Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

624KB
MD5

db25814df34e1a5b382b8be4ea49f14c
SHA1

303aa937f18c0d368094aa421a732b915df7f013
SHA256

a7b971d9bfd17f0e924be9c4930e8fe1fa9cbd6f4d26b941aaeeb9ce6abb18d1
SHA512

d604e49e4c38607e6b080ad0fa566102864bb67fb2daae881d5dd37afaee33a3e68e5b5b0ee7629c689505448cfa95fc6a2ea8a212dec97fe41649e4fb988ed4
SSDEEP

6144:PiBB3+u/E66HkHWADZevX+2lgHvnC3/e3QBcHcr:PiBp+hDHkHWAD4vcvCvewxr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.exe

Files

Setup.exe
.exe windows:4 windows x86 arch:x86

e1e9ff4928a3529c193e575999619d6f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupCopyOEMInfA

shlwapi

PathFindExtensionA
PathIsDirectoryA
PathFileExistsA
PathRemoveFileSpecA

kernel32

HeapFree
HeapAlloc
RaiseException
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapSize
GetTimeZoneInformation
GetACP
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
RtlUnwind
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTickCount
WritePrivateProfileStringA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetThreadLocale
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DuplicateHandle
SetErrorMode
GetOEMCP
GetCPInfo
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GlobalFlags
GetProcessVersion
GlobalAlloc
lstrcmpA
GetCurrentThread
MulDiv
FindNextFileA
SetLastError
SetFileAttributesA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FindFirstFileA
FindClose
lstrcpynA
GetFileTime
GetFileSize
GetFileAttributesA
MultiByteToWideChar
InterlockedIncrement
GetVersion
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
CreateFileA
lstrlenW
WideCharToMultiByte
Sleep
InterlockedDecrement
GetSystemDefaultLangID
CopyFileA
FormatMessageA
SetCurrentDirectoryA
GetTempPathA
GetModuleFileNameA
GetVersionExA
GetSystemDirectoryA
GetCurrentDirectoryA
lstrcatA
lstrcpyA
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
GetPrivateProfileStringA
DeleteFileA
FindResourceA
LoadResource
SizeofResource
LockResource
lstrlenA
GetCurrentProcess
GetLastError
LocalFree
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
InterlockedExchange
GetProfileStringA
IsBadWritePtr

user32

MessageBeep
GetNextDlgGroupItem
SetRect
CopyAcceleratorTableA
CharNextA
CharUpperA
DestroyMenu
GetDesktopWindow
PtInRect
GetSysColorBrush
SetWindowContextHelpId
GetMessageA
TranslateMessage
ValidateRect
GetCursorPos
PostQuitMessage
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
MoveWindow
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
MapWindowPoints
GetSysColor
PeekMessageA
DispatchMessageA
ScreenToClient
CopyRect
IsWindowVisible
MessageBoxA
IsChild
WinHelpA
GetClassInfoA
RegisterClassA
PostThreadMessageA
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetKeyState
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
RegisterClipboardFormatA
InflateRect
InvalidateRect
EndDialog
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowRect
DefDlgProcA
IsWindowUnicode
AdjustWindowRectEx
PostMessageA
GetParent
EnableWindow
SendMessageA
wsprintfA
LoadStringA
ReleaseDC
GetDC
LoadBitmapA
GetDlgItem
FindWindowA
GetDlgCtrlID
GetNextDlgTabItem
EnumWindows
GetWindowTextA
GetClassNameA
LoadIconA
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SetWindowPos
ShowWindow
GetTopWindow
GetWindow
SetCursor
LoadCursorA
UpdateWindow
IsWindowEnabled
SetFocus
GetFocus
GetWindowLongA
MapDialogRect
GetCapture
GetActiveWindow
SetActiveWindow
CheckMenuItem

gdi32

GetTextColor
GetBkColor
DPtoLP
LPtoDP
PatBlt
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateSolidBrush
GetWindowExtEx
GetViewportExtEx
SetBkColor
DeleteObject
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateDIBitmap
SetTextColor
GetClipBox
GetObjectA
GetMapMode
GetDeviceCaps
IntersectClipRect
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

CryptDestroyHash
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
RegCreateKeyExA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
SetNamedSecurityInfoA
CryptReleaseContext
RegSetValueExA
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
AllocateAndInitializeSid
OpenProcessToken
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

ShellExecuteA

comctl32

ord17

oledlg

ord8

ole32

CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
CoRevokeClassObject

olepro32

ord253

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen
VariantClear
VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysAllocStringByteLen
SysStringLen

Sections

.text
Size: 184KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1e9ff4928a3529c193e575999619d6f

Headers

File Characteristics

Imports

setupapi

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 184KB - Virtual size: 181KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 24KB - Virtual size: 38KB

.rsrc Size: 364KB - Virtual size: 362KB

.text
Size: 184KB - Virtual size: 181KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 24KB - Virtual size: 38KB

.rsrc
Size: 364KB - Virtual size: 362KB