Static task
static1
Behavioral task
behavioral1
Sample
Setupprogram_01234.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Setupprogram_01234.exe
Resource
win10v2004-20240412-en
General
-
Target
d5d8bb613252f25ef6b679698ddc0775fadae2908231e356f40e442922282fd6
-
Size
19.6MB
-
MD5
225084c44d28fc604ff21adf910088ee
-
SHA1
22e30ad9c1412400cf4434c07b639b50653e2f01
-
SHA256
d5d8bb613252f25ef6b679698ddc0775fadae2908231e356f40e442922282fd6
-
SHA512
1d39f919ef0d1aca0b9a043c729bde64e7eeeb94db09cd64bf1ea71cc0ac8cc09988c8fbd82b688138eff63cf7d1a8249b118d24c03a446c33330eecb3d42560
-
SSDEEP
393216:UFU4A1myf32RMVRs6rpMNorLLPvFmTIQlZFBDCywNDFSQ5:e2p26Vi6qNALPsHlZFcy+J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setupprogram_01234.exe
Files
-
d5d8bb613252f25ef6b679698ddc0775fadae2908231e356f40e442922282fd6.zip
-
Setupprogram_01234.exe.exe windows:6 windows x86 arch:x86
e68f6e06458f4914010d75d6c214598e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeSListHead
TlsSetValue
GlobalLock
GetCurrentProcessId
GetModuleHandleW
GetFileSizeEx
RtlUnwind
GetModuleFileNameW
WaitForMultipleObjects
GetFileAttributesW
LeaveCriticalSection
CreateSemaphoreW
GetLocaleInfoW
FindFirstFileExW
WideCharToMultiByte
GlobalMemoryStatus
GetCurrentThread
ReadFile
TlsFree
SwitchToThread
DeleteTimerQueueTimer
ReadConsoleW
IsValidCodePage
lstrcatA
EnterCriticalSection
SetFilePointerEx
GetLastError
GetModuleHandleExW
GetThreadPriority
GetLogicalProcessorInformation
GetCurrentThreadId
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
GetACP
EnumSystemLocalesW
MoveFileW
LoadLibraryW
VirtualFree
GetTickCount64
SetFileAttributesW
SetEndOfFile
InterlockedFlushSList
LCMapStringW
GetStringTypeW
ResetEvent
GetFileType
VirtualProtect
TlsGetValue
IsProcessorFeaturePresent
WriteConsoleW
SetEnvironmentVariableW
ReleaseSRWLockExclusive
InitializeCriticalSection
VerSetConditionMask
GetNumaHighestNodeNumber
GetTickCount
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionEx
GetDateFormatW
HeapReAlloc
UnregisterWaitEx
SleepEx
DeleteCriticalSection
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentVariableA
FindFirstFileW
HeapAlloc
GetCurrentDirectoryW
AcquireSRWLockExclusive
ChangeTimerQueueTimer
GlobalFree
GetProcAddress
ExitProcess
GetProcessAffinityMask
SetLastError
SetFilePointer
IsDebuggerPresent
GetOEMCP
SetFileTime
CreateEventW
IsValidLocale
GetFullPathNameW
FreeLibraryAndExitThread
EncodePointer
SignalObjectAndWait
SetStdHandle
GetConsoleOutputCP
InterlockedPushEntrySList
TerminateProcess
CloseHandle
HeapSize
QueryDepthSList
CompareStringW
GetModuleHandleA
LocalFree
GetSystemInfo
VerifyVersionInfoW
GetVersionExW
GetThreadTimes
CreateTimerQueue
FindClose
ReleaseSemaphore
GetTimeFormatW
GlobalAlloc
GetCPInfo
FileTimeToSystemTime
CreateThread
FormatMessageW
DecodePointer
RaiseException
lstrlenA
FileTimeToLocalFileTime
GetCurrentProcess
GetLogicalDriveStringsW
GetEnvironmentStringsW
GetFileInformationByHandle
RemoveDirectoryW
HeapFree
CreateTimerQueueTimer
CreateFileW
UnhandledExceptionFilter
TryEnterCriticalSection
FlushFileBuffers
GetTimeZoneInformation
GlobalUnlock
GetDriveTypeW
QueryPerformanceFrequency
DeleteFileW
TlsAlloc
GetProcessHeap
CreateDirectoryW
GetVersion
VirtualAlloc
GetSystemTimeAsFileTime
WaitForSingleObjectEx
SetEvent
FreeLibrary
MultiByteToWideChar
GetStdHandle
GetCommandLineW
FindNextFileW
SetThreadPriority
RegisterWaitForSingleObject
WriteFile
FreeEnvironmentStringsW
GetCommandLineA
GetFileAttributesExW
MoveFileExW
PeekNamedPipe
DuplicateHandle
UnregisterWait
SetThreadAffinityMask
SetPriorityClass
SetUnhandledExceptionFilter
ExitThread
InterlockedPopEntrySList
GetConsoleMode
WaitForSingleObject
LoadLibraryExW
CompareFileTime
GetFileSize
GetStartupInfoW
Sleep
user32
ShowWindow
EnableWindow
GetWindowLongW
GetWindowTextW
OpenClipboard
DialogBoxParamW
LoadIconW
PostMessageW
CloseClipboard
MessageBoxW
LoadStringW
MoveWindow
MessageBoxA
InvalidateRect
GetParent
wsprintfA
SetFocus
GetMonitorInfoA
GetDlgItem
SetWindowLongW
SetCursor
GetWindowTextLengthW
CheckDlgButton
EndDialog
SetClipboardData
GetWindowRect
GetFocus
SystemParametersInfoW
GetKeyState
KillTimer
MapDialogRect
ScreenToClient
IsDlgButtonChecked
LoadCursorW
EmptyClipboard
SetTimer
SetWindowTextW
SetDlgItemTextW
SendMessageW
MonitorFromWindow
CharUpperW
advapi32
CryptReleaseContext
CryptImportKey
CryptCreateHash
CryptEncrypt
CryptAcquireContextW
CryptGetHashParam
CryptDestroyKey
CloseServiceHandle
CryptDestroyHash
CryptHashData
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoInitialize
CoUninitialize
OleInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen
bcrypt
BCryptGenRandom
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CryptDecodeObjectEx
CryptQueryObject
CertAddCertificateContextToStore
CertFindCertificateInStore
CertFreeCertificateChain
CertOpenStore
PFXImportCertStore
CertCloseStore
CertEnumCertificatesInStore
CertGetNameStringW
CertFreeCertificateContext
CryptStringToBinaryW
CertCreateCertificateChainEngine
CertFindExtension
wldap32
ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ws2_32
recvfrom
sendto
getpeername
ioctlsocket
gethostname
freeaddrinfo
WSACreateEvent
getsockopt
send
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAEventSelect
socket
WSAIoctl
WSAResetEvent
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
getaddrinfo
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSACloseEvent
Sections
.text Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ