setup[.]exe | Triage™

General

Target
setup.exe
Size 397KB
Sample230402-bcnfcsdg63
SHA256 feb5487ea80521645196d869335bbc829280c03bd83b5d9e6a0f0e1e23b1a1c3
MD5 0ff50a2908535351a560e42def77c509
SHA1 8fcfc9b45f17943657762c0ae1459f14e95e555e
SHA512 5d3e566651b56ca4fa2b218cdd7ce64f721e2a4420f1d68c6a2d4db4c84198bef5308a4605870034a7722b374162b8393c1dc3ac2a7963c936bfdbaaefc08e51
SSDEEP 6144:/fRW2RboYqLaQxnICyfCcnl2hVmQXoat72BIwg:/JdJoYqLaQpITCuYhVtDS2F
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 397KB

setup.exe

IMPHASH 5ca6a4f926acaf79e41109061c7e5b6c
SHA256 feb5487ea80521645196d869335bbc829280c03bd83b5d9e6a0f0e1e23b1a1c3
MD5 0ff50a2908535351a560e42def77c509
SHA1 8fcfc9b45f17943657762c0ae1459f14e95e555e
SHA512 5d3e566651b56ca4fa2b218cdd7ce64f721e2a4420f1d68c6a2d4db4c84198bef5308a4605870034a7722b374162b8393c1dc3ac2a7963c936bfdbaaefc08e51
SSDEEP 6144:/fRW2RboYqLaQxnICyfCcnl2hVmQXoat72BIwg:/JdJoYqLaQpITCuYhVtDS2F
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

16613

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateTimerQueue CreateMutexW SearchPathW lstrcmpA WriteConsoleInputW GetModuleHandleExA SetLocalTime _llseek CallNamedPipeA LocalCompact EnumCalendarInfoW SetDefaultCommConfigW GetEnvironmentStringsW InterlockedCompareExchange BackupSeek FindActCtxSectionStringA GetDriveTypeA GlobalAlloc LoadLibraryW GetFileAttributesA GetConsoleAliasW GetSystemDirectoryA CompareStringW GetDevicePowerState DeactivateActCtx GetConsoleOutputCP SetLastError GetProcAddress PulseEvent WriteProfileSectionA GetFirmwareEnvironmentVariableW ResetEvent OpenWaitableTimerA OpenMutexA LocalAlloc SetCalendarInfoW DnsHostnameToComputerNameA GetFileType BuildCommDCBAndTimeoutsW RemoveDirectoryW AddAtomA WaitForMultipleObjects EnumResourceTypesW GetPrivateProfileSectionNamesA FindNextFileA FindFirstVolumeMountPointA GetModuleHandleA SetLocaleInfoW ContinueDebugEvent GetStringTypeW GetCurrentThreadId GetWindowsDirectoryW DeleteFileW CopyFileExA IsValidLocale EnumSystemLocalesA GetComputerNameExW GetDateFormatW GetLastError HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW HeapCreate HeapDestroy EnterCriticalSection LeaveCriticalSection DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep FatalAppExitA GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetLocaleInfoW HeapAlloc HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringW MultiByteToWideChar SetFilePointer IsProcessorFeaturePresent HeapSize CloseHandle WriteConsoleW SetStdHandle CreateFileW GetUserDefaultLCID GetLocaleInfoA DeleteFileA

user32

LoadMenuW

advapi32

ReportEventW

Sharing