Static task
static1
General
-
Target
setup.exe
-
Size
5.4MB
-
MD5
64b22215cca284010e9bf96eb5ae2f02
-
SHA1
65ca0d5558f8461efe3cb70bda1949bb78a2a811
-
SHA256
1542ed413c1d21ca7b5cde39ce4e0d4ee592de26a25a9868ece77b875a16639e
-
SHA512
9951f9e4817cf1fe7c53cc92acd7ac4d0d7621109ab9b204136523d21514a7964d2ecf89f13e3e6d881654e5e1b44606e70ab020125d2be2e2989dbecbb9fd39
-
SSDEEP
98304:zGrSU2RFMu6kpUDAdbsWo93oTBVh/y3AXGqtw+/ok8LXKpHcYBwY2h/wI:zcSFpUD6o93iBVhaQXGqtw+gxCHcEWF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource setup.exe
Files
-
setup.exe.exe windows x86
7a73970ba5fe5c05778b498b19646dc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
gdi32
GetTextExtentPoint32W
Rectangle
SetDCPenColor
CreatePen
SetDCBrushColor
SelectObject
CreateFontW
GetStockObject
SetBkColor
SetTextColor
CreateSolidBrush
GetTextMetricsW
DeleteObject
GetDeviceCaps
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
advapi32
SetServiceObjectSecurity
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
DeleteService
EnumDependentServicesW
ControlService
StartServiceW
QueryServiceConfigW
QueryServiceStatusEx
OpenServiceW
CloseServiceHandle
OpenSCManagerW
RegSetKeySecurity
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteValueA
RegCreateKeyExW
RegCloseKey
CryptReleaseContext
CryptAcquireContextW
EventWriteTransfer
EventRegister
EventUnregister
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptHashData
RegEnumValueA
RegNotifyChangeKeyValue
RevertToSelf
EventWrite
OpenThreadToken
OpenProcessToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
CheckTokenMembership
CreateWellKnownSid
EqualSid
ImpersonateLoggedOnUser
kernel32
GetConsoleCP
GetCurrentProcess
InitializeCriticalSectionEx
GetLastError
CompareStringEx
DeleteCriticalSection
FlsFree
FlsAlloc
IsWow64Process
GetModuleFileNameW
CloseHandle
CreateThread
GetExitCodeThread
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetProcessTimes
GetCurrentThread
GetThreadTimes
CreateDirectoryW
FindFirstFileW
GetFullPathNameW
FindNextFileW
DeviceIoControl
RemoveDirectoryW
GetEnvironmentVariableW
SetEndOfFile
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
GetDiskFreeSpaceExW
DeleteFileW
GetCurrentDirectoryW
SetFilePointerEx
MoveFileExW
CopyFileW
AreFileApisANSI
WideCharToMultiByte
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FreeLibrary
LocalFree
FormatMessageA
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetTickCount64
GetModuleHandleExW
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
GetCurrentProcessId
GetStringTypeW
GetProductInfo
GetVersionExW
GetUserDefaultLocaleName
IsValidCodePage
SetLastError
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
SetErrorMode
HeapSize
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetNativeSystemInfo
GetSystemDirectoryW
CreateEventW
SetEvent
WaitForSingleObject
WaitForMultipleObjectsEx
CreateEventExW
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetModuleHandleA
LoadLibraryW
OutputDebugStringA
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
ReleaseSemaphore
WaitForSingleObjectEx
QueryDepthSList
TryEnterCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
ReleaseMutex
TzSpecificLocalTimeToSystemTime
GetTempPathW
GetLongPathNameW
ResetEvent
VirtualProtectEx
GetSystemInfo
GlobalFree
GlobalAlloc
ReadFile
WriteFile
GetFileSizeEx
LockResource
GetOverlappedResult
FlushFileBuffers
CancelIoEx
GetDriveTypeW
FindFirstFileExW
GetFileType
GetTempFileNameW
SetFileInformationByHandle
GetFileInformationByHandleEx
SignalObjectAndWait
GetProcessAffinityMask
GetLogicalProcessorInformationEx
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
IsProcessorFeaturePresent
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetQueuedCompletionStatus
IsDebuggerPresent
WaitForMultipleObjects
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
QueryUnbiasedInterruptTime
OutputDebugStringW
CreateMutexW
VirtualFree
ExpandEnvironmentStringsW
VirtualAlloc
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetThreadLocale
lstrcmpW
ProcessIdToSessionId
GetCommandLineW
SetEnvironmentVariableW
GetPriorityClass
GetExitCodeProcess
K32EnumProcesses
GetTimeZoneInformation
IsValidLocale
GetLocaleInfoEx
LCIDToLocaleName
LocaleNameToLCID
GetLocaleInfoW
ResolveLocaleName
GetUserPreferredUILanguages
GetACP
LCMapStringEx
GetSystemDefaultLCID
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetUserGeoID
SwitchToThread
GetConsoleMode
UnregisterWaitEx
VirtualProtect
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateTimerQueue
InterlockedFlushSList
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
EncodePointer
DuplicateHandle
OpenThread
K32GetProcessImageFileNameW
GetSystemPreferredUILanguages
GetDateFormatW
GetTimeFormatW
DeleteTimerQueueTimer
CreateTimerQueueTimer
lstrcmpA
FreeConsole
WriteConsoleW
GetStdHandle
AllocConsole
AttachConsole
DecodePointer
HeapReAlloc
ExitProcess
EnumSystemLocalesW
SetStdHandle
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualQuery
LoadLibraryExA
ReadConsoleW
GetComputerNameW
GetLocalTime
ole32
IIDFromString
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateGuid
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CreateStreamOnHGlobal
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoCancelCall
CLSIDFromString
CoEnableCallCancellation
CoDisableCallCancellation
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
setupapi
SetupIterateCabinetW
ws2_32
FreeAddrInfoW
WSAStartup
GetAddrInfoW
gdiplus
GdipDeleteBrush
GdipCreateSolidFill
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDrawImageRectRectI
GdiplusStartup
GdipDrawImageRectI
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromStream
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
rpcrt4
RpcStringFreeW
UuidToStringW
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 140KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 635KB - Virtual size: 634KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ