Apple Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Apple Setup.exe
Size 382KB
Sample260716-28hsvsbs5y
SHA256 bb59d51284fb02de86324d6247e92cac5dfbfd7adcaa3834fdf777670b044461
MD5 71b4a297f4b1faa593b381efd3c5bcd8
SHA1 c289e8065abd97e66631950faa0d23305be27a92
SHA512 2139bf7135c2f27feee55f730b0811d92b62e6dd3c7a06d7dc63df9aef7f2dc2c78d287e6bfdf3f7b467e0b6a0d5bacdf973a35a1df22e3f5ea729e627b25661
SSDEEP 6144:giRdT/+SPpS6OHmbB23r1jZsGskrKA+mUnkS38MSJuST:gd3r1C53AbUk8k
TLSH
T1B7849E19FAA540F5E5B7C538CDA24506EB327CCE47A0DACF13A449961F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Apple Setup.exe

File Explorer

Apple Setup.exe

.exe 382KB

Apple Setup.exe

IMPHASH 5678623090a8ea9f34cf1227163858bd
SHA256 bb59d51284fb02de86324d6247e92cac5dfbfd7adcaa3834fdf777670b044461
MD5 71b4a297f4b1faa593b381efd3c5bcd8
SHA1 c289e8065abd97e66631950faa0d23305be27a92
SHA512 2139bf7135c2f27feee55f730b0811d92b62e6dd3c7a06d7dc63df9aef7f2dc2c78d287e6bfdf3f7b467e0b6a0d5bacdf973a35a1df22e3f5ea729e627b25661
SSDEEP 6144:giRdT/+SPpS6OHmbB23r1jZsGskrKA+mUnkS38MSJuST:gd3r1C53AbUk8k
TLSH
T1B7849E19FAA540F5E5B7C538CDA24506EB327CCE47A0DACF13A449961F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\James\Desktop\fbi\FBI-Setup\Build\x64\Apple Setup.pdb

kernel32

GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc SetFilePointerEx GetFileType CreateProcessW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID GetCommandLineW GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleOutputCP HeapSize WriteConsoleW CreateProcessA CloseHandle WaitForSingleObject CreatePipe ReadFile GlobalUnlock GlobalLock GlobalAlloc Sleep IsValidLocale GetModuleHandleA WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx

user32

BeginPaint ReleaseDC InvalidateRect ReleaseCapture UpdateWindow SetWindowLongPtrA GetDesktopWindow PostQuitMessage KillTimer GetWindowLongPtrA GetClientRect LoadIconA SetClipboardData SetCapture TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA RegisterClassA EndPaint EmptyClipboard CloseClipboard SetTimer OpenClipboard IsWindow ShowWindow GetSystemMetrics ScreenToClient FillRect PostMessageA CopyImage SetWindowPos GetDC DestroyWindow LoadCursorA GetWindowRect DispatchMessageA GetMessageA MessageBoxA TrackMouseEvent

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject DeleteDC DeleteObject CreateSolidBrush BitBlt

advapi32

RegCloseKey CloseServiceHandle RegQueryValueExA QueryServiceConfigA OpenSCManagerA RegCreateKeyExA ChangeServiceConfigA StartServiceA RegSetValueExA RegOpenKeyExA QueryServiceStatusEx RegEnumKeyExA OpenServiceA

shell32

ShellExecuteA

ole32

CreateStreamOnHGlobal

gdiplus

GdipSetStringFormatAlign GdipCreatePen1 GdipLoadImageFromStream GdiplusStartup GdiplusShutdown GdipDeletePen GdipGetImageWidth GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipCloneBrush GdipSetTextRenderingHint GdipFillEllipseI GdipCreateFromHDC GdipDrawString GdipDrawPath GdipFree GdipGetGenericFontFamilySansSerif GdipClosePathFigure GdipSetClipRectI GdipSetPixelOffsetMode GdipFillPath GdipSetStringFormatTrimming GdipCreateSolidFill GdipSetInterpolationMode GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipDrawImageRectI GdipAlloc GdipDrawEllipseI GdipDeleteBrush GdipCloneImage GdipCreateLineBrushI GdipCreateFontFamilyFromName GdipAddPathArcI GdipResetClip GdipGetImageHeight GdipDeleteFontFamily GdipCreateStringFormat GdipDrawLineI

dwmapi

DwmSetWindowAttribute

Name

.text

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Apple Setup.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

dwmapi

generic