setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 6.7MB
Sample240601-w1bfxsbf46
SHA256 8eef87212ca808b830123256be45cc0a800a77507ac9d646d6d656d04243dea6
MD5 53c49eb46e609dc60c4d8c2a399f3b44
SHA1 c90e831199880f0c1c25ee034329a04ccebd60bf
SHA512 e6bde4b7158ec51b609b16b17e4b3acba83c0cf3890274e243392eac84efbfc492380e8f100330ba9b42135e6bc82cefe25f7a51bdfb8b7b9cd61d4532471844
SSDEEP 98304:LbWKo/zVIQsun5MxKkCRrXZu+aV1ZIDHCYYgYM7yn5duKYO4rOiZZeMV61lIeaS:8+1Z9df4jFVgba
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 6.7MB

setup.exe

IMPHASH 2e2da7b94d1f6d997af1e3e644a0053a
SHA256 8eef87212ca808b830123256be45cc0a800a77507ac9d646d6d656d04243dea6
MD5 53c49eb46e609dc60c4d8c2a399f3b44
SHA1 c90e831199880f0c1c25ee034329a04ccebd60bf
SHA512 e6bde4b7158ec51b609b16b17e4b3acba83c0cf3890274e243392eac84efbfc492380e8f100330ba9b42135e6bc82cefe25f7a51bdfb8b7b9cd61d4532471844
SSDEEP 98304:LbWKo/zVIQsun5MxKkCRrXZu+aV1ZIDHCYYgYM7yn5duKYO4rOiZZeMV61lIeaS:8+1Z9df4jFVgba
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3775908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hecker\Desktop\Bloxshade-main\installer\bloxshade\src-tauri\target\release\deps\app.pdb

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx DeleteCriticalSection RtlPcToFileHeader InitializeSListHead GetModuleHandleW RaiseException AcquireSRWLockShared IsDebuggerPresent ReleaseSRWLockShared TryAcquireSRWLockExclusive EncodePointer lstrlenW LoadLibraryA CreateMutexA WaitForSingleObjectEx GetTempPathW GetSystemTimeAsFileTime GetCurrentThread CreateThread GetUserDefaultUILanguage WriteConsoleW MultiByteToWideChar UpdateProcThreadAttribute InitializeProcThreadAttributeList LCIDToLocaleName LoadLibraryW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW ReadFileEx CreateNamedPipeW GetFullPathNameW ExitProcess CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW MoveFileExW DeleteFileW FindFirstFileW CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetLastError OutputDebugStringA OutputDebugStringW InitializeCriticalSectionAndSpinCount TlsAlloc GetProcAddress GetCurrentThreadId LoadLibraryExW TlsGetValue CloseHandle TlsSetValue ReleaseSRWLockExclusive FreeLibrary GetEnvironmentVariableW SleepConditionVariableSRW GetSystemInfo GetFileInformationByHandleEx CreateFileW FindClose GetProcessHeap HeapFree HeapAlloc WaitForSingleObject FindNextFileW FormatMessageW ReleaseMutex HeapReAlloc Sleep GetModuleHandleA GetCurrentProcess DuplicateHandle CreatePipe GetFileInformationByHandle GetConsoleMode QueryPerformanceFrequency WakeConditionVariable FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread CreateWaitableTimerExW SetWaitableTimer QueryPerformanceCounter RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentStringsW SetEnvironmentVariableW AcquireSRWLockExclusive WakeAllConditionVariable GetCommandLineW SetFileInformationByHandle GetProcessId TerminateProcess GetExitCodeProcess SleepEx WriteFileEx GetCurrentProcessId GetStdHandle TlsFree

user32

AppendMenuW CreateMenu SetMenuItemInfoW CheckMenuItem ToUnicodeEx GetKeyboardLayout CreateIcon GetRawInputData LoadCursorW SetCursor SetMenu SendInput SetForegroundWindow GetMessageA GetWindowTextW GetWindowTextLengthW SetWindowTextW MonitorFromPoint EnumDisplayMonitors IsProcessDPIAware GetDC IsIconic SystemParametersInfoA IsWindowVisible DispatchMessageA ReleaseCapture ClientToScreen GetClientRect AdjustWindowRectEx GetWindowRect InvalidateRgn SetCursorPos SetWindowPos PostQuitMessage CreateAcceleratorTableW GetWindowLongPtrW GetActiveWindow SetWindowDisplayAffinity GetMenu GetWindowPlacement ShowCursor GetForegroundWindow SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW ClipCursor GetClipCursor EnableMenuItem GetSystemMenu ShowWindow SetWindowLongW SendMessageW DestroyAcceleratorTable DestroyIcon RedrawWindow PostThreadMessageW VkKeyScanW MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SetCapture SetWindowLongPtrW MsgWaitForMultipleObjectsEx RegisterRawInputDevices RegisterClassExW RegisterWindowMessageA DispatchMessageW EnumChildWindows TranslateMessage TranslateAcceleratorW GetAncestor GetMessageW MapVirtualKeyW PostMessageW DestroyWindow RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow GetCursorPos CloseTouchInputHandle ScreenToClient GetTouchInputInfo TrackMouseEvent MonitorFromRect GetWindowLongW

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance OleInitialize CreateStreamOnHGlobal RegisterDragDrop RevokeDragDrop CoTaskMemAlloc

shell32

SHGetKnownFolderPath SHAppBarMessage ShellExecuteW DragQueryFileW DragFinish

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

advapi32

RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister SystemFunction036

oleaut32

SysFreeString SetErrorInfo GetErrorInfo SysStringLen

bcrypt

BCryptGenRandom

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile NtCreateFile

api-ms-win-crt-math-l1-1-0

floor pow __setusermatherr trunc round

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s wcslen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_initterm _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm_e _cexit __p___argv _set_app_type exit _configure_narrow_argv _seh_filter_exe __p___argc _exit terminate _crt_atexit _register_onexit_function _initialize_narrow_environment _initialize_onexit_table _c_exit abort

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode calloc malloc

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

205KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

user32

comctl32

api-ms-win-shcore-scaling-l1-1-1

ole32

shell32

gdi32

dwmapi

uxtheme

advapi32

oleaut32

bcrypt

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic