Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 3.5MB
Sample260703-efwspaf12l
SHA256 657076159f541e0dfc3020cfca3f12a7c38a7ec87425c73a47eaa80bc06e52d7
MD5 9c384f2b734e3920642eb404554a790e
SHA1 9fd4be89e66c40e89d328f562fe91e598a384f88
SHA512 1e87fb60b20f1ef83d35159ca7daa72839f355b621dff4cd85c8ee6091ef1727a48ce7fb06b6ff3933a6105dfcce8b291104f83ae1762c09b60ed92939c6a280
SSDEEP 98304:2JMC229vKlYzcXl9RV/LTtm1gf/mg559ZFzvZI9Y9lq6:9lYAXxHUgp5Vl/
TLSH
T1A606122591563E79F637823DC5BA4262F8367C0D0392C8DB33A2A8E82CA7FDC5775611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.exe

File Explorer

Setup.exe

.exe 3.5MB

Setup.exe

IMPHASH 72c63918d4c41d7d5c75afb87d4d72d9
SHA256 657076159f541e0dfc3020cfca3f12a7c38a7ec87425c73a47eaa80bc06e52d7
MD5 9c384f2b734e3920642eb404554a790e
SHA1 9fd4be89e66c40e89d328f562fe91e598a384f88
SHA512 1e87fb60b20f1ef83d35159ca7daa72839f355b621dff4cd85c8ee6091ef1727a48ce7fb06b6ff3933a6105dfcce8b291104f83ae1762c09b60ed92939c6a280
SSDEEP 98304:2JMC229vKlYzcXl9RV/LTtm1gf/mg559ZFzvZI9Y9lq6:9lYAXxHUgp5Vl/
TLSH
T1A606122591563E79F637823DC5BA4262F8367C0D0392C8DB33A2A8E82CA7FDC5775611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\duckn\IdeaProjects\GreenCloudClient\build_injector\GreenCloudInjectable.pdb

kernel32

GetStdHandle CreateDirectoryW CreateFileW WriteFile CloseHandle LoadResource LockResource SizeofResource FindResourceW SetConsoleTextAttribute GetFileAttributesW GetLastError WaitForSingleObject GetCurrentProcess CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx IsWow64Process GetModuleHandleW GetProcAddress CopyFileW K32EnumProcessModulesEx K32GetModuleFileNameExW FlushFileBuffers GetTempPathW OutputDebugStringA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetLocalTime LocalFree FormatMessageA WideCharToMultiByte ReadProcessMemory QueryFullProcessImageNameW K32GetModuleBaseNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead

user32

IsWindowVisible GetWindowThreadProcessId GetWindowTextW EnumWindows

shell32

SHGetFolderPathW

msvcp140

??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQueryInformationProcess

vcruntime140

__current_exception_context memset memchr __std_exception_destroy __current_exception __C_specific_handler memmove memcpy __std_terminate memcmp _CxxThrowException __std_exception_copy __std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_at_quick_exit _get_initial_narrow_environment _initterm _initterm_e exit _exit _invoke_watson __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _execute_onexit_table _errno _register_onexit_function terminate _seh_filter_dll _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _cexit

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode _callnewh free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

towlower strlen _wcsicmp wcslen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode __stdio_common_vswprintf_s __stdio_common_vsprintf

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale