StartSetup_20221[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

StartSetup_20221.exe
Size

36.6MB
MD5

1c1f71500e57b1b5d0b701d33695410a
SHA1

579a1ee80a60df0418bff3e2bb997b22ada3ad4c
SHA256

ea9316d6571a44b3a621229e402c27d0fed99403450a7400771fff634f78e5a6
SHA512

4aa8d1f6044e4d36e5ed8990aa067aafe50fccc8fa270120f5ad6df68d347e92973c5dfa8eef3d02bfc074da55170c8bbb313087ccdfb8877b96de9727d4af16
SSDEEP

786432:3bbOULnsdHsJgXv746tDYFN3tx4hO5+JhTM3YEsVI1QkvkUmP1R0SDBJZ9GixzRR:xtFN3tShOoJhTya6MUiRHXZV4Yoffs4y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StartSetup_20221.exe

Files

StartSetup_20221.exe
.exe windows:6 windows x86

ab7917c1f116757b304c7d1ea164ac40

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObjectEx
GetFileAttributesA
CloseHandle
CompareStringW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
InitializeCriticalSectionEx
GetModuleHandleExW
GetSystemWow64DirectoryW
FormatMessageA
GetCurrentDirectoryA
WideCharToMultiByte
EncodePointer
FindFirstFileExW
ExitThread
WriteConsoleW
UnhandledExceptionFilter
LoadLibraryExW
TlsGetValue
WaitForMultipleObjects
IsDebuggerPresent
IsValidCodePage
lstrlenA
FindFirstFileA
GetCurrentThreadId
GetCommandLineW
GetCurrentThread
GetLogicalDriveStringsW
GetLastError
GetSystemTimeAsFileTime
CreateFileA
SetFilePointer
GlobalUnlock
CreateSemaphoreA
FreeEnvironmentStringsW
EnumSystemLocalesW
GetProcessHeap
SetEndOfFile
MoveFileExW
GetProcessAffinityMask
GetConsoleMode
CreateThread
DeleteFileW
GetStringTypeW
GetDateFormatW
HeapAlloc
IsProcessorFeaturePresent
FindFirstFileW
GetStartupInfoW
IsValidLocale
GetConsoleOutputCP
GetFileType
CreateDirectoryW
GetFileInformationByHandle
VirtualAlloc
GlobalFree
GetFileSize
FileTimeToLocalFileTime
RtlUnwind
LoadLibraryA
RemoveDirectoryA
AreFileApisANSI
DeleteFileA
SetFileAttributesW
DeleteCriticalSection
SystemTimeToTzSpecificLocalTime
MultiByteToWideChar
FlushFileBuffers
TerminateProcess
GetACP
SetFileAttributesA
GetModuleFileNameW
VerSetConditionMask
GlobalAlloc
GetCurrentProcess
MoveFileW
SetFilePointerEx
FindClose
LoadLibraryW
GetEnvironmentVariableA
lstrcatW
LCMapStringEx
GetFileAttributesW
GetModuleFileNameA
GetProcAddress
lstrlenW
PeekNamedPipe
InitializeSListHead
GetCPInfo
GetModuleHandleA
LocalFree
CompareFileTime
GetTimeZoneInformation
SetLastError
VirtualFree
TlsFree
EnterCriticalSection
GetLogicalDriveStringsA
SetEvent
GlobalMemoryStatus
TlsSetValue
GetSystemDirectoryW
DecodePointer
GetDriveTypeW
GetVersionExA
HeapSize
FreeLibraryAndExitThread
HeapFree
SleepEx
QueryPerformanceFrequency
GlobalLock
GetCurrentProcessId
WriteFile
GetUserDefaultLCID
SetStdHandle
GetLocaleInfoW
GetStdHandle
RemoveDirectoryW
ResetEvent
CreateDirectoryA
ReadConsoleW
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetFileSizeEx
LeaveCriticalSection
FreeLibrary
SetFileTime
FindNextFileW
lstrcatA
SetEnvironmentVariableW
GetTickCount64
GetOEMCP
ExitProcess
InitializeCriticalSection
ReadFile
CreateFileW
GetCurrentDirectoryW
HeapReAlloc
FindNextFileA
VerifyVersionInfoW
TlsAlloc
QueryPerformanceCounter
GetSystemInfo
FormatMessageW
ReleaseSRWLockExclusive
ReleaseSemaphore
RaiseException
GetTickCount
FileTimeToSystemTime
LCMapStringW
GetModuleHandleW
Sleep
AcquireSRWLockExclusive
CreateEventA
GetFullPathNameW
MoveFileA
WaitForSingleObject
GetTimeFormatW
SetPriorityClass

user32

GetWindowTextW
PostMessageA
MapDialogRect
GetWindowTextLengthW
SetWindowLongA
CharUpperA
EnableWindow
LoadStringA
MonitorFromWindow
GetWindowTextLengthA
DialogBoxParamA
GetMonitorInfoA
GetDlgItem
GetKeyState
SetClipboardData
SystemParametersInfoA
GetWindowRect
LoadCursorA
GetFocus
LoadIconA
SetTimer
CharUpperW
MoveWindow
SetWindowTextW
ShowWindow
SendMessageW
MessageBoxW
InvalidateRect
KillTimer
SetFocus
SetWindowTextA
CheckDlgButton
EmptyClipboard
ScreenToClient
GetWindowTextA
OpenClipboard
SetCursor
EndDialog
SendMessageA
wsprintfA
MessageBoxA
CloseClipboard
IsDlgButtonChecked
GetWindowLongA
GetParent
DialogBoxParamW
LoadStringW

advapi32

CryptGetHashParam
RegSetValueExW
CryptEncrypt
RegCloseKey
CryptDestroyHash
RegOpenKeyExW
CryptDestroyKey
RegCreateKeyExW
CryptReleaseContext
CryptImportKey
CryptAcquireContextW
CryptHashData
CryptCreateHash

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderPathW
SHGetMalloc
CommandLineToArgvW

ole32

CoUninitialize
OleInitialize
CoInitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

bcrypt

BCryptGenRandom

crypt32

CertFindExtension
CertFreeCertificateContext
CryptQueryObject
CertFreeCertificateChain
CertEnumCertificatesInStore
CertCloseStore
CertGetNameStringW
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertFindCertificateInStore
CryptStringToBinaryW
CertCreateCertificateChainEngine
CertOpenStore
PFXImportCertStore
CryptDecodeObjectEx

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ord27

ws2_32

getpeername
sendto
recvfrom
WSAWaitForMultipleEvents
socket
ioctlsocket
gethostname
getsockopt
send
WSACloseEvent
getaddrinfo
WSAEventSelect
freeaddrinfo
WSAIoctl
WSACreateEvent
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSAEnumNetworkEvents
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSAResetEvent

Sections

.text
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab7917c1f116757b304c7d1ea164ac40

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.4MB - Virtual size: 6.4MB

.rdata Size: 229KB - Virtual size: 229KB

.data Size: 8KB - Virtual size: 28KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 78KB - Virtual size: 78KB

.text
Size: 6.4MB - Virtual size: 6.4MB

.rdata
Size: 229KB - Virtual size: 229KB

.data
Size: 8KB - Virtual size: 28KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 78KB - Virtual size: 78KB