Isetup2[.]exe | Triage™

General

Target
Isetup2.exe
Size 764KB
Sample240519-bkwfyaaf55
SHA256 4ea1ba89caf3d2c01cb65b9b56c0ec569a975df788572aa6a95537b546f3a2fc
MD5 9ca07a18755fef4e505b233f3dddb6ea
SHA1 707705d5d4898eaef1238429447783db28554ba9
SHA512 4d8e43c3398064ffd37868617d76814cb27ba541724f4a5943d05e4ffe03afcfbf7dc293b62107803cd7b9ff5c059b9241c27fee15d7e2ae9716164c6d836693
SSDEEP 12288:UBfdmQiTgXF/OHYMhHQ7hLJQ9w5DUAinUKjZjk3G1MxnIDN5hZ2+y5JHF:UBFmntH9i7RJQ9wiBMxIHhKHF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Isetup2.exe

.exe 764KB

Isetup2.exe

IMPHASH 70229c3a1d4b2e17d3131a0bf773a764
SHA256 4ea1ba89caf3d2c01cb65b9b56c0ec569a975df788572aa6a95537b546f3a2fc
MD5 9ca07a18755fef4e505b233f3dddb6ea
SHA1 707705d5d4898eaef1238429447783db28554ba9
SHA512 4d8e43c3398064ffd37868617d76814cb27ba541724f4a5943d05e4ffe03afcfbf7dc293b62107803cd7b9ff5c059b9241c27fee15d7e2ae9716164c6d836693
SSDEEP 12288:UBfdmQiTgXF/OHYMhHQ7hLJQ9w5DUAinUKjZjk3G1MxnIDN5hZ2+y5JHF:UBFmntH9i7RJQ9wiBMxIHhKHF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

27:07:e6:97:a2:1b:86:a2:7c:6e:d9:49:03:5f:b0:ab:1b:e0:57:5c:91:c0:27:54:da:05:1a:eb:9d:be:82:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 17, 2024

Minor OS version

0

Major OS version

6

Entry point

78044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathA CloseHandle WaitForSingleObject Sleep CreateProcessA AllocConsole FreeConsole EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

190KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

139KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Isetup2.exe

PE Signature issue

kernel32

generic