iCloudSetup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
iCloudSetup.exe
Size 153.7MB
Sample260706-eze92shx41
SHA256 4cfd20d13cdce2b5c435f2ddaf4ee4c81d976461846bf3b954e8af6cbcdeb9f7
MD5 029b6ee8b92cd54b7596a1530d7d9187
SHA1 cecb50aa208cc7d8ac42de79fb18cf817ca4a453
SHA512 fc458814f12313b936328f1378f90516d82693b41691aa56dc809ea11972a5904d090cf58aa5e2182daf8761b6d8c992b7b21035fbb704db537c605e8c453c46
SSDEEP 3145728:Hx2EAQkPGtUIEh7ONXXNsFesSS7ycoJwQ9BOJx7Tg+6Ao:M0C1IEh7OdNRjSA19BKPwr
TLSH
T18378335331328D23F9EEB938C9A229E2F444DDA1965465FB580EE70973B73902D38B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

iCloudSetup.exe

.exe 153.7MB

iCloudSetup.exe

IMPHASH ac4a2657285a6d3a9d6e39e46afd4342
SHA256 4cfd20d13cdce2b5c435f2ddaf4ee4c81d976461846bf3b954e8af6cbcdeb9f7
MD5 029b6ee8b92cd54b7596a1530d7d9187
SHA1 cecb50aa208cc7d8ac42de79fb18cf817ca4a453
SHA512 fc458814f12313b936328f1378f90516d82693b41691aa56dc809ea11972a5904d090cf58aa5e2182daf8761b6d8c992b7b21035fbb704db537c605e8c453c46
SSDEEP 3145728:Hx2EAQkPGtUIEh7ONXXNsFesSS7ycoJwQ9BOJx7Tg+6Ao:M0C1IEh7OdNRjSA19BKPwr
TLSH
T18378335331328D23F9EEB938C9A229E2F444DDA1965465FB580EE70973B73902D38B5C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

0c:9f:ee:05:fc:2d:4e:fc:b1:19:ba:77:12:c2:b7:78:1c:84:e3:6e:b2:12:c8:8c:2b:13:2d:35:05:03:b2:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Sep 9, 2020

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

d6:f1:f0:4d:a2:bc:a6:76:f8:2e:3a:28:4b:51:78:25:fe:20:06:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Sep 9, 2020

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 6, 2020 - Mar 1, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

12314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BWA\F43365AE-6ACE-0\MobileMeWinPackageData_Final-443.13\srcroot\setup\Release\setup.pdb

kernel32

CreateDirectoryA CreateFileA DeleteFileA LocalFileTimeToFileTime RemoveDirectoryA SetFileAttributesA SetFileTime CloseHandle GetLastError WaitForSingleObject CreateMutexA GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessA GetTickCount GetSystemDirectoryA FreeLibrary FreeResource GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LocalAlloc LocalFree SetProcessWorkingSetSize DosDateTimeToFileTime FindResourceA GetTempPathA SetStdHandle HeapAlloc HeapFree GetProcessHeap GetLocalTime LoadLibraryExA LoadLibraryA DecodePointer HeapReAlloc HeapSize GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetFilePointerEx ReadFile MultiByteToWideChar GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP CreateFileW GetFileType GetStdHandle ExitProcess GetModuleHandleExW GetACP LCMapStringW FlushFileBuffers WriteConsoleW SetEndOfFile FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetSystemMetrics ShowWindow DestroyWindow CreateWindowExA SendMessageA UpdateWindow

Sharing

General

Malware Config

Signatures

File Explorer

iCloudSetup.exe

kernel32

user32

generic