setup[.]exe | Triage™

General

Target
setup.exe
Size 119KB
Sample260718-sed35sd12q
SHA256 1273bf55749d2ba299c094c34f32fb98ef0e7910748772e3c6008ed08e86a878
MD5 bda9ecc0b9fde9e205240a511313cc7a
SHA1 415afbbd32b35c55edd1c9d2545dcfdd1a96f5aa
SHA512 61242f08e408a104b79054895d6f6d96cc6205831c12e478def6e6357241666df193590d4ea79b978425e3484ff2f270e01e7ad5eea25a576db024c803fc6f40
SSDEEP 1536:RsnkkOcSotb7B4eTZ+xg9vijvX0wndXUU4nQwmcShLt+xalyl9XpE:eS80WKpnSU4nQwtOt+xalylF
TLSH
T1B9C36C2131ECE4B1C4A540764846CF60773AFC621E799D8373E43E9F9E326C1E66A2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 119KB

setup.exe

IMPHASH 821f289755dad224fb429e334b6e9ce9
SHA256 1273bf55749d2ba299c094c34f32fb98ef0e7910748772e3c6008ed08e86a878
MD5 bda9ecc0b9fde9e205240a511313cc7a
SHA1 415afbbd32b35c55edd1c9d2545dcfdd1a96f5aa
SHA512 61242f08e408a104b79054895d6f6d96cc6205831c12e478def6e6357241666df193590d4ea79b978425e3484ff2f270e01e7ad5eea25a576db024c803fc6f40
SSDEEP 1536:RsnkkOcSotb7B4eTZ+xg9vijvX0wndXUU4nQwmcShLt+xalyl9XpE:eS80WKpnSU4nQwtOt+xalylF
TLSH
T1B9C36C2131ECE4B1C4A540764846CF60773AFC621E799D8373E43E9F9E326C1E66A2B5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\CXR20\BSF\intel_a\code\bin\setup.pdb

kernel32

RemoveDirectoryA FindClose FindNextFileA DeleteFileA FindFirstFileA GetTempPathA GetModuleFileNameA GetExitCodeProcess WaitForSingleObject GetLastError CreateProcessA GetCurrentProcess GetProcAddress GetModuleHandleA ReadFile SetEndOfFile GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA CreateDirectoryA GetFileAttributesA EnterCriticalSection LeaveCriticalSection MultiByteToWideChar SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc TerminateProcess UnhandledExceptionFilter IsDebuggerPresent CloseHandle RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers Sleep SetEnvironmentVariableA SetEnvironmentVariableW RaiseException LoadLibraryA InitializeCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer CompareStringA CompareStringW SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

MessageBoxA

msi

ord70 ord205

Sharing