Static task
static1
Behavioral task
behavioral1
Sample
Setup_02026.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Setup_02026.exe
Resource
win10v2004-20240221-en
General
-
Target
95fce4113a59bb7299250061d397da824e051cc2146915b9a2dc8cd962437c53
-
Size
22.7MB
-
MD5
1bd908394b4d2335416d12039a1932e8
-
SHA1
78fd5cbb455d2c3ae345c81f3215a00036dcf50f
-
SHA256
95fce4113a59bb7299250061d397da824e051cc2146915b9a2dc8cd962437c53
-
SHA512
d7d8b05311028b546430066b38a90967e43a2166c7ad4e0da75aed25fa033a609586f2c61819934580b5b86475ae71be666725452fc761abd9c6627d71be8e04
-
SSDEEP
393216:f/XOAC6QIahuHqCC5JFR0mZJgZmDRdMOb+f1dD/boT3SrQfF8ebsiBtGgRc9HfMI:3eATQDhiVC5JVJ4AdMOb+f1dD/oqgjyX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup_02026.exe
Files
-
95fce4113a59bb7299250061d397da824e051cc2146915b9a2dc8cd962437c53.zip
-
Setup_02026.exe.exe windows:6 windows x86 arch:x86
6015e21507aa185352f6fe9887cbc5b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetOEMCP
GetFileInformationByHandle
GetCurrentThread
FindClose
InterlockedPopEntrySList
FlushFileBuffers
CreateEventA
AreFileApisANSI
DeleteFileA
GetProcAddress
FormatMessageA
GetDriveTypeW
FreeEnvironmentStringsW
GetThreadPriority
TlsAlloc
GetLogicalDriveStringsW
MultiByteToWideChar
GetLocaleInfoW
GetTickCount64
MoveFileExW
TryEnterCriticalSection
InterlockedPushEntrySList
UnregisterWaitEx
GetCurrentProcess
CreateTimerQueue
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
SetFileAttributesA
lstrlenA
SetEvent
WaitForSingleObject
GetDateFormatW
GlobalUnlock
ReadConsoleW
SwitchToThread
VirtualAlloc
FindFirstFileExA
SetThreadAffinityMask
GetThreadTimes
MoveFileA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetCPInfo
CreateEventW
SetFilePointer
GetLogicalDriveStringsA
TerminateProcess
SetFileTime
CreateSemaphoreA
EnterCriticalSection
GlobalFree
TlsFree
SetLastError
FindNextFileW
PeekNamedPipe
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
LeaveCriticalSection
GlobalLock
GetModuleHandleW
InterlockedFlushSList
FormatMessageW
UnregisterWait
TlsSetValue
FindNextFileA
GetCurrentProcessId
GetStdHandle
GetUserDefaultLCID
FindFirstFileA
ReadFile
lstrcatA
LoadLibraryW
HeapSize
MoveFileW
GetTickCount
SleepEx
WaitForSingleObjectEx
GetFileAttributesW
GetSystemTimeAsFileTime
SetEnvironmentVariableA
ChangeTimerQueueTimer
DecodePointer
GlobalMemoryStatus
TlsGetValue
DuplicateHandle
GetCommandLineW
GetFileSize
InitializeCriticalSection
SetEndOfFile
GetCurrentDirectoryA
Sleep
GetModuleFileNameA
FreeLibrary
CompareStringW
IsValidLocale
GetConsoleCP
GetConsoleMode
RtlUnwind
FindFirstFileW
LoadLibraryA
FileTimeToLocalFileTime
DeleteFileW
WaitForMultipleObjects
GetNumaHighestNodeNumber
GetCurrentDirectoryW
GetACP
CreateThread
SetFilePointerEx
FileTimeToSystemTime
FreeLibraryAndExitThread
GetModuleHandleExW
SignalObjectAndWait
CreateTimerQueueTimer
GetProcessAffinityMask
EncodePointer
GetSystemDirectoryW
WriteConsoleW
VerSetConditionMask
GetStringTypeW
SetThreadPriority
ReleaseSemaphore
GetFileType
GetLastError
QueryPerformanceCounter
ExitProcess
RemoveDirectoryA
GetEnvironmentStringsW
ExitThread
DeleteTimerQueueTimer
CreateFileA
CreateFileW
GetVersionExA
LoadLibraryExW
GetFullPathNameW
RegisterWaitForSingleObject
WriteFile
DeleteCriticalSection
GetFileAttributesExW
GetLogicalProcessorInformation
HeapFree
VirtualFree
QueryPerformanceFrequency
GetTimeFormatW
SetPriorityClass
CreateDirectoryA
LCMapStringW
GetFileSizeEx
IsValidCodePage
UnhandledExceptionFilter
QueryDepthSList
ResetEvent
CloseHandle
VerifyVersionInfoW
SetStdHandle
RemoveDirectoryW
InitializeCriticalSectionEx
GetVersion
AcquireSRWLockExclusive
WideCharToMultiByte
HeapReAlloc
ReleaseSRWLockExclusive
CompareFileTime
GetSystemInfo
RaiseException
IsProcessorFeaturePresent
GetEnvironmentVariableA
GetVersionExW
GlobalAlloc
GetModuleHandleA
InitializeSListHead
GetFileAttributesA
GetCurrentThreadId
LocalFree
GetCommandLineA
SystemTimeToTzSpecificLocalTime
GetStartupInfoW
SetFileAttributesW
CreateDirectoryW
user32
LoadCursorA
InvalidateRect
KillTimer
GetWindowTextLengthA
ScreenToClient
MapDialogRect
LoadIconA
DialogBoxParamW
CloseClipboard
EnableWindow
DialogBoxParamA
LoadStringW
IsDlgButtonChecked
GetDlgItem
SetTimer
MonitorFromWindow
ShowWindow
SetWindowTextA
SetFocus
GetWindowTextA
SystemParametersInfoA
GetWindowRect
GetFocus
PostMessageA
wsprintfA
GetWindowTextW
MoveWindow
CharUpperA
SetWindowTextW
SetClipboardData
GetWindowLongA
LoadStringA
CheckDlgButton
MessageBoxW
SetWindowLongA
GetParent
CharUpperW
SendMessageW
GetKeyState
GetMonitorInfoA
SetCursor
EmptyClipboard
OpenClipboard
GetWindowTextLengthW
EndDialog
SendMessageA
MessageBoxA
advapi32
CryptHashData
CryptDestroyKey
CryptReleaseContext
CryptEncrypt
CryptAcquireContextW
CryptImportKey
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CloseServiceHandle
shell32
SHGetSpecialFolderPathW
SHGetPathFromIDListA
SHGetFileInfoA
SHBrowseForFolderA
ole32
CoUninitialize
OleInitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
bcrypt
BCryptGenRandom
crypt32
CertFreeCertificateChainEngine
CertOpenStore
CertEnumCertificatesInStore
CertFindExtension
CertCloseStore
CertGetNameStringW
CryptStringToBinaryW
CryptQueryObject
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFindCertificateInStore
CertGetCertificateChain
CryptDecodeObjectEx
CertCreateCertificateChainEngine
PFXImportCertStore
CertFreeCertificateContext
wldap32
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ws2_32
WSACreateEvent
WSAEventSelect
recvfrom
sendto
getpeername
ioctlsocket
gethostname
socket
getsockopt
send
WSAIoctl
WSAWaitForMultipleEvents
getaddrinfo
WSACloseEvent
WSAEnumNetworkEvents
freeaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSAResetEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ