Setup[.]Exe | Triage

Resubmissions

25/03/2024, 17:47

240325-wcxdgsee34 7

25/03/2024, 17:44

240325-wbfpcahc3y 7

25/03/2024, 17:40

240325-v8wldsec97 7

Sharing

Copy URL Twitter E-mail

General

Target

Setup.Exe
Size

580KB
MD5

ae9f731ef6bf35c70c9526c814ec6dc4
SHA1

2d5629b7bf6e506a67ca127a99b859d35ddb5d16
SHA256

dcfbc2431ba4c16d6d673502b5ed3ad9aeb45e8a2611a7baafd55361b6e2b349
SHA512

89a104eeb3ae9b567edab698a3f0643a1feac52ffb3ec48a818b83af8aa5462df1dcc53c6615a411d354f276d8c0f81a5eeb1cf8a327d05c0349da1d0d0aed5f
SSDEEP

12288:st8HvAGBRugty/GR5kGpjWSQxaoepwFqMve9J4B6w8k1E/zd3PpWV3lr7VjkPI4h:st8HvAGLuay/SGGpjWSQxaoepwFqMveX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.Exe

Files

Setup.Exe
.exe windows:4 windows x86 arch:x86

06f1cfaa3c4ea834ea2af610a5df812f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Vss\Setup1\Code\Austin\GenSetup\Release\Setup.pdb

Imports

winmm

PlaySoundA
waveOutGetNumDevs
timeGetTime
waveOutGetDevCapsA

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
GetVolumeInformationA
Sleep
GetSystemDirectoryA
ResetEvent
SetEvent
GetTempPathA
GetLastError
lstrcmpiA
FindFirstFileA
WaitForSingleObject
LocalFree
FormatMessageA
lstrcmpA
RemoveDirectoryA
IsDBCSLeadByte
GetFullPathNameA
lstrcpynA
GetWindowsDirectoryA
SetLastError
GetFileAttributesA
GetVersionExA
LockResource
LoadResource
FindResourceA
GetShortPathNameA
GetExitCodeProcess
GetUserDefaultLCID
GetLocaleInfoA
VerLanguageNameA
CreateProcessA
SetFileAttributesA
GetTempFileNameA
ReleaseMutex
CreateMutexA
OpenEventA
CreateEventA
GetModuleHandleA
MultiByteToWideChar
VirtualProtect
SizeofResource
FindFirstChangeNotificationA
FindCloseChangeNotification
FindNextChangeNotification
GetPrivateProfileStringA
TerminateProcess
WaitForMultipleObjects
WritePrivateProfileStringA
SetFilePointer
ExpandEnvironmentStringsA
GetDriveTypeA
_lclose
_llseek
_lopen
GetSystemTime
FindClose
VirtualFree
SetErrorMode
VirtualAlloc
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetTickCount
DeviceIoControl
CreateDirectoryA
WriteFile
ReadFile
SetFileTime
GetFileTime
GetFileSize
GetFileType
MoveFileExA
SetEndOfFile
GetCurrentDirectoryA
CopyFileA
DeleteFileA
GetModuleFileNameA
GetDiskFreeSpaceA
SetCurrentDirectoryA
GetLogicalDrives
FindNextFileA
ResumeThread
SetPriorityClass
GetCurrentThread
SetThreadPriority
GetEnvironmentVariableA
FlushFileBuffers
CreateThread
WideCharToMultiByte
CompareFileTime
QueryPerformanceCounter
GetThreadPriority
GetPriorityClass
QueryPerformanceFrequency
ExitThread
GetExitCodeThread
SuspendThread
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
RtlUnwind
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapFree
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
LCMapStringA
LCMapStringW
lstrcatA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
VirtualQuery
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
GetACP
GetOEMCP
IsBadCodePtr
GetTimeZoneInformation
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
CloseHandle
lstrcpyA
lstrlenA
GetSystemDefaultLangID
GetCPInfo

user32

CharUpperA
ReleaseDC
GetDC
EnumDisplaySettingsA
ExitWindowsEx
IsWindow
SystemParametersInfoA
GetClassNameA
CharToOemA
FindWindowExA
EnumWindows
SetCursor
LoadCursorA
DestroyCursor
IsDialogMessageA
GetMessageA
GetWindowLongA
RedrawWindow
GetUpdateRect
EndPaint
BeginPaint
CopyRect
IntersectRect
SetWindowTextA
GetWindowRect
IsWindowVisible
UnionRect
IsChild
IsRectEmpty
RemovePropA
GetWindowTextA
ReleaseCapture
GetCapture
EnableWindow
GetParent
GetNextDlgGroupItem
MsgWaitForMultipleObjects
OffsetRect
SetCapture
GetKeyState
GetNextDlgTabItem
ScreenToClient
CallWindowProcA
GetClassInfoA
ClientToScreen
PtInRect
DrawTextA
DrawTextExA
GrayStringA
SetWindowRgn
CreateDialogIndirectParamA
EndDialog
MessageBeep
MapWindowPoints
GetMessagePos
DialogBoxIndirectParamA
RegisterWindowMessageA
GetSystemMetrics
GetWindowPlacement
SetWindowLongA
PostQuitMessage
EnableMenuItem
InvalidateRect
FillRect
LoadIconA
EqualRect
GetWindowTextLengthA
GetAsyncKeyState
VkKeyScanExA
GetKeyboardLayout
LoadStringA
CharPrevA
GetKeyboardType
PeekMessageA
TranslateMessage
DispatchMessageA
GetDesktopWindow
WaitForInputIdle
LoadImageA
wvsprintfA
UnregisterClassA
IsWindowEnabled
SetTimer
KillTimer
wsprintfA
PostMessageA
SetWindowPos
IsIconic
GetFocus
FindWindowA
ShowWindow
SetRectEmpty
CreateWindowExA
SetPropA
RegisterClassA
DefWindowProcA
GetPropA
DestroyWindow
SetForegroundWindow
SetFocus
SetActiveWindow
CharNextA
SendMessageA
MessageBoxA

gdi32

SetBkColor
SetBkMode
SetTextColor
SelectObject
GetTextMetricsA
SetTextAlign
SelectPalette
GetDeviceCaps
RealizePalette
CreateDIBSection
SetDIBits
DeleteObject
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetSystemPaletteEntries
GetObjectA
GetDIBColorTable
CreateFontA
CreateCompatibleDC
BitBlt
DeleteDC
CombineRgn
CreateBrushIndirect
CreateRectRgn
GetStockObject
AddFontResourceA
RemoveFontResourceA

advapi32

RegQueryInfoKeyA
OpenProcessToken
RegCloseKey
CloseServiceHandle
OpenSCManagerA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyExA

comctl32

ImageList_LoadImageA
ImageList_Destroy

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

imm32

ImmGetContext

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteExA
SHChangeNotify

ole32

CoCreateInstance
CoInitialize
OleUninitialize
OleInitialize
CoUninitialize

Exports

Exports

?DialogProc@CAppAlert@@SGHPAUHWND__@@IIJ@Z
?DialogProc@CAppMessage@@SGHPAUHWND__@@IIJ@Z
?DialogProc@CDirBrowser@@SGHPAUHWND__@@IIJ@Z
?HotsetupCallback@@YG?AW4EBURETCODE@@PAX@Z
LaunchGame

Sections

.text
Size: 440KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

06f1cfaa3c4ea834ea2af610a5df812f

Headers

File Characteristics

PDB Paths

Imports

winmm

kernel32

user32

gdi32

advapi32

comctl32

version

imm32

shell32

ole32

Exports

Exports

Sections

.text Size: 440KB - Virtual size: 436KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 24KB - Virtual size: 63KB

.rsrc Size: 40KB - Virtual size: 36KB

.text
Size: 440KB - Virtual size: 436KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 24KB - Virtual size: 63KB

.rsrc
Size: 40KB - Virtual size: 36KB