spsetup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

spsetup.exe
Size

1.7MB
MD5

9636e30396e6b267c833e4d32af5eceb
SHA1

4c36579457f1e0038869fa4977f4cb17df73545e
SHA256

53ccf6303e377ddfd9166a3ed26621619147d1c5d49243d12d9264400b549c3c
SHA512

047f4b43e7edd88483dfb8a3319cabd9c27778277835921e2a2b2f337381ae02087fec91e177e5e7595980e19b131d53f825f3fce8937631be04389969ffec65
SSDEEP

49152:j7LJfE1HOpV+crX6HwGBn0bcxGoWG4XZCZWE7cRGo8sOgZT00a9CI3W1Fx7Xv:TpV3XzGBnw3jG+ZCZWE7cRGo8sOgZT0k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spsetup.exe

Files

spsetup.exe
.exe windows:6 windows x64 arch:x64

3947326078746c77ab3fd2fcd310d00e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LocalFree
GetStdHandle
GetEnvironmentVariableA
ExpandEnvironmentStringsA
SetCurrentDirectoryA
FindClose
FindFirstFileA
FindNextFileA
RemoveDirectoryA
CreateProcessW
GetStartupInfoW
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryExA
GlobalHandle
FormatMessageA
lstrcmpiA
MoveFileA
IsDBCSLeadByte
ReadFile
SetHandleInformation
CreatePipe
PeekNamedPipe
LocalUnlock
CreateProcessA
SetStdHandle
DeleteFileA
ReleaseMutex
CreateMutexA
GetCurrentProcess
GetCurrentThread
LoadLibraryA
GetStartupInfoA
CopyFileA
GetSystemDefaultLangID
LocalLock
LocalAlloc
GetModuleHandleW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
Sleep
InitializeCriticalSection
GetFileAttributesA
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
lstrcmpA
MulDiv
GetModuleFileNameA
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
SetLastError
FindResourceA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
FreeResource
ResumeThread
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
CloseHandle
GetExitCodeProcess
FindFirstFileExA
SetEndOfFile
DecodePointer
GetFullPathNameW
GetTimeZoneInformation
GetConsoleCP
FlushFileBuffers
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetACP
WriteFile
ExitProcess
HeapReAlloc
ReadConsoleW
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryA
lstrlenA
MoveFileExA
GetCurrentProcessId
TerminateProcess
OpenProcess
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
GetSystemInfo
VirtualProtect
VirtualQuery
SetDllDirectoryA
GetFileInformationByHandleEx
AttachConsole
GetSystemFirmwareTable
IsDebuggerPresent
OutputDebugStringW
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
GetStringTypeW
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileType

oleaut32

SysFreeString
VarUI4FromStr
SysAllocStringByteLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
OleLoadPicture
SysAllocString
SysAllocStringLen
SysStringLen

advapi32

RegConnectRegistryA
RegisterEventSourceA
RegQueryValueExA
LookupPrivilegeValueA
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
RegSetValueExA
RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
GetUserNameA
DeregisterEventSource
ReportEventA

comctl32

InitCommonControlsEx

libxml2_mt

xmlNewDoc
xmlBufferCreate
xmlNewNode
xmlDocGetRootElement
xmlHasProp
xmlDocDumpMemory
xmlNodeDump
xmlParseMemory
xmlXPathFreeObject
xmlXPathNewContext
xmlXPathFreeContext
xmlXPathEvalExpression
xmlBufferFree
xmlGetProp
xmlCleanupParser
xmlParseDoc
xmlDocSetRootElement
xmlAddChild
xmlFreeDoc
xmlParseFile
xmlKeepBlanksDefault

psapi

EnumProcessModules
GetModuleBaseNameA
EnumProcesses

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Sections

.text
Size: 700KB - Virtual size: 700KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 707KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pkbtqow
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3947326078746c77ab3fd2fcd310d00e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

advapi32

comctl32

libxml2_mt

psapi

version

Sections

.text Size: 700KB - Virtual size: 700KB

.rdata Size: 270KB - Virtual size: 270KB

.data Size: 13KB - Virtual size: 21KB

.pdata Size: 32KB - Virtual size: 32KB

.gfids Size: 512B - Virtual size: 416B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 707KB - Virtual size: 707KB

.reloc Size: 32KB - Virtual size: 33KB

pkbtqow Size: - Virtual size: 4KB

.text
Size: 700KB - Virtual size: 700KB

.rdata
Size: 270KB - Virtual size: 270KB

.data
Size: 13KB - Virtual size: 21KB

.pdata
Size: 32KB - Virtual size: 32KB

.gfids
Size: 512B - Virtual size: 416B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 707KB - Virtual size: 707KB

.reloc
Size: 32KB - Virtual size: 33KB

pkbtqow
Size: - Virtual size: 4KB