setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 742KB
Sample240729-2yy24avdpp
SHA256 be65a8d884dbb5c292c2ae94591cc6c86909bcd7ddb42588932afaf9ce15728e
MD5 13fd90197ba55324bd01b9fa97f5295a
SHA1 313ac91a6ea6e75c0fe75f65d1254905491b59f6
SHA512 a2d7a2b666f712b57f1cbed89598ad783589b93d4e0b67ccbe5d8ac4f8b3faf18c704a5606953319090dbf974f5cd9bc600ee3b7695c47cc92db5d9a8227f6fb
SSDEEP 12288:hx2+AAPYnxYN43oEFdodmbI+9KvWzFk0QCsX5D7rIOpw9:hx2MYnxsSDd4L+9KOzWdCI5D7EOa9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 742KB

setup.exe

IMPHASH ae274c29ca15928cb1e23f2e712ba155
SHA256 be65a8d884dbb5c292c2ae94591cc6c86909bcd7ddb42588932afaf9ce15728e
MD5 13fd90197ba55324bd01b9fa97f5295a
SHA1 313ac91a6ea6e75c0fe75f65d1254905491b59f6
SHA512 a2d7a2b666f712b57f1cbed89598ad783589b93d4e0b67ccbe5d8ac4f8b3faf18c704a5606953319090dbf974f5cd9bc600ee3b7695c47cc92db5d9a8227f6fb
SSDEEP 12288:hx2+AAPYnxYN43oEFdodmbI+9KvWzFk0QCsX5D7rIOpw9:hx2MYnxsSDd4L+9KOzWdCI5D7EOa9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PulseEvent ReadConsoleInputW GetFirmwareEnvironmentVariableW GetCPInfoExW CreateEventW CopyFileExA GetProcAddress GlobalAlloc SetDefaultCommConfigA OpenWaitableTimerW GetFileAttributesW EnumResourceTypesW WriteFileGather GetModuleHandleW InterlockedCompareExchange UnhandledExceptionFilter LocalFlags GlobalLock GetConsoleAliasW WritePrivateProfileSectionA FindFirstVolumeMountPointA SetLastError SleepEx AddAtomA lstrcmpA SetCalendarInfoA GetSystemWindowsDirectoryA EnumTimeFormatsW GetSystemDirectoryW AddAtomW GetExitCodeThread _llseek FindNextFileW CopyFileA GetShortPathNameW EnumCalendarInfoA EnumCalendarInfoExA AddRefActCtx SetStdHandle WriteConsoleW GetCurrentThreadId LoadLibraryA CloseHandle SetFilePointer ReadFile FlushFileBuffers InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException HeapReAlloc HeapAlloc MoveFileA DeleteFileA GetCommandLineA HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess WriteFile GetStdHandle GetModuleFileNameW SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetStringTypeW GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW GetConsoleCP GetConsoleMode CreateFileW

user32

LoadMenuW

advapi32

LookupAccountSidW

shell32

FindExecutableA

ole32

CoGetInstanceFromFile