setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

685.0MB
MD5

64e1372cbb3b52e7aadebb4087fc2239
SHA1

0b40e5924cea9136979a2eaf1462449aae126eb7
SHA256

9f55a1c767169e34bd534bdca8807f557063da59a24d6ef4b662b048d219c652
SHA512

adff3dbe46edf1fae240929940deb5c96a676666dcb05ffeb095749c29705a94a5a399118bf75fe610915c31ccd9baed6b708b4e3f59804b751f107a09dc3c83
SSDEEP

49152:xK/iMe6AtrK/bEUSiKZYrWc/bs+0kdEDnMoZPAmXCcj0wCx:xKw4b8zZ2Qk3f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

Files

setup.exe
.exe windows x64

d75116b68202e298728ec70552120ba0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

strcpy_s
memset
strcat_s
malloc
strncpy
memmove
fopen
fwrite
fclose
strstr
strrchr
strcat
fgetc
fputc
rand
_getcwd
strncat
sprintf
getenv
_itoa
strcmp
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

kernel32

CreatePipe
SetHandleInformation
GetStdHandle
CreateProcessA
CloseHandle
ReadFile
WaitForSingleObject
GetExitCodeProcess
GetWindowsDirectoryA
GetLocaleInfoA
GetModuleFileNameA
CopyFileA
GetCurrentProcessId
ExitProcess

user32

MessageBoxA

shell32

ShellExecuteExA

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ