irsetup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

irsetup.exe
Size

1.3MB
MD5

e7bbc7b426cee4b8027a00b11f06ef34
SHA1

926fad387ede328d3cfd9da80d0b303a865cca98
SHA256

e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538
SHA512

f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70
SSDEEP

24576:WBIWcmjuRli1R/zBUhmgI2TIhXlqLUxocktXo4SHS1CQAHgxs/r6dc:MIWcmKRklqdTAqwxSXo4SHS1Fs/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

irsetup.exe
.exe windows x86

Code Sign

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

Issuer

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Not Before

01/09/2016, 14:35

Not After

29/09/2024, 14:35

Subject

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10
Certificate

Issuer

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Not Before

03/02/2020, 10:09

Not After

02/02/2023, 16:09

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:2d:84:7e:bc:eb:a2:7a:ab:57:70:f1:32:02:6b:eb:3d:12:b8
Certificate

Issuer

CN=Trustwave Global Timestamping CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Not Before

21/09/2020, 09:52

Not After

19/12/2031, 15:52

Subject

CN=SecureTrust TWG Timestamping Responder 2021,O=SecureTrust,L=Chicago,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83
Certificate

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Not Before

06/02/2018, 12:21

Not After

21/08/2042, 18:21

Subject

CN=Trustwave Global Timestamping CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

Issuer

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Not Before

01/09/2016, 14:35

Not After

29/09/2024, 14:35

Subject

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10
Certificate

Issuer

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Not Before

03/02/2020, 10:09

Not After

02/02/2023, 16:09

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:2d:84:7e:bc:eb:a2:7a:ab:57:70:f1:32:02:6b:eb:3d:12:b8
Certificate

Issuer

CN=Trustwave Global Timestamping CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Not Before

21/09/2020, 09:52

Not After

19/12/2031, 15:52

Subject

CN=SecureTrust TWG Timestamping Responder 2021,O=SecureTrust,L=Chicago,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83
Certificate

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Not Before

06/02/2018, 12:21

Not After

21/08/2042, 18:21

Subject

CN=Trustwave Global Timestamping CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:c3:0e:83:0e:02:eb:e4:25:d9:86:0e:3d:38:aa:0b:cd:41:ce:92:e4:5a:fa:00:f5:a4:c3:5d:ca:01:80:c1
Signer

Actual PE Digest

98:c3:0e:83:0e:02:eb:e4:25:d9:86:0e:3d:38:aa:0b:cd:41:ce:92:e4:5a:fa:00:f5:a4:c3:5d:ca:01:80:c1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

22/02/2022, 08:27
Valid: true

Chain 1

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

0b:64:f4:4b:5b:d4:02:08:11:86:1c:c4:eb:99:96:e0:69:07:ad:e7
Signer

Actual PE Digest

0b:64:f4:4b:5b:d4:02:08:11:86:1c:c4:eb:99:96:e0:69:07:ad:e7

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

22/02/2022, 08:27
Valid: true

Chain 1

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 687KB - Virtual size: 686KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54Certificate

Extended Key Usages

Key Usages

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10Certificate

Extended Key Usages

Key Usages

07:2d:84:7e:bc:eb:a2:7a:ab:57:70:f1:32:02:6b:eb:3d:12:b8Certificate

Extended Key Usages

Key Usages

06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83Certificate

Extended Key Usages

Key Usages

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54Certificate

Extended Key Usages

Key Usages

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10Certificate

Extended Key Usages

Key Usages

07:2d:84:7e:bc:eb:a2:7a:ab:57:70:f1:32:02:6b:eb:3d:12:b8Certificate

Extended Key Usages

Key Usages

06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83Certificate

Extended Key Usages

Key Usages

98:c3:0e:83:0e:02:eb:e4:25:d9:86:0e:3d:38:aa:0b:cd:41:ce:92:e4:5a:fa:00:f5:a4:c3:5d:ca:01:80:c1Signer

Signature Validations

Verification

22/02/2022, 08:27 Valid: true

Chain 1

0b:64:f4:4b:5b:d4:02:08:11:86:1c:c4:eb:99:96:e0:69:07:ad:e7Signer

Signature Validations

Verification

22/02/2022, 08:27 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.6MB

UPX1 Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 32KB - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 687KB - Virtual size: 686KB

.data Size: 49KB - Virtual size: 154KB

.rsrc Size: 46KB - Virtual size: 45KB

.reloc Size: 289KB - Virtual size: 289KB

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10
Certificate

07:2d:84:7e:bc:eb:a2:7a:ab:57:70:f1:32:02:6b:eb:3d:12:b8
Certificate

06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83
Certificate

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10
Certificate

07:2d:84:7e:bc:eb:a2:7a:ab:57:70:f1:32:02:6b:eb:3d:12:b8
Certificate

06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83
Certificate

98:c3:0e:83:0e:02:eb:e4:25:d9:86:0e:3d:38:aa:0b:cd:41:ce:92:e4:5a:fa:00:f5:a4:c3:5d:ca:01:80:c1
Signer

22/02/2022, 08:27
Valid: true

0b:64:f4:4b:5b:d4:02:08:11:86:1c:c4:eb:99:96:e0:69:07:ad:e7
Signer

22/02/2022, 08:27
Valid: true

UPX0
Size: - Virtual size: 2.6MB

UPX1
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 32KB - Virtual size: 32KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 687KB - Virtual size: 686KB

.data
Size: 49KB - Virtual size: 154KB

.rsrc
Size: 46KB - Virtual size: 45KB

.reloc
Size: 289KB - Virtual size: 289KB