VanishSetup[.]exe | Triage™

General

Target
VanishSetup.exe
Size 135.0MB
Sample260622-jsmsrsas4k
SHA256 f039d3435f8bf7862ed25e1342d6c19fc4fdf0c4d1634340822bbce0ba3b49dc
MD5 235b60aff298e74178d28920ae56683e
SHA1 f52d6a2d22b392abc1af0803284f0b862d825d24
SHA512 ae23ab5c516eb5590f804761443fc4fcf21595dcabea87040b317ccf561784b3a16383ce36892b43942a6d4162a6420130f3a836fd9cb9d7871b9f1bef3b1e09
SSDEEP 3145728:CMQZi1AYJFmGlrkuboVAefUDSGzsRGxJgOybM0RfZD4k:CTZebjD0krbuIsR4
TLSH
T18368333C0A1ACC4FD32CF5B1AAA5075174D6BD202746B4B1D6A747FAAC79AC3D70A2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VanishSetup.exe

File Explorer

VanishSetup.exe

.exe 135.0MB

VanishSetup.exe

IMPHASH e6f4169f2a5c3a8f93171d9f593bd22a
SHA256 f039d3435f8bf7862ed25e1342d6c19fc4fdf0c4d1634340822bbce0ba3b49dc
MD5 235b60aff298e74178d28920ae56683e
SHA1 f52d6a2d22b392abc1af0803284f0b862d825d24
SHA512 ae23ab5c516eb5590f804761443fc4fcf21595dcabea87040b317ccf561784b3a16383ce36892b43942a6d4162a6420130f3a836fd9cb9d7871b9f1bef3b1e09
SSDEEP 3145728:CMQZi1AYJFmGlrkuboVAefUDSGzsRGxJgOybM0RfZD4k:CTZebjD0krbuIsR4
TLSH
T18368333C0A1ACC4FD32CF5B1AAA5075174D6BD202746B4B1D6A747FAAC79AC3D70A2D0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\Setup.pdb

kernel32

LoadResource FindResourceW lstrlenW GetProcAddress GetModuleHandleW DeleteCriticalSection GetTempPathW GetLastError GetTempFileNameW MoveFileW WaitForSingleObject GetExitCodeProcess CloseHandle DeleteFileW GetModuleFileNameW GetCurrentProcess LoadLibraryW FreeLibrary InitializeCriticalSectionEx GetFileAttributesW CreateFileW SetFilePointer ReadFile VerSetConditionMask GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW WriteFile SetFileTime FreeResource SizeofResource LockResource CreateProcessW GetSystemDirectoryW SetDefaultDllDirectories GetCurrentThreadId DecodePointer RaiseException LeaveCriticalSection EnterCriticalSection lstrcmpiW LoadLibraryExW GetConsoleMode GetConsoleCP SystemTimeToFileTime VerifyVersionInfoW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx FlushFileBuffers WriteConsoleW

shlwapi

PathIsUNCW

comctl32

InitCommonControlsEx

Sharing