SETUP.7z
- SHA256 7fe3468bee85a18497b86654e72230645677482141f08d05cbde14d63708a68b
Static task
static1
1 signatures
General
- Target SETUP.7z
- Size 14.1MB
- Sample260721-qcdcqabr2v
- SHA256 7fe3468bee85a18497b86654e72230645677482141f08d05cbde14d63708a68b
- MD5 9d3d558df524fc77cdecc595cc3d285d
- SHA1 76a5a2557f3eb4c61e4a2323af648428ebc9749f
- SHA512 911747c8d7b1d0546d926046c05353adf555f851cd6db1e6695be0e9de5bf0f24967c365ba873cad8aedb0533201c2433d367f73135e48fa99651c1454caa7a4
- SSDEEP 393216:N2kdJxohspaJ7qRyKf+nPhjGkid0qhnW1MEb1lCM7ZIo5zP0Cxtz1:n3CspaoyPhBw0qRidlV7ZIo5z8I
- TLSH T1D1E63372F9D37B53D09EE70909369E49EC6E05DD613E026FF09E69619029E48F800BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/ARMGDDN Browser/7z.dll unpack001/ARMGDDN Browser/7z.exe unpack001/ARMGDDN Browser/Install.exe
File Explorer
-
SETUP.7z.7z 14.1MB
-
ARMGDDN Browser/7z.dll.dll 1.8MB
-
ARMGDDN Browser/7z.exe.exe 543KB
-
ARMGDDN Browser/INSTALL.bat.bat .vbs 2KB
-
ARMGDDN Browser/Install.conf1KB
-
ARMGDDN Browser/Install.exe.exe 60.4MB
ARMGDDN Browser/7z.dll
- IMPHASH 18c56484bb7252ae9636c0d55e9b67b6
- SHA256 1af1b530f6295207f719697184d4ab5587e2f11586da4564ce352a743e7b8ccb
- MD5 325164288f23ccfff4891b050bf4a43e
- SHA1 c6a2ded962d39a62da3878408fe0e3354938f81d
- SHA512 ce7765a689b15c85ee95394422a9a93d36ca803b89246edfdfcf86969b1227b52e99e7e029e5e52741f3bb41c0b8b7463e92e9f4ef7439a40e1cb70c79cade3c
- SSDEEP 24576:KhpsP5/bvmwaL7ZLZHshUkdPYBSMLyE+z3oMs4:KhpRNZHcUEIyEtMb
- TLSH T18E954C5AF6748270D0B7C075C5E2AB9AEA7134868B30A6C75385DB3D2F13AF6C539360
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1285632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
user32
CharUpperW
CharPrevExA
advapi32
SystemFunction036
msvcrt
_purecall
memset
free
malloc
strlen
__CxxFrameHandler
strchr
strstr
wcscmp
strcmp
memmove
_CxxThrowException
memcpy
memcmp
realloc
__C_specific_handler
_beginthreadex
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Sleep
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
SetEvent
GetCurrentDirectoryW
IsProcessorFeaturePresent
GetLargePageMinimum
VirtualFree
VirtualAlloc
QueryPerformanceCounter
GetOEMCP
DeleteCriticalSection
LocalFileTimeToFileTime
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatusEx
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
WriteFile
ReadFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
354KB
Virtual Size
353KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=101, id=1, productName=Unmarked objects,
count=230, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=4, id=260, version=33134,
count=44, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
ARMGDDN Browser/7z.exe
- IMPHASH cd85418ebba264af6f974156c0fb1f93
- SHA256 cf20cf85335562d6d62ba191614393f8da80664d3d6126c9fbaec9c7caadaaa2
- MD5 2f58d2175bd282f29cb215275a18100f
- SHA1 f7daad8646e9b633b9e57df43ec819d6e72c907c
- SHA512 44ae15cada6b0823e0717a27dcfe2e4bd245184c0dd96961de7ff2eaabc3947fffb6fe86c9fb0f77e39fb81f0bf2a54f86206d9f7a267a05cee38525c65d54e4
- SSDEEP 12288:206zwmIMUxp3+CdKJqQ2b8kOY+25EkYFGhv:1PpUJIUHov
- TLSH T15AC40826F6748335D073C0B9C5D2A68EE97230865B308ACB4286C77C7E67AE6D536731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
384464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysStringByteLen
SysFreeString
SysAllocStringLen
user32
CharUpperW
advapi32
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
msvcrt
_c_exit
_XcptFilter
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
_isatty
memcmp
memset
strlen
_exit
wcscmp
strcmp
memmove
fflush
fputc
fputs
_iob
fgetc
free
malloc
__CxxFrameHandler
_CxxThrowException
memcpy
_cexit
__initenv
exit
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
wcsstr
kernel32
WaitForSingleObject
ResumeThread
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
GetVersion
SetFileAttributesW
GetLargePageMinimum
VirtualFree
VirtualAlloc
GetConsoleMode
SetConsoleMode
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetProcessAffinityMask
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
RemoveDirectoryW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetLogicalDriveStringsW
DeviceIoControl
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
Name
.text
Size
375KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=152, id=1, productName=Unmarked objects,
count=79, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=260, version=33134,
count=16, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
ARMGDDN Browser/INSTALL.bat
- SHA256 103a9df6a8a93415e80c6b98075cec69d83d5e579b828f8d3fef80f00485d4ff
- MD5 5fea3e8d81ae23c1fc1203c7f2b9d221
- SHA1 7bd3dcc7d70198cb2557e52bbf1931978622ea94
- SHA512 d64abb49b50d45099c33a32d56ae2d2d4833d7caa32986f4d6564744cbb9124deb71d1531890cca4bb277b32fbc223db47afa71ae5b5697af5a3b22036397de6
- TLSH T18E41BFA6B005A4A09A523FB4CE7FB42DF90653C7C3029C14F52F4EBA271AAE175BDC41
- MD5 SHA1 SHA512 TLSH
ARMGDDN Browser/Install.conf
- SHA256 c4ddc38ff587d2d7a30fd9487acbf950e5d44089034e9b1b77be8143a739d0da
- MD5 e41b1c8a02b26fa0b89b07e755e2fb29
- SHA1 b6d5e52a2f9833f03abd3a4485870b69ac82076f
- SHA512 990565b445ca2a513cdce3a28f7ddd7598c9ea9bc93ff7edb79c74a84f4908f62e6cfb306a4c34316c0927d65088e7d99212aff16649c665a16a3deda6ddf39a
- TLSH T1E121F9FF3CC72C866BF05E086BD030F444A022EE3C29A13B02B3745B25D66D089B0DA9
- MD5 SHA1 SHA512 TLSH
ARMGDDN Browser/Install.exe
- IMPHASH b196866f0bf37f1f128fa153413b744f
- SHA256 f4887fb1be7fc63bd6f571289a438b3926581e5d7d63203e6fc2edfce6b6be73
- MD5 c83181ab5292d1e30322b2900033c293
- SHA1 65aea808386599f09736211d0a2fa6690c6f2d4d
- SHA512 66435fbf2edadab1e36d75d1d09ded9e9ca90b3e3e3761cec6c9ecd1f355a5162fd2c9f9270ee14aa0e9ba97a492b46e37fd4a44f9cff4617156aecafc369902
- SSDEEP 393216:c5QWN8rXxNKicouumFz/19/oW/jQkI5sx+k76a9G8tg9Lyc:cek8rXxNKiaxr9/jss0k76a9GGkd
- TLSH T139D73943E85141E8C9E9C534C6669A23BB707C498B2577D72FA0F6342F76BC0A6BE314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
542368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
27.1MB
Virtual Size
27.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29.9MB
Virtual Size
29.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.8MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
679KB
Virtual Size
679KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
664KB
Virtual Size
663KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
379KB
Virtual Size
378KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ