setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

786KB
MD5

54d0c197c0ec22f6bcc1ee521b59b593
SHA1

cd76b7d98903758ed7b53c4daff04e0f94b5b47e
SHA256

1fa7ef783a81ed730bd40540e0aec4c1b42ba7eef52ddb28311f2086580db766
SHA512

f0f8f2cefb8467d6ce5dccf7abfa6ef792cf462274f14d6c9639cfae74eca157e8129fe37b8650116b97481bbbdc183d02331acc9b7eafed54bbca2a130f7821
SSDEEP

6144:GXhf4Ax+Xcz26/8VDtJMl4ZJGjYjVkTz2IHAQo2iqMnmChsroaNneWGTVYPDdqC+:GZXQD6YG8jNIHAQoP1H85LdXF3qWny

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

Files

setup.exe
.exe windows:4 windows x86 arch:x86

f4eb8d5227db584830b3c3c7048ed9e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

WriteFile
lstrcpynA
lstrcmpiA
GetFileAttributesA
lstrcatA
FindClose
FindFirstFileA
IsBadReadPtr
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
CreateFileMappingA
VirtualQuery
CompareStringA
CreateDirectoryA
CompareStringW
GetCurrentDirectoryA
ExpandEnvironmentStringsA
SetFileAttributesA
FileTimeToLocalFileTime
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
IsDBCSLeadByte
MoveFileExA
GetProcAddress
GetModuleHandleA
GetDriveTypeA
lstrcpyA
lstrlenA
Sleep
CloseHandle
CreateProcessA
lstrlenW
FindResourceExA
GetPrivateProfileIntA
GetFileSize
SetFilePointer
CreateEventA
QueryPerformanceFrequency
GetSystemTimeAsFileTime
ReleaseMutex
GetSystemDefaultLangID
CreateMutexA
SetErrorMode
LoadLibraryA
FreeLibrary
GetDiskFreeSpaceA
VerLanguageNameA
ReadFile
GetTickCount
GetCommandLineA
ExitThread
CreateThread
GetExitCodeProcess
FreeResource
MulDiv
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
GetLocaleInfoA
GetWindowsDirectoryA
InterlockedDecrement
LocalFree
InterlockedIncrement
FormatMessageA
GetTempPathA
GetVersionExA
CreateFileA
GlobalFree
FindResourceA
LoadResource
SizeofResource
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GetSystemDirectoryA
SetCurrentDirectoryA
WaitForSingleObject
ExitProcess
GetCurrentProcess
GetModuleFileNameA
DuplicateHandle
GetThreadContext
VirtualProtectEx
WriteProcessMemory
FlushInstructionCache
SetThreadContext
ResumeThread
GetLastError
SetLastError
DeleteFileA
RemoveDirectoryA
MultiByteToWideChar
WideCharToMultiByte
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
FindNextFileA
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
lstrcmpA
SystemTimeToFileTime
QueryPerformanceCounter
SetEvent
ResetEvent
SearchPathA
VirtualProtect
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetVersion
GetCurrentProcessId
InitializeCriticalSection
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
HeapReAlloc
RaiseException
RtlUnwind
DeleteCriticalSection
InterlockedExchange
GetTempFileNameA
OpenProcess
CompareFileTime
GetProcessTimes
TerminateProcess
GetLocalTime
GetTimeFormatA
GetDateFormatA

user32

CharUpperA
DialogBoxIndirectParamA
WaitForInputIdle
SetActiveWindow
SetForegroundWindow
SetWindowLongA
SetWindowTextA
SendMessageA
GetDlgItem
LoadIconA
EndDialog
MoveWindow
GetWindowRect
wsprintfA
MessageBoxA
SetFocus
BeginPaint
LoadStringA
FillRect
EndPaint
GetMessageA
DefWindowProcA
GetWindow
SystemParametersInfoA
GetSystemMetrics
MapWindowPoints
GetPropA
EnableMenuItem
SetPropA
RemovePropA
GetSysColor
LoadImageA
GetDC
ReleaseDC
CreateDialogParamA
GetParent
GetWindowTextA
IsWindowVisible
CreateDialogIndirectParamA
GetDesktopWindow
ExitWindowsEx
RegisterClassExA
InvalidateRect
IntersectRect
EnumChildWindows
GetWindowDC
GetDlgItemTextA
CreateWindowExA
UpdateWindow
DrawIcon
MapDialogRect
GetClassNameA
CallWindowProcA
DrawFocusRect
InflateRect
DrawTextA
CopyRect
GetClientRect
IsWindowEnabled
FindWindowExA
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
EnableWindow
ShowWindow
SendDlgItemMessageA
PostMessageA
ScreenToClient
SetWindowPos
IsWindow
DestroyWindow
GetWindowLongA
SetDlgItemTextA

gdi32

SetBkMode
SetTextColor
TextOutA
RestoreDC
SetBkColor
CreateSolidBrush
UnrealizeObject
SelectPalette
RealizePalette
BitBlt
CreateCompatibleDC
SelectObject
GetDIBColorTable
GetSystemPaletteEntries
CreatePalette
DeleteDC
CreateHalftonePalette
GetDeviceCaps
TranslateCharsetInfo
GetObjectA
CreateFontIndirectA
DeleteObject
DeleteMetaFile
CreateCompatibleBitmap
CreateDCA
GetStockObject
GetTextExtentPoint32A
CreatePatternBrush
CreateDIBitmap
SetMetaFileBitsEx
SetStretchBltMode
SelectClipRgn
CreateRectRgn
SetPixel
PatBlt
PlayMetaFile
StretchBlt
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SaveDC

advapi32

SetSecurityDescriptorDacl
RegCreateKeyExA
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegDeleteKeyA
RegEnumValueA
RegQueryValueExA
RegDeleteValueA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegSetValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoInitialize
CoUninitialize
CoInitializeSecurity

oleaut32

VariantChangeType
VariantClear
GetErrorInfo
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SysReAllocStringLen

lz32

LZOpenFileA
LZCopy
LZClose

msi

ord87
ord168
ord8
ord136
ord141

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

Sections

.text
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4eb8d5227db584830b3c3c7048ed9e0

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

lz32

msi

rpcrt4

Sections

.text Size: 407KB - Virtual size: 406KB

.rdata Size: 57KB - Virtual size: 56KB

.data Size: 30KB - Virtual size: 37KB

.rsrc Size: 291KB - Virtual size: 290KB

.text
Size: 407KB - Virtual size: 406KB

.rdata
Size: 57KB - Virtual size: 56KB

.data
Size: 30KB - Virtual size: 37KB

.rsrc
Size: 291KB - Virtual size: 290KB