setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

6.7MB
MD5

0f45bd783484b81e6cf68c1e433e5028
SHA1

ef0467023e36873b843ff0b1752b567fe7c065a8
SHA256

692fd837e45845c80f814de9fc8b4b8fef90a61534cea5b9fb50d44dee52ab5c
SHA512

1f3fec3b8391b80a0a82ba4df4e8fdf808d0173edef9a0f8f20d64a2938b5079f0ac1d7dc9126635523647beb7184a2d755c5aa2566f9c952754180e1460700d
SSDEEP

98304:d4BqhRzuIQsJmABRNki0r3wueafmOFyxCYPA71M6m15kyjib1rOit6wuKOUFk82S:HsmOqkX1jzujJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

Files

setup.exe
.exe windows:6 windows x64 arch:x64

2e2da7b94d1f6d997af1e3e644a0053a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\hecker\Desktop\Bloxshade-main\installer\bloxshade\src-tauri\target\release\deps\app.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RtlUnwindEx
DeleteCriticalSection
RtlPcToFileHeader
InitializeSListHead
GetModuleHandleW
RaiseException
AcquireSRWLockShared
IsDebuggerPresent
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
EncodePointer
lstrlenW
LoadLibraryA
CreateMutexA
WaitForSingleObjectEx
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
GetUserDefaultUILanguage
WriteConsoleW
MultiByteToWideChar
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
LCIDToLocaleName
LoadLibraryW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
CreateNamedPipeW
GetFullPathNameW
ExitProcess
CopyFileExW
GetFinalPathNameByHandleW
RemoveDirectoryW
MoveFileExW
DeleteFileW
FindFirstFileW
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
GetLastError
OutputDebugStringA
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetProcAddress
GetCurrentThreadId
LoadLibraryExW
TlsGetValue
CloseHandle
TlsSetValue
ReleaseSRWLockExclusive
FreeLibrary
GetEnvironmentVariableW
SleepConditionVariableSRW
GetSystemInfo
GetFileInformationByHandleEx
CreateFileW
FindClose
GetProcessHeap
HeapFree
HeapAlloc
WaitForSingleObject
FindNextFileW
FormatMessageW
ReleaseMutex
HeapReAlloc
Sleep
GetModuleHandleA
GetCurrentProcess
DuplicateHandle
CreatePipe
GetFileInformationByHandle
GetConsoleMode
QueryPerformanceFrequency
WakeConditionVariable
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
AcquireSRWLockExclusive
WakeAllConditionVariable
GetCommandLineW
SetFileInformationByHandle
GetProcessId
TerminateProcess
GetExitCodeProcess
SleepEx
WriteFileEx
GetCurrentProcessId
GetStdHandle
TlsFree

user32

AppendMenuW
CreateMenu
SetMenuItemInfoW
CheckMenuItem
ToUnicodeEx
GetKeyboardLayout
CreateIcon
GetRawInputData
LoadCursorW
SetCursor
SetMenu
SendInput
SetForegroundWindow
GetMessageA
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
MonitorFromPoint
EnumDisplayMonitors
IsProcessDPIAware
GetDC
IsIconic
SystemParametersInfoA
IsWindowVisible
DispatchMessageA
ReleaseCapture
ClientToScreen
GetClientRect
AdjustWindowRectEx
GetWindowRect
InvalidateRgn
SetCursorPos
SetWindowPos
PostQuitMessage
CreateAcceleratorTableW
GetWindowLongPtrW
GetActiveWindow
SetWindowDisplayAffinity
GetMenu
GetWindowPlacement
ShowCursor
GetForegroundWindow
SetWindowPlacement
PeekMessageW
ChangeDisplaySettingsExW
FlashWindowEx
DefWindowProcW
ClipCursor
GetClipCursor
EnableMenuItem
GetSystemMenu
ShowWindow
SetWindowLongW
SendMessageW
DestroyAcceleratorTable
DestroyIcon
RedrawWindow
PostThreadMessageW
VkKeyScanW
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
GetKeyboardState
SetCapture
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterClassExW
RegisterWindowMessageA
DispatchMessageW
EnumChildWindows
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
MapVirtualKeyW
PostMessageW
DestroyWindow
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
GetUpdateRect
ValidateRect
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetWindowLongW

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateInstance
OleInitialize
CreateStreamOnHGlobal
RegisterDragDrop
RevokeDragDrop
CoTaskMemAlloc

shell32

SHGetKnownFolderPath
SHAppBarMessage
ShellExecuteW
DragQueryFileW
DragFinish

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

advapi32

RegGetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
SystemFunction036

oleaut32

SysFreeString
SetErrorInfo
GetErrorInfo
SysStringLen

bcrypt

BCryptGenRandom

ntdll

NtReadFile
RtlNtStatusToDosError
NtWriteFile
NtCreateFile

api-ms-win-crt-math-l1-1-0

floor
pow
__setusermatherr
trunc
round

api-ms-win-crt-string-l1-1-0

wcsncmp
_wcsicmp
strcpy_s
wcslen

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm_e
_cexit
__p___argv
_set_app_type
exit
_configure_narrow_argv
_seh_filter_exe
__p___argc
_exit
terminate
_crt_atexit
_register_onexit_function
_initialize_narrow_environment
_initialize_onexit_table
_c_exit
abort

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_set_new_mode
calloc
malloc

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e2da7b94d1f6d997af1e3e644a0053a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comctl32

api-ms-win-shcore-scaling-l1-1-1

ole32

shell32

gdi32

dwmapi

uxtheme

advapi32

oleaut32

bcrypt

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 2.5MB - Virtual size: 2.5MB

.data Size: 1KB - Virtual size: 13KB

.pdata Size: 177KB - Virtual size: 177KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 205KB - Virtual size: 205KB

.reloc Size: 37KB - Virtual size: 37KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 1KB - Virtual size: 13KB

.pdata
Size: 177KB - Virtual size: 177KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 205KB - Virtual size: 205KB

.reloc
Size: 37KB - Virtual size: 37KB