Apple Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Apple Setup.exe
Size 382KB
Sample260716-239pdsfx7k
SHA256 7f3e2dcca5ce23091b94e85a9784aa27998059236f9a373c54a6930979642a7b
MD5 dda67ae06b91cb3eda0759884aa797df
SHA1 df6cfdf2172071190bb62759c3f7caf79019b525
SHA512 1238b9f9517205f446a9a08978fa2de8a6048a8d53a4f863cd79d628febb04e505825a6aa190492f024c514914e95505accb09ab26cb3d9beb68f01ff333eddc
SSDEEP 6144:dPET/uSPdSor3mbB23r1jZsGskrqd+mUnkS38USJuiT:q3r1C5XdbUkkU
TLSH
T1D8849E19FAA540F5E5B7C538CDA24506EB327CCE47A0DACF13A449961F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Apple Setup.exe

File Explorer

Apple Setup.exe

.exe 382KB

Apple Setup.exe

IMPHASH 5678623090a8ea9f34cf1227163858bd
SHA256 7f3e2dcca5ce23091b94e85a9784aa27998059236f9a373c54a6930979642a7b
MD5 dda67ae06b91cb3eda0759884aa797df
SHA1 df6cfdf2172071190bb62759c3f7caf79019b525
SHA512 1238b9f9517205f446a9a08978fa2de8a6048a8d53a4f863cd79d628febb04e505825a6aa190492f024c514914e95505accb09ab26cb3d9beb68f01ff333eddc
SSDEEP 6144:dPET/uSPdSor3mbB23r1jZsGskrqd+mUnkS38USJuiT:q3r1C5XdbUkkU
TLSH
T1D8849E19FAA540F5E5B7C538CDA24506EB327CCE47A0DACF13A449961F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\James\Desktop\fbi\FBI-Setup\Build\x64\Apple Setup.pdb

kernel32

GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc SetFilePointerEx GetFileType CreateProcessW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID GetCommandLineW GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleOutputCP HeapSize WriteConsoleW CreateProcessA CloseHandle WaitForSingleObject CreatePipe ReadFile GlobalUnlock GlobalLock GlobalAlloc Sleep IsValidLocale GetModuleHandleA WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx

user32

BeginPaint ReleaseDC InvalidateRect ReleaseCapture UpdateWindow SetWindowLongPtrA GetDesktopWindow PostQuitMessage KillTimer GetWindowLongPtrA GetClientRect LoadIconA SetClipboardData SetCapture TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA RegisterClassA EndPaint EmptyClipboard CloseClipboard SetTimer OpenClipboard IsWindow ShowWindow GetSystemMetrics ScreenToClient FillRect PostMessageA CopyImage SetWindowPos GetDC DestroyWindow LoadCursorA GetWindowRect DispatchMessageA GetMessageA MessageBoxA TrackMouseEvent

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject DeleteDC DeleteObject CreateSolidBrush BitBlt

advapi32

RegCloseKey CloseServiceHandle RegQueryValueExA QueryServiceConfigA OpenSCManagerA RegCreateKeyExA ChangeServiceConfigA StartServiceA RegSetValueExA RegOpenKeyExA QueryServiceStatusEx RegEnumKeyExA OpenServiceA

shell32

ShellExecuteA

ole32

CreateStreamOnHGlobal

gdiplus

GdipSetStringFormatAlign GdipCreatePen1 GdipLoadImageFromStream GdiplusStartup GdiplusShutdown GdipDeletePen GdipGetImageWidth GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipCloneBrush GdipSetTextRenderingHint GdipFillEllipseI GdipCreateFromHDC GdipDrawString GdipDrawPath GdipFree GdipGetGenericFontFamilySansSerif GdipClosePathFigure GdipSetClipRectI GdipSetPixelOffsetMode GdipFillPath GdipSetStringFormatTrimming GdipCreateSolidFill GdipSetInterpolationMode GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipDrawImageRectI GdipAlloc GdipDrawEllipseI GdipDeleteBrush GdipCloneImage GdipCreateLineBrushI GdipCreateFontFamilyFromName GdipAddPathArcI GdipResetClip GdipGetImageHeight GdipDeleteFontFamily GdipCreateStringFormat GdipDrawLineI

dwmapi

DwmSetWindowAttribute

Name

.text

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Apple Setup.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

dwmapi

generic