Setup[.]ebin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.ebin
Size

8.4MB
MD5

9d3cfcf72253b3d11b1b269052a32e98
SHA1

8388da555b646579280a6cb969a69e4193b68428
SHA256

d2946c09d18e13ea08180292614564ffc419457e006f2872a958b714325e2b8a
SHA512

ec14e852116fff1aafe75a9922b225b694b68470c3b828d48bcc65124967a6c3dc763ce2132f2dbdc5f4279b6555538c2503acb352fc45008d8df76b6d225968
SSDEEP

196608:AqCqbKZd582NBaZNqFn4X+vsw6GLGuP/ZnSkr8u6yVcfdi5O:AqCXd5hNBaOFnhsGXZS5NyVL5O

Score

1^/10

Malware Config

Signatures

Files

Setup.ebin
.exe windows:5 windows x86 arch:x86

b51da05fdbfe3b52d2e0cdae0b451d4a

Code Sign

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9
Certificate

Issuer

CN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m

Not Before

23/11/2023, 09:28

Not After

24/11/2033, 09:28

Subject

CN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:84:30:39:05:71:63:62:5e:02:fc:15:d9:18:c7:52:76:93:96:18:0a:58:f2:39:fa:f8:fc:e8:c9:9a:27:73
Signer

Actual PE Digest

4c:84:30:39:05:71:63:62:5e:02:fc:15:d9:18:c7:52:76:93:96:18:0a:58:f2:39:fa:f8:fc:e8:c9:9a:27:73

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_EH_prolog

kernel32

IsProcessorFeaturePresent
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharToOemA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

advapi32

RegOpenKeyExA

ole32

CoInitializeSecurity

oleaut32

VariantClear

shlwapi

ord155

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.…²Î
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.…²Î
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp‰�
Size: - Virtual size: 973KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp‰�
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp‰�
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b51da05fdbfe3b52d2e0cdae0b451d4a

Code Sign

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

4c:84:30:39:05:71:63:62:5e:02:fc:15:d9:18:c7:52:76:93:96:18:0a:58:f2:39:fa:f8:fc:e8:c9:9a:27:73Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

Sections

.text Size: - Virtual size: 119KB

.rdata Size: - Virtual size: 40KB

.data Size: - Virtual size: 7.1MB

.…²Î Size: - Virtual size: 2.5MB

.…²Î Size: - Virtual size: 1.9MB

.vmp‰� Size: - Virtual size: 973KB

.vmp‰� Size: 1024B - Virtual size: 564B

.vmp‰� Size: 8.2MB - Virtual size: 8.2MB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 193KB - Virtual size: 193KB

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

4c:84:30:39:05:71:63:62:5e:02:fc:15:d9:18:c7:52:76:93:96:18:0a:58:f2:39:fa:f8:fc:e8:c9:9a:27:73
Signer

.text
Size: - Virtual size: 119KB

.rdata
Size: - Virtual size: 40KB

.data
Size: - Virtual size: 7.1MB

.…²Î
Size: - Virtual size: 2.5MB

.…²Î
Size: - Virtual size: 1.9MB

.vmp‰�
Size: - Virtual size: 973KB

.vmp‰�
Size: 1024B - Virtual size: 564B

.vmp‰�
Size: 8.2MB - Virtual size: 8.2MB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 193KB - Virtual size: 193KB