HC2Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
HC2Setup.exe
Size 631KB
Sample240921-knef9stepq
SHA256 6a06b2ba1a32b703d65f43d49ddaa8e74d8f5add21a8ab04aa0044937a5a50c5
MD5 f96a73b23464366e4158620b10fa52c5
SHA1 1b048d127670ea9c113c3582c7d2bfde2bc4b32a
SHA512 2639aa5b6b954d6492fb1116309f0810f68b758717f7b0158107296a515c1b326cdf166590e173a00a92d14dcc80e7aa2e9f4495806890f530b79d17e12ec6b3
SSDEEP 12288:qr3ZBIRB5Ij7QaClHwJFispW/tB7/x+irBvMb4AcKoUvTUfT2uk0pKBLMYN9UUvq:2ZB2B+j+wJF+/H7x+irBuocTvuPpKBAZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

HC2Setup.exe

.exe 631KB

HC2Setup.exe

IMPHASH 87b324a67e18fb2e1d12308b06fa8d4f
SHA256 6a06b2ba1a32b703d65f43d49ddaa8e74d8f5add21a8ab04aa0044937a5a50c5
MD5 f96a73b23464366e4158620b10fa52c5
SHA1 1b048d127670ea9c113c3582c7d2bfde2bc4b32a
SHA512 2639aa5b6b954d6492fb1116309f0810f68b758717f7b0158107296a515c1b326cdf166590e173a00a92d14dcc80e7aa2e9f4495806890f530b79d17e12ec6b3
SSDEEP 12288:qr3ZBIRB5Ij7QaClHwJFispW/tB7/x+irBvMb4AcKoUvTUfT2uk0pKBLMYN9UUvq:2ZB2B+j+wJF+/H7x+irBuocTvuPpKBAZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Hyperionics Technology\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Hyperionics Technology\, LLC,L=Murrysville,ST=Pennsylvania,C=US

Serial Number

5a:5f:28:0a:34:ad:9f:ba:9a:af:5e:62:ae:8f:98:4c

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 5, 2006 - Sep 3, 2007

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetFileSecurityA SetFileSecurityW

kernel32

CloseHandle CompareStringA CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DeleteFileA DeleteFileW DosDateTimeToFileTime ExitProcess ExpandEnvironmentStringsA FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FindResourceA FreeLibrary GetCPInfo GetCommandLineA GetCurrentDirectoryA GetCurrentProcess GetDateFormatA GetFileAttributesA GetFileAttributesW GetFileType GetFullPathNameA GetLastError GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetNumberFormatA GetProcAddress GetProcessHeap GetStdHandle GetTempPathA GetTickCount GetTimeFormatA GetVersionExA GlobalAlloc HeapAlloc HeapFree HeapReAlloc IsDBCSLeadByte LoadLibraryA LocalFileTimeToFileTime MoveFileA MoveFileExA MultiByteToWideChar ReadFile SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableA SetFileAttributesA SetFileAttributesW SetFilePointer SetFileTime SetLastError Sleep SystemTimeToFileTime WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpiA lstrlenA

comctl32

ord17

comdlg32

CommDlgExtendedError GetOpenFileNameA

gdi32

DeleteObject

shell32

SHBrowseForFolderA SHChangeNotify SHFileOperationA SHGetFileInfoA SHGetMalloc SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA

user32

CharToOemA CharToOemBuffA CharUpperA CopyRect CreateWindowExA DefWindowProcA DestroyIcon DestroyWindow DialogBoxParamA DispatchMessageA EnableWindow EndDialog FindWindowExA GetClassNameA GetClientRect GetDlgItem GetDlgItemTextA GetMessageA GetParent GetSysColor GetSystemMetrics GetWindow GetWindowLongA GetWindowRect GetWindowTextA IsWindow IsWindowVisible LoadBitmapA LoadCursorA LoadIconA LoadStringA MapWindowPoints MessageBoxA OemToCharA OemToCharBuffA PeekMessageA PostMessageA RegisterClassExA SendDlgItemMessageA SendMessageA SetDlgItemTextA SetFocus SetMenu SetWindowLongA SetWindowPos SetWindowTextA ShowWindow TranslateMessage UpdateWindow WaitForInputIdle wsprintfA wvsprintfA

ole32

CLSIDFromString CoCreateInstance CreateStreamOnHGlobal OleInitialize OleUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

HC2Setup.exe

PE Signature issue

advapi32

kernel32

comctl32

comdlg32

gdi32

shell32

user32

ole32

generic