ep_setup[.]exe | Triage™

Resubmissions

26/07/2024, 17:50

240726-wevbxaxgnh8

26/07/2024, 17:44

240726-wa8zhatern8

Sharing

Copy URL Twitter E-mail

General

Target
ep_setup.exe
Size 2.5MB
Sample240726-wevbxaxgnh
SHA256 6942de4845ca2bff1665cc1a0fb1a46eaa36404b7e4436dee9552ea5f2216f92
MD5 5458fa0f26db7314f2e53b4936703ece
SHA1 d254e1dd2910e41a98f0f93e2308db9298ad5ed3
SHA512 8164d225124c40c9eb43e45da1a8f160159f6d83b966c9fddedd36e09c53ca11ab592b01d412d3cc200ef4750bec01db9293c350828623a4aee87520ec0490c0
SSDEEP 24576:NRNmzbyiwF/OWJ6bThYVzp67D0azP845aeHE2uFPL2oiB3yYUIKZdcmx4r1em:pmvbIO0tVzpIuFzCYSKATem
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ep_setup.exe

File Explorer

ep_setup.exe

.exe 2.5MB

ep_setup.exe

IMPHASH 495641b4c53bdb7fd933007629f1edde
SHA256 6942de4845ca2bff1665cc1a0fb1a46eaa36404b7e4436dee9552ea5f2216f92
MD5 5458fa0f26db7314f2e53b4936703ece
SHA1 d254e1dd2910e41a98f0f93e2308db9298ad5ed3
SHA512 8164d225124c40c9eb43e45da1a8f160159f6d83b966c9fddedd36e09c53ca11ab592b01d412d3cc200ef4750bec01db9293c350828623a4aee87520ec0490c0
SSDEEP 24576:NRNmzbyiwF/OWJ6bThYVzp67D0azP845aeHE2uFPL2oiB3yYUIKZdcmx4r1em:pmvbIO0tVzpIuFzCYSKATem
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

21828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\ep_setup.pdb

kernel32

GetExitCodeProcess FindFirstFileW SetLastError WriteFile RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose CreateThread GetCurrentDirectoryW GetProcAddress MoveFileExW FreeLibrary CopyFileW CreateSymbolicLinkW MoveFileW LoadLibraryExW WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetProcessTimes WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW MultiByteToWideChar SetFilePointerEx GetConsoleMode GetConsoleOutputCP LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType MapViewOfFile CreateFileMappingW GetModuleHandleW CreateProcessW GetCurrentProcessId LocalFree GetWindowsDirectoryW K32EnumProcesses FindResourceW LoadResource FreeConsole CloseHandle DeleteFileW LockResource GetLastError Sleep CreateEventW OpenProcess FreeResource UnmapViewOfFile GetSystemDirectoryW K32GetProcessImageFileNameW GetCurrentThreadId CreateFileW LocalAlloc WaitForSingleObject TerminateProcess CreateDirectoryW GetCurrentProcess GetFileSizeEx SizeofResource GetEnvironmentStringsW HeapFree HeapAlloc GetStdHandle GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

user32

FindWindowW LoadIconW TranslateMessage LoadCursorW wsprintfW SetProcessDpiAwarenessContext SendMessageTimeoutW SendMessageW LoadStringW GetWindowThreadProcessId GetMessageW DefWindowProcW MessageBoxW CreateWindowExW RegisterClassExW DispatchMessageW ExitWindowsEx

advapi32

RegCreateKeyExW RevertToSelf EqualSid AllocateAndInitializeSid RegDeleteKeyValueW CreateProcessWithTokenW ImpersonateLoggedOnUser RegDeleteTreeW RegSetValueExW FreeSid CheckTokenMembership DuplicateTokenEx RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey OpenProcessToken RegOpenKeyExW RegGetValueW RegQueryValueExW GetTokenInformation

shell32

Shell_NotifyIconW SHGetFolderPathW SHFileOperationW CommandLineToArgvW ShellExecuteW ShellExecuteExW

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString

rstrtmgr

RmRegisterResources RmGetList RmStartSession RmShutdown RmEndSession RmRestart

version

VerQueryValueW

shlwapi

PathStripPathW PathFileExistsW PathRemoveFileSpecW PathRemoveExtensionW

Name

.text

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ep_setup.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

rstrtmgr

version

shlwapi

generic