Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

5.3MB
MD5

b97f1e33de763f29fffc2987b87db5f9
SHA1

d761d2763a1f6fe5a496e2bb6154ab0c458f0c21
SHA256

e55217f73f8dbf197642e214c274e71a5c42916effdc73b8e70252e175c587a1
SHA512

36f2e46108a8dd8eaf551122be32f5c5f40df2ea3a1ad0c8e38cf98136f375afd5199717ca042470e1a396b4f84f799ffed644c7b85fa27b8fedc69c8c561465
SSDEEP

49152:yoSe2FxL55aKQ35Nqoe7fVO22SCDrbWXD3UcodT2BP60kNwNF5RlSiYecHF61X7z:Exaw4jK2gYvnAg8zyAX++NpO0z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.exe

Files

Setup.exe
.exe windows:6 windows x64 arch:x64

eb0cb35206dccb2a417ff573d6b7f0a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindFirstFileW
GetConsoleMode
GetStdHandle
GetFinalPathNameByHandleW
SetLastError
CloseHandle
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockShared
WakeConditionVariable
SleepConditionVariableSRW
CreateThread
TryAcquireSRWLockExclusive
SetFileCompletionNotificationModes
GetCurrentThread
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetTempPathA
Sleep
HeapSize
GetModuleHandleA
UnmapViewOfFile
WriteConsoleW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
CreateIoCompletionPort
MultiByteToWideChar
GetQueuedCompletionStatusEx
SetHandleInformation
WakeAllConditionVariable
HeapReAlloc
GetFileAttributesW
GetSystemInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeConsole
HeapFree
HeapAlloc
GetProcessHeap
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetStdHandle
FindClose
FindNextFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetProcAddress
LoadLibraryA
WaitForSingleObject
PostQueuedCompletionStatus
SwitchToThread
GetLastError
HeapValidate
GetDiskFreeSpaceA

crypt32

CertCloseStore
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateContext
CryptUnprotectData
CertAddCertificateContextToStore
CertGetCertificateChain
CertEnumCertificatesInStore
CertDuplicateStore
CertDuplicateCertificateContext
CertOpenStore

ws2_32

bind
WSAIoctl
setsockopt
ioctlsocket
WSASocketW
getsockname
WSAGetLastError
getpeername
getsockopt
closesocket
shutdown
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
recv
send
WSASend
connect

secur32

FreeCredentialsHandle
EncryptMessage
ApplyControlToken
DecryptMessage
QueryContextAttributesW
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
AcquireCredentialsHandleA
DeleteSecurityContext

bcrypt

BCryptGenRandom

advapi32

RegCloseKey
SystemFunction036
RegQueryValueExW
RegOpenKeyExW

iphlpapi

GetAdaptersAddresses

vcruntime140

__CxxFrameHandler3
__C_specific_handler
memcpy
memset
memmove
memcmp
strrchr
__current_exception
__current_exception_context

api-ms-win-crt-string-l1-1-0

strcspn
strspn
strncmp
strlen
strcmp

api-ms-win-crt-math-l1-1-0

pow
log
__setusermatherr

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_set_new_mode
_msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_register_onexit_function
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
_crt_atexit
terminate
__p___argc
__p___argv
_cexit
_register_thread_local_exe_atexit_callback
_c_exit
_endthreadex

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb0cb35206dccb2a417ff573d6b7f0a8

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

crypt32

ws2_32

secur32

bcrypt

advapi32

iphlpapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 25KB - Virtual size: 27KB

.pdata Size: 96KB - Virtual size: 95KB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 25KB - Virtual size: 27KB

.pdata
Size: 96KB - Virtual size: 95KB

.reloc
Size: 29KB - Virtual size: 28KB