Static task
static1
General
-
Target
SetupFile_882495.exe
-
Size
23.3MB
-
MD5
58a703894fdc593803296f098d1a4d15
-
SHA1
cb97ede36ef9ab5c95bb192c084351dcb490bb68
-
SHA256
2e1d346d508825855ae5c849341aa8d573adecb543cd8d4c196959d550787256
-
SHA512
5c311d40ffb05c741e9de2724d2137d1f46980bf2c736bfb66b19c55487fd71a3660afe5fcad9cb2c3d0bbdfe9befe7b5c8afe346125f65b9bf54c58dd92f566
-
SSDEEP
393216:U6b5R1iW9vFevjZ1wFC9WWajo0oeYvq4vHj5Xov/2MjdshHzeobmKNV+lMG5DMP9:U6b5R1iW89WWajo0oeYvq4vHj54vuVzT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SetupFile_882495.exe
Files
-
SetupFile_882495.exe.exe windows:6 windows x86 arch:x86
d0461df990406d115985c9a9aa005886
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
FindClose
InitializeCriticalSection
DeleteCriticalSection
GlobalMemoryStatus
ReadFile
IsValidLocale
MoveFileExW
IsProcessorFeaturePresent
EnumSystemLocalesW
GetEnvironmentVariableA
GetSystemTimeAsFileTime
AcquireSRWLockExclusive
DeleteTimerQueueTimer
GetCommandLineA
FindFirstFileExW
SleepEx
EncodePointer
SetEndOfFile
GetFileAttributesExW
QueryDepthSList
TlsAlloc
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
HeapFree
lstrcatA
GetFileSize
GetACP
ResetEvent
CreateEventW
GetDateFormatW
ExitThread
HeapReAlloc
GetCurrentProcessId
InterlockedFlushSList
InitializeSListHead
WriteFile
LocalFree
FileTimeToLocalFileTime
GetModuleHandleExW
GetEnvironmentStringsW
GetSystemDirectoryW
SetStdHandle
GetFileType
Sleep
RaiseException
GetLogicalProcessorInformation
CreateTimerQueueTimer
SignalObjectAndWait
GetProcAddress
SetUnhandledExceptionFilter
QueryPerformanceFrequency
DecodePointer
UnregisterWaitEx
WaitForSingleObject
GetTickCount
GetNumaHighestNodeNumber
SetPriorityClass
InterlockedPushEntrySList
FreeLibraryAndExitThread
GetCommandLineW
GetModuleFileNameW
GetLocaleInfoW
FreeLibrary
DeleteFileW
FreeEnvironmentStringsW
GlobalAlloc
WriteConsoleW
GlobalLock
CompareFileTime
TlsSetValue
HeapAlloc
ReleaseSemaphore
FlushFileBuffers
GetModuleHandleA
FindNextFileW
GetStartupInfoW
HeapSize
VirtualProtect
VerSetConditionMask
WaitForSingleObjectEx
GetLastError
GetCurrentThreadId
SetFilePointerEx
InitializeCriticalSectionAndSpinCount
SetFileAttributesW
InitializeCriticalSectionEx
FindFirstFileW
UnhandledExceptionFilter
TryEnterCriticalSection
ExitProcess
SwitchToThread
CloseHandle
GetFileAttributesW
CompareStringW
GetThreadTimes
GetCPInfo
GetFileInformationByHandle
QueryPerformanceCounter
WaitForMultipleObjects
CreateDirectoryW
VerifyVersionInfoW
IsValidCodePage
CreateFileW
SetEvent
SetThreadAffinityMask
GlobalFree
GetUserDefaultLCID
GetCurrentThread
TlsFree
ChangeTimerQueueTimer
GetOEMCP
GetConsoleOutputCP
InterlockedPopEntrySList
SetLastError
WideCharToMultiByte
GetVersion
VirtualFree
SetEnvironmentVariableW
ReleaseSRWLockExclusive
GetProcessHeap
SetFileTime
GetCurrentDirectoryW
GetProcessAffinityMask
FileTimeToSystemTime
GetCurrentProcess
GetThreadPriority
GetFullPathNameW
GetSystemInfo
GlobalUnlock
CreateTimerQueue
DuplicateHandle
FormatMessageW
SystemTimeToTzSpecificLocalTime
TlsGetValue
RtlUnwind
GetLogicalDriveStringsW
CreateSemaphoreW
SetThreadPriority
PeekNamedPipe
GetDriveTypeW
LeaveCriticalSection
VirtualAlloc
LCMapStringW
SetFilePointer
RegisterWaitForSingleObject
GetTimeFormatW
RemoveDirectoryW
GetModuleHandleW
GetVersionExW
LoadLibraryW
lstrlenA
EnterCriticalSection
LoadLibraryExW
GetFileSizeEx
MultiByteToWideChar
GetStringTypeW
GetTickCount64
IsDebuggerPresent
TerminateProcess
MoveFileW
CreateThread
UnregisterWait
user32
KillTimer
ScreenToClient
LoadStringW
SetDlgItemTextW
SetWindowTextW
EnableWindow
MoveWindow
CloseClipboard
GetDlgItem
MapDialogRect
GetParent
EndDialog
GetWindowTextW
GetWindowRect
EmptyClipboard
SetCursor
GetWindowTextLengthW
wsprintfA
MessageBoxW
GetFocus
CharUpperW
InvalidateRect
SetClipboardData
GetMonitorInfoA
SetTimer
MonitorFromWindow
MessageBoxA
PostMessageW
ShowWindow
SendMessageW
CheckDlgButton
LoadCursorW
GetKeyState
IsDlgButtonChecked
DialogBoxParamW
GetWindowLongW
OpenClipboard
SetFocus
LoadIconW
SystemParametersInfoW
SetWindowLongW
advapi32
CloseServiceHandle
CryptHashData
CryptReleaseContext
CryptGetHashParam
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptAcquireContextW
CryptCreateHash
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
ole32
CoInitialize
OleInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen
bcrypt
BCryptGenRandom
crypt32
CertFindCertificateInStore
CryptDecodeObjectEx
CertFreeCertificateChainEngine
CertEnumCertificatesInStore
CryptStringToBinaryW
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCreateCertificateChainEngine
PFXImportCertStore
CertFindExtension
CertOpenStore
CertCloseStore
CertGetCertificateChain
CertFreeCertificateChain
wldap32
ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ws2_32
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAEnumNetworkEvents
WSAIoctl
getsockopt
send
WSAWaitForMultipleEvents
freeaddrinfo
WSAEventSelect
socket
WSACloseEvent
getaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSACreateEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSAResetEvent
Sections
.text Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 279KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ