The Install Xfer LFOTool 1768 exe File Malware Analysis

Technical Analysis

File Name	Install_Xfer_LFOTool_1768.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Scanner Version	1.0.229.174
Database Version	2025-12-02 03:00:40 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	b53570404d253f783374d8df9b54c9af
SHA1	ca61a35e430f9d017868253e1cedd74e4ec8a77c
SHA256	94a6f72f4489ce41e7c7dfc9dd8a59128e25dff297ec6e7ca7efecd1bf9ccdf5
SHA512	e1754d032fd63a6af0f1634c2fccf7fe1706c74bd30c636a89c6066c4c27290be8bbb6ee35666ca9c42c8fc71575649f56493debd58fdecd8a60bb7334517f2e
ImpHash	b34f154ec913d2d2c435cbd644e91687

PE Analysis

Basic Information

▼

Icon	Hash: 1ee95ad54b68087c5b1841beba3b46f7 Fuzzy: f7ec96daa0e30c4daf1d2511dbe1818d dHash: 28d62ce9cc049200
Image Base	`0x00400000`
Entry Point	`0x0040338f`
Compilation Time	2018-01-30 03:57:48
Checksum	0x006f3345 (Actual: 0x006f3345)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive`
Digital Signature	OK
Imports	7 libraries KERNEL32, USER32, GDI32, SHELL32, ADVAPI32, COMCTL32, ole32
Exports	0 functions
Resources	14 Resources
Sections	5 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	26,151 bytes	26,624 bytes	6.45 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`8C030DFED318C62753A7B0D60218279B`
`.rdata`	`0x00008000`	5,274 bytes	5,632 bytes	5.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`966A3835FD2D9407261AE78460C26DCC`
`.data`	`0x0000a000`	176,120 bytes	1,536 bytes	4.04 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`939516377E7577B622EB1FFDC4B5DB4A`
`.ndata`	`0x00035000`	184,320 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x00062000`	34,752 bytes	34,816 bytes	5.39 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D5B4208A683671A7C3FCC08B27472FF5`

Resource Analysis

▼

Total Resources: 14 (33,922 bytes)

Resource Type	Count	Total Size	Percentage
RT_BITMAP	1	1,638 bytes	4.8%
RT_ICON	5	29,332 bytes	86.5%
RT_DIALOG	6	1,810 bytes	5.3%
RT_GROUP_ICON	1	76 bytes	0.2%
RT_MANIFEST	1	1,066 bytes	3.1%

Certificate Chain Analysis

▼

Certificate Information

Signing Date	04:21 AM 06/05/2022 (1313 days ago)
Verification Status	Signed
Signers	Stephen Duda; DigiCert SHA2 Assured ID Code Signing CA; DigiCert
Counter Signers	Sectigo RSA Time Stamping Signer #3; Sectigo RSA Time Stamping CA; Sectigo

Certificate Chain Summary

Stephen Duda #1 Primary

Validity Period: 2020-05-07 00:00:00 → 2023-05-12 12:00:00

Signature Algorithm: sha256RSA

Serial Number: 0D 8E 39 4F 36 06 1F EF 36 DE C5 2C 04 F6 03 33

DigiCert SHA2 Assured ID Code Signing CA #2 Chain

Validity Period: 2013-10-22 12:00:00 → 2028-10-22 12:00:00

Signature Algorithm: sha256RSA

Serial Number: 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08

Sectigo RSA Time Stamping Signer #3 #3 Chain

Validity Period: 2022-05-11 00:00:00 → 2033-08-10 23:59:59

Signature Algorithm: sha384RSA

Serial Number: 90 39 7F 9A D2 4A 3A 13 F2 BD 91 5F 08 38 A9 43

Sectigo RSA Time Stamping CA #4 Chain

Validity Period: 2019-05-02 00:00:00 → 2038-01-18 23:59:59

Signature Algorithm: sha384RSA

Serial Number: 30 0F 6F AC DD 66 98 74 7C A9 46 36 A7 78 2D B9

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

OK

The Install_Xfer_LFOTool_1768.exe File Analysis