Static task
static1
General
-
Target
Telesetup.exe
-
Size
53.1MB
-
MD5
727c10aebe4538ea0708eab29b337dce
-
SHA1
72f2f68fd6078c9c0aaef62faeae7fbb3fab8717
-
SHA256
db2f5892aaaefde508d2e3e455a39d54d5ea1c70d9c43e62b8e3f7951dae7911
-
SHA512
4e2b6e4dc3470a9c4af5e27f2c528b92a2fd34bfc99d1ee07c159ebb0031672b14616d25d454c6c10287da1c5e8b5b0ac8689fb59ce589f84828edfaf8fb851b
-
SSDEEP
786432:1x9Nol1W4PdaAtiTxRz+R9uWRKvnXFlHR9sYKX/WnBFYAfBSrATdbE83XQNtfZpV:Y1XzgTi9ovnVlEWnLBSrGyjBZNynzLQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Telesetup.exe
Files
-
Telesetup.exe.exe windows x64
fdde264bf47bd8b989c3a43bdd6b0215
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReleaseMutex
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
AcquireSRWLockExclusive
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
DuplicateHandle
CreateDirectoryW
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
TryAcquireSRWLockExclusive
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
HeapFree
FreeEnvironmentStringsW
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
MultiByteToWideChar
WriteConsoleW
CreateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
HeapReAlloc
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
vcruntime140
_CxxThrowException
memset
__CxxFrameHandler3
memmove
memcpy
__current_exception_context
__C_specific_handler
__current_exception
memcmp
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm
_set_app_type
_configure_narrow_argv
__p___argc
_get_initial_narrow_environment
_seh_filter_exe
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 209KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52.9MB - Virtual size: 52.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ