SilentSetup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SilentSetup.exe
Size 8.9MB
Sample260602-pf13hsd18r
SHA256 f41e0ef9fbc2828d03c28047b3bb5122c7c4fc8a3fb96e163c6caaf4be3606ab
MD5 6f42a58a212a552c255d304835e7783f
SHA1 05a28daa6a562b37822eb3ece41bf1daa7e5629d
SHA512 e6b900a634c29bd4b2e4434fd012ba6bd499ea571a233bcd9a4c4d8a70543d829f04fa398dd5c68663af5188b208f625751ad9fd9de1357eb614add4bf9a30e5
SSDEEP 98304:NOGeuuh2QtBs8K6xGvUb1gKMCDK/pf81/GMaeRlKNotsuwMOncuggvI3w:NOG7uh2gu8K6ovUb6KM61/GMNnKNTLI
TLSH
T197968D6B2BB940E5D03BC17CCA92CB46F6B270551B215BDB45A1435E2F33BE44E3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SilentSetup.exe

File Explorer

SilentSetup.exe

.exe 8.9MB

SilentSetup.exe

IMPHASH d490403586fc0245170c57b1181cf565
SHA256 f41e0ef9fbc2828d03c28047b3bb5122c7c4fc8a3fb96e163c6caaf4be3606ab
MD5 6f42a58a212a552c255d304835e7783f
SHA1 05a28daa6a562b37822eb3ece41bf1daa7e5629d
SHA512 e6b900a634c29bd4b2e4434fd012ba6bd499ea571a233bcd9a4c4d8a70543d829f04fa398dd5c68663af5188b208f625751ad9fd9de1357eb614add4bf9a30e5
SSDEEP 98304:NOGeuuh2QtBs8K6xGvUb1gKMCDK/pf81/GMaeRlKNotsuwMOncuggvI3w:NOG7uh2gu8K6ovUb6KM61/GMNnKNTLI
TLSH
T197968D6B2BB940E5D03BC17CCA92CB46F6B270551B215BDB45A1435E2F33BE44E3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4606376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins-root\workspace\VNC_6.6.x\label\win-ent\bld64\RelWithDebInfo\vncviewer.pdb

crypt32

CryptUnprotectData CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertGetCertificateContextProperty CryptAcquireCertificatePrivateKey CryptProtectData CertGetEnhancedKeyUsage CertOpenStore

ws2_32

WSADuplicateSocketW WSASocketW htons ntohs WSAEnumNetworkEvents WSAEventSelect WSAIoctl accept bind closesocket ioctlsocket getsockopt setsockopt socket WSAStartup WSAConnect getpeername getservbyname getsockname shutdown send recv select listen WSASendTo WSASend WSASetLastError htonl getservbyport gethostbyname gethostbyaddr ntohl inet_ntoa inet_addr WSAGetLastError

comctl32

InitCommonControlsEx ImageList_ReplaceIcon ImageList_Add ImageList_Create _TrackMouseEvent ImageList_Destroy

imm32

ImmGetVirtualKey ImmGetContext ImmSetOpenStatus

kernel32

GetCurrentDirectoryW CreateDirectoryW RemoveDirectoryW GetFileAttributesW GetFileAttributesExW DeleteFileW MoveFileW LockResource LoadResource SizeofResource FindResourceW GetComputerNameW LoadLibraryA GetSystemDirectoryA GetSystemDirectoryW LCMapStringW GetTempPathW GetTempFileNameW CreateThread GetCurrentThread GetThreadTimes TerminateThread ResumeThread OutputDebugStringW RtlCaptureStackBackTrace GetModuleHandleExW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetExitCodeProcess LocalAlloc FlushFileBuffers GetNumberFormatW GetSystemInfo MapViewOfFile UnmapViewOfFile CreateFileMappingW GetTimeFormatW GetDateFormatW ExitProcess RaiseException VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount CompareStringW CreateNamedPipeW ConnectNamedPipe WaitForMultipleObjects GetUserDefaultLCID GetLocaleInfoW FindNextFileW FindFirstFileW OpenProcess CreateProcessW SetHandleInformation DuplicateHandle SetFilePointer SearchPathW GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter GetSystemTimeAsFileTime GetProcAddress GetCommandLineW WriteConsoleW ReadConsoleW FreeConsole AllocConsole GetConsoleMode SetStdHandle GetFileType SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc WideCharToMultiByte MultiByteToWideChar GetModuleHandleW LocalFree CancelIo GetOverlappedResult WaitForSingleObject Sleep GetCurrentThreadId ExpandEnvironmentStringsW SetFileAttributesW CreateFileW GlobalFree GlobalAlloc GlobalUnlock GlobalLock GlobalSize CreateEventW CloseHandle ResetEvent SetEvent DeleteCriticalSection EnterCriticalSection InitializeCriticalSection GetVolumeInformationW FindFirstFileA GetFileAttributesA GetDiskFreeSpaceExW SetEndOfFile GetDiskFreeSpaceW GetDriveTypeW FindClose GetLogicalDrives SetErrorMode GetModuleFileNameW LoadLibraryW FreeLibrary LeaveCriticalSection ReadFile WriteFile GetStdHandle GetLastError GetCurrentProcessId SetCurrentDirectoryW GetHandleInformation HeapSize GetProcessId FormatMessageW SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList EncodePointer LoadLibraryExW SetFilePointerEx GetConsoleCP GetModuleFileNameA GetACP HeapAlloc HeapFree IsValidLocale EnumSystemLocalesW GetStringTypeW SetConsoleCtrlHandler OutputDebugStringA HeapReAlloc SetEnvironmentVariableA SetEnvironmentVariableW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetVersionExW

user32

DefWindowProcW ChangeDisplaySettingsExW EnumDisplaySettingsW MonitorFromRect MonitorFromWindow GetMonitorInfoW EnumDisplayMonitors MsgWaitForMultipleObjects DefDlgProcW DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW CallWindowProcW ChangeClipboardChain SetClipboardViewer SendMessageTimeoutW CreateMenu SetMenu SetParent ShowCursor ScrollWindowEx GetDoubleClickTime IsWindowVisible SetWindowRgn IsZoomed CloseClipboard OpenClipboard GetClipboardOwner GetParent CallNextHookEx GetForegroundWindow SetWindowsHookExW MessageBoxW IsDialogMessageW EnumChildWindows GetWindowLongPtrW SetWindowTextW EndDialog DialogBoxParamW PeekMessageW SetMenuItemInfoW InsertMenuItemW DeleteMenu GetMenuItemCount CheckMenuItem GetMenuState WindowFromPoint GetClassNameW IsWindowEnabled PostMessageW GetCursor OffsetRect GetWindowTextLengthW GetWindowTextW GetKeyState GetClipboardData LoadIconW GetDesktopWindow SetWindowLongPtrW SetForegroundWindow ReleaseCapture SetCapture GetDlgCtrlID MapVirtualKeyW keybd_event VkKeyScanExW VkKeyScanExA ToAsciiEx GetAsyncKeyState GetKeyboardLayoutList ToUnicodeEx SendInput mouse_event UnhookWindowsHookEx PostThreadMessageW PostQuitMessage GetSystemMetrics GetCursorPos SendMessageW GetSystemMenu EnableMenuItem GetDlgItem EnableWindow ShowWindow SetWindowPos DrawTextW BeginPaint EndPaint GetClientRect GetWindowRect TranslateMessage GetKeyboardLayoutNameW DispatchMessageW GetWindowLongW CreateIconIndirect RegisterWindowMessageW RedrawWindow KillTimer CreateDialogParamW SetTimer GetWindowPlacement IsChild GetMessageW GetComboBoxInfo InflateRect DrawFocusRect DrawFrameControl GetKeyboardState GetKeyboardLayout MapWindowPoints SetCursor MessageBeep AdjustWindowRectEx UpdateWindow IsIconic FrameRect GetAncestor GetNextDlgTabItem SystemParametersInfoW FillRect ReleaseDC GetWindowDC GetDC GetScrollInfo SetScrollInfo DrawIconEx DestroyIcon LoadCursorW GetSysColorBrush ScreenToClient ClientToScreen InvalidateRect SetMenuDefaultItem TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetMessagePos RegisterClipboardFormatW GetSysColor GetFocus SetFocus EmptyClipboard SetClipboardData GetWindowThreadProcessId GetOpenClipboardWindow SetWindowLongW

gdi32

StretchBlt GetClipBox CreateDCW SetDIBColorTable CreateDIBSection GdiAlphaBlend SetPixelV CreateBitmap SetMapMode GetTextExtentPoint32W CreateFontIndirectW GetTextMetricsW CreateRectRgnIndirect ExcludeClipRect GetPixel PatBlt SetBrushOrgEx SetWindowOrgEx SetStretchBltMode SetRectRgn SetPaletteEntries SelectPalette RealizePalette OffsetRgn GetRegionData GetRandomRgn CreateRectRgn CreatePalette CombineRgn BitBlt GetObjectW RoundRect CreateSolidBrush CreateCompatibleBitmap SetBkColor Rectangle GetStockObject CreateBrushIndirect MoveToEx LineTo DeleteObject CreatePen StretchDIBits GetDeviceCaps EndPage StartPage EndDoc StartDocW ResetDCW DeleteDC SetTextColor SetBkMode GetDIBits CreateCompatibleDC SelectObject

shell32

SHGetFolderPathW SHGetMalloc SHAddToRecentDocs SHFileOperationW Shell_NotifyIconW ord74 SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW SHGetFileInfoW SHGetDesktopFolder

ole32

CoTaskMemFree OleGetClipboard ReleaseStgMedium OleSetClipboard CoTaskMemAlloc CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoCreateInstance PropVariantClear OleInitialize RegisterDragDrop DoDragDrop CoTaskMemRealloc CoInitializeSecurity CoSetProxyBlanket OleUninitialize CoInitializeEx CoUninitialize

oleaut32

SafeArrayGetDim SysFreeString SysAllocString SafeArrayGetElement VariantClear

comdlg32

CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW

advapi32

DeregisterEventSource CryptSetProvParam CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashW CreateProcessAsUserW OpenProcessToken EqualSid RegCloseKey CryptGenRandom CryptAcquireContextW MakeAbsoluteSD MakeSelfRelativeSD SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorControl GetSecurityDescriptorLength InitializeSecurityDescriptor SetEntriesInAclW GetAclInformation InitializeAcl LookupAccountNameW LookupAccountSidW CopySid GetLengthSid GetSidIdentifierAuthority FreeSid AllocateAndInitializeSid IsValidSid CreateProcessWithLogonW LogonUserW GetTokenInformation ReportEventW RegisterEventSourceW CryptReleaseContext GetUserNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo RegSetValueExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW

generic

count=18, id=241, version=40116,

count=162, id=243, version=40116,

count=29, id=242, version=40116,

count=7, id=199, version=41118,

count=10, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,

count=20, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,

count=1, id=136, version=30729,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=50, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=2, id=135, version=30729,

count=180, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=528, id=1, productName=Unmarked objects,

count=952, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=255, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=151,

count=1, id=258, productName=VS2017 v15.7.5 build 26433, version=26433,