFolder.png-preview.png

ScreenConnect.Properties.CommandSendMessage.png

ScreenConnect.Properties.CommandSendMessage.png-preview.png

ScreenConnect.Properties.CommandSendSystemKeyCode.png

ScreenConnect.Properties.CommandSendSystemKeyCode.png-preview.png

ScreenConnect.Properties.CommandShareMyDesktop.png

ScreenConnect.Properties.CommandShareMyDesktop.png-preview.png

ScreenConnect.Properties.CommandSplitMonitors.png

ScreenConnect.Properties.CommandSplitMonitors.png-preview.png

ScreenConnect.Properties.CommandStopParticipantShare.png

ScreenConnect.Properties.CommandStopParticipantShare.png-preview.png

ScreenConnect.Properties.CommandTakeScreenshotToClipboard.png

ScreenConnect.Properties.CommandTakeScreenshotToClipboard.png-preview.png

ScreenConnect.Properties.CommandTakeScreenshotToFile.png

ScreenConnect.Properties.CommandTakeScreenshotToFile.png-preview.png

ScreenConnect.Properties.CommandUndockControlPanel.png

ScreenConnect.Properties.CommandUndockControlPanel.png-preview.png

ScreenConnect.Properties.CommandVideoRecord.png

ScreenConnect.Properties.CommandVideoRecord.png-preview.png

ScreenConnect.Properties.ControlPanelAnnotation.png

ScreenConnect.Properties.ControlPanelAnnotation.png-preview.png

ScreenConnect.Properties.ControlPanelEssentials.png

ScreenConnect.Properties.ControlPanelEssentials.png-preview.png

ScreenConnect.Properties.ControlPanelFileTransfer.png

ScreenConnect.Properties.ControlPanelFileTransfer.png-preview.png

ScreenConnect.Properties.ControlPanelHelper.png

ScreenConnect.Properties.ControlPanelHelper.png-preview.png

ScreenConnect.Properties.ControlPanelMessages.png

ScreenConnect.Properties.ControlPanelMessages.png-preview.png

ScreenConnect.Properties.ControlPanelParticipants.png

ScreenConnect.Properties.ControlPanelParticipants.png-preview.png

ScreenConnect.Properties.ControlPanelScreenCapture.png

ScreenConnect.Properties.ControlPanelScreenCapture.png-preview.png

ScreenConnect.Properties.ControlPanelShare.png

ScreenConnect.Properties.ControlPanelShare.png-preview.png

ScreenConnect.Properties.ControlPanelSound.png

ScreenConnect.Properties.ControlPanelSound.png-preview.png

ScreenConnect.Properties.ControlPanelStatus.png

ScreenConnect.Properties.ControlPanelStatus.png-preview.png

ScreenConnect.Properties.ControlPanelToolbox.png

ScreenConnect.Properties.ControlPanelToolbox.png-preview.png

ScreenConnect.Properties.ControlPanelView.png

ScreenConnect.Properties.ControlPanelView.png-preview.png

ScreenConnect.Properties.DropDownGlyph.png

ScreenConnect.Properties.DropDownGlyph.png-preview.png

ScreenConnect.Properties.FeedbackBannerLogo.png

ScreenConnect.Properties.FeedbackBannerLogo.png-preview.png

ScreenConnect.Properties.HostClientOptions.png

ScreenConnect.Properties.HostClientOptions.png-preview.png

ScreenConnect.Properties.NotificationOptionsIcon.png

ScreenConnect.Properties.NotificationOptionsIcon.png-preview.png

ScreenConnect.Properties.ParticipantAnnotating.png

ScreenConnect.Properties.ParticipantAnnotating.png-preview.png

ScreenConnect.Properties.ParticipantCapturing.png

ScreenConnect.Properties.ParticipantCapturing.png-preview.png

ScreenConnect.Properties.ParticipantGuest.png

ScreenConnect.Properties.ParticipantGuest.png-preview.png

ScreenConnect.Properties.ParticipantHost.png

ScreenConnect.Properties.ParticipantHost.png-preview.png

ScreenConnect.Properties.ParticipantMicrophone.png

ScreenConnect.Properties.ParticipantMicrophone.png-preview.png

ScreenConnect.Properties.ParticipantMicrophoneSending.png

ScreenConnect.Properties.ParticipantMicrophoneSending.png-preview.png

ScreenConnect.Properties.ParticipantRequesting.png

ScreenConnect.Properties.ParticipantRequesting.png-preview.png

ScreenConnect.Properties.ParticipantSendingInput.png

ScreenConnect.Properties.ParticipantSendingInput.png-preview.png

ScreenConnect.Properties.ParticipantSpeakers.png

ScreenConnect.Properties.ParticipantSpeakers.png-preview.png

ScreenConnect.Properties.ParticipantSpeakersSending.png

ScreenConnect.Properties.ParticipantSpeakersSending.png-preview.png

ScreenConnect.Properties.PlaceholderImageHeadlessGuest.png

ScreenConnect.Properties.PlaceholderImageHeadlessGuest.png-preview.png

ScreenConnect.Properties.Resolutions.png

ScreenConnect.Properties.Resolutions.png-preview.png

ScreenConnect.Properties.SelectedSign.png

ScreenConnect.Properties.SelectedSign.png-preview.png

ScreenConnect.Properties.ShareGlyph.png

ScreenConnect.Properties.ShareGlyph.png-preview.png

ScreenConnect.Properties.ShareMask.png

ScreenConnect.Properties.ShareMask.png-preview.png

ScreenConnect.Properties.StatusGlyphBlankMonitor.png

ScreenConnect.Properties.StatusGlyphBlankMonitor.png-preview.png

ScreenConnect.Properties.StatusGlyphGuestAndHostConnected.png

ScreenConnect.Properties.StatusGlyphGuestAndHostConnected.png-preview.png

ScreenConnect.Properties.StatusGlyphGuestNotConnected.png

ScreenConnect.Properties.StatusGlyphGuestNotConnected.png-preview.png

ScreenConnect.Properties.StatusGlyphMask.png

ScreenConnect.Properties.StatusGlyphMask.png-preview.png

ScreenConnect.Properties.ToolTip.png

ScreenConnect.Properties.ToolTip.png-preview.png

ScreenConnect.Properties.Lasso.cur

ScreenConnect.ClientService.dll

[Authenticode]_653cc2d4.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ScreenConnect.WindowsAuthenticationPackage.dll

[Authenticode]_5a461ecd.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.rsrc

.reloc

Resources

RT_MANIFEST

ID:0002

ID:1033

ScreenConnect.WindowsBackstageShell.exe

[Authenticode]_3b71daa4.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

ScreenConnect.WindowsBackstageShell.exe.config

ScreenConnect.WindowsClient.exe

ScreenConnect.WindowsCredentialProvider.arm64.dll

ScreenConnect.WindowsCredentialProvider.dll

ScreenConnect.WindowsFileManager.exe

ServiceExeWithoutService