setup[.]exe | Triage™

General

Target
setup.exe
Size 333KB
Sample230405-dshadsdd8w
SHA256 def37ed3e6ccca831f35008fcf829583d483939669a9bbc8410f9ce9fb303d6e
MD5 0d59e7d7e996a61f8fabd546d1c0f298
SHA1 c4d58ca0161a851784641d59d5179b3a28785834
SHA512 9e96f4828a14685382ad19f1d85c0234a9fe73615a273c874f24ccad2696d1b45e90e64be4468f7a0ff157aae2a924069a5b843849effbc312519b91811cb90d
SSDEEP 6144:OHv6soVCMPERIuPJ4XvNDu+Iu+x1QAbRQaW:OHv6soEMP41mxu+IuopbRo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 333KB

setup.exe

IMPHASH 262ebebc1125c68c79c87bc329257c28
SHA256 def37ed3e6ccca831f35008fcf829583d483939669a9bbc8410f9ce9fb303d6e
MD5 0d59e7d7e996a61f8fabd546d1c0f298
SHA1 c4d58ca0161a851784641d59d5179b3a28785834
SHA512 9e96f4828a14685382ad19f1d85c0234a9fe73615a273c874f24ccad2696d1b45e90e64be4468f7a0ff157aae2a924069a5b843849effbc312519b91811cb90d
SSDEEP 6144:OHv6soVCMPERIuPJ4XvNDu+Iu+x1QAbRQaW:OHv6soEMP41mxu+IuopbRo
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

17730

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileExW GetModuleHandleExA SetLocalTime BuildCommDCBAndTimeoutsA CallNamedPipeA SetUnhandledExceptionFilter WaitNamedPipeA GlobalSize GetEnvironmentStringsW InterlockedCompareExchange WriteConsoleInputA SetEvent BackupSeek GetModuleHandleW CreateRemoteThread SetFileTime GetWindowsDirectoryA GetDateFormatA FindActCtxSectionStringA GetDriveTypeA GlobalAlloc ReadFileScatter GetVersionExW DnsHostnameToComputerNameW GetComputerNameExA FindNextVolumeW GetConsoleAliasW GetFileAttributesW EnumCalendarInfoA GetSystemDirectoryA FindNextVolumeMountPointW DeactivateActCtx EnumSystemLocalesA GetConsoleOutputCP OpenMutexW GetProcAddress LoadLibraryA LocalAlloc SetCalendarInfoW RemoveDirectoryW GlobalGetAtomNameW GetCommMask RtlCaptureStackBackTrace GlobalFindAtomW EnumResourceTypesW FindNextFileA GetModuleHandleA SetLocaleInfoW EraseTape CreateMutexA GetStringTypeW RequestWakeupLatency GetVolumeNameForVolumeMountPointW DeleteFileW GetFileInformationByHandle CloseHandle HeapSize GetModuleFileNameW lstrcmpA GetLastError WideCharToMultiByte DeleteFileA HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree SetLastError GetCurrentThreadId GetCurrentThread UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection HeapCreate HeapDestroy HeapFree HeapAlloc SetFilePointer ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar FatalAppExitA Sleep IsProcessorFeaturePresent GetLocaleInfoW GetUserDefaultLCID GetLocaleInfoA IsValidLocale RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryW WriteConsoleW CreateFileW

user32

GetMenu

advapi32

ReportEventA

Sharing