Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20230824-en
General
-
Target
Setup.rar
-
Size
57.3MB
-
MD5
d5a06051729b1cce2e0a9e706be32e9b
-
SHA1
4317561ff6640a3bee96acbedbdae7cdba929d43
-
SHA256
2ba70d5f05e58f1062125a0cbc046312f407c9d07f0d3b6bfe4add46cb7572ef
-
SHA512
9d55f5edf3a38db0cab78c67252fa23beae7e38d3ed740eacb5d45daae0de5b889ea9d8abf6164a8484bbb4eeaed4074771aaadc9050265150a16ed31358d88c
-
SSDEEP
1572864:nqUmPd46qzrsk4doe0aBgaW8PY+jYiOGDv6Q63K:nCPd4rC8aaaO+j5TSB3K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe
Files
-
Setup.rar.rar
-
Setup.exe.exe windows x86
6fe47b34c3da61f45764c74380ecd296
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
HeapQueryInformation
GetConsoleOutputCP
ReadConsoleW
GetEnvironmentStringsW
ExitProcess
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryExW
GetModuleFileNameW
RtlUnwind
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetThreadTimes
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
SetLastError
GetLastError
GetStringTypeExA
GetUserDefaultLCID
LCMapStringA
LoadLibraryA
FreeLibrary
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
DeviceIoControl
CreateFileW
LocalFree
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
CloseHandle
DebugBreak
GetConsoleMode
IsDebuggerPresent
InterlockedFlushSList
InterlockedPushEntrySList
VirtualQuery
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
GetCPInfo
CompareStringEx
CloseThreadpoolWait
SetThreadpoolWait
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WideCharToMultiByte
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
GetSystemDirectoryW
GetModuleHandleW
LoadLibraryW
GetEnvironmentVariableA
FormatMessageW
MoveFileExW
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
WaitForSingleObjectEx
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetLocaleInfoEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
CreateDirectoryExW
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeSRWLock
TryAcquireSRWLockExclusive
GetStringTypeW
RaiseException
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
SleepConditionVariableCS
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
ws2_32
WSAStartup
ntohl
accept
closesocket
recv
send
ioctlsocket
gethostname
getpeername
connect
htonl
WSAIoctl
setsockopt
freeaddrinfo
getaddrinfo
listen
getsockname
sendto
socket
bind
htons
inet_pton
WSACleanup
recvfrom
inet_ntop
ntohs
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
advapi32
CryptAcquireContextW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext
crypt32
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CryptDecodeObjectEx
CertCloseStore
CertOpenStore
CryptUnprotectData
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom
user32
LoadStringA
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
SetErrorInfo
VariantChangeType
GetErrorInfo
CreateErrorInfo
Sections
.text Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 929KB - Virtual size: 929KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 559.2MB - Virtual size: 559.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ