setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 1.4MB
Sample260722-zagf2athpf
SHA256 7f5d09c223cf679e840fd10fd223ba55068209d3c54cce34c7399b93277d1340
MD5 a28aa39dd7b3883a6f5a9bf2755060e7
SHA1 44dd345983ce5b159e8b73b60e5165c32cdc3ba2
SHA512 d6cf269ac820c7b77eab58f6cd3fb7deb5aa8d481d8bdea5f83e37b9a69324fa49dffe199e869e0351be888d35f6fc23629b628cd138f8270fe35300eafc9698
SSDEEP 24576:41VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3GcrR59H7USvx9f0:8QdhZgEN6GnJl9pO
TLSH
T1AF656B22A3918837D1732F759C6BC2946C257E602F74E54A7EB8AE0D1E38B417D393D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 1.4MB

setup.exe

IMPHASH ccd5f2ad4761330df297d2ddedcd8ed3
SHA256 7f5d09c223cf679e840fd10fd223ba55068209d3c54cce34c7399b93277d1340
MD5 a28aa39dd7b3883a6f5a9bf2755060e7
SHA1 44dd345983ce5b159e8b73b60e5165c32cdc3ba2
SHA512 d6cf269ac820c7b77eab58f6cd3fb7deb5aa8d481d8bdea5f83e37b9a69324fa49dffe199e869e0351be888d35f6fc23629b628cd138f8270fe35300eafc9698
SSDEEP 24576:41VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3GcrR59H7USvx9f0:8QdhZgEN6GnJl9pO
TLSH
T1AF656B22A3918837D1732F759C6BC2946C257E602F74E54A7EB8AE0D1E38B417D393D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1044484

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo GetActiveObject RegisterTypeLib LoadTypeLib SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit SysFreeString

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey OpenThreadToken OpenProcessToken LookupPrivilegeValueW GetUserNameW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid AdjustTokenPrivileges

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage WaitForInputIdle UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRectEmpty SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClassLongW SetCapture SetActiveWindow SendNotifyMessageW SendMessageTimeoutW SendMessageA SendMessageW ScrollWindowEx ScrollWindow ScreenToClient ReplyMessage RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OffsetRect OemToCharBuffA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect ExitWindowsEx EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon ClientToScreen CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BringWindowToTop BeginPaint AppendMenuW CharToOemBuffA AdjustWindowRectEx ActivateKeyboardLayout

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW lstrcmpW WriteProfileStringW WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualFree VirtualAlloc TransactNamedPipe TerminateProcess SwitchToThread SizeofResource SignalObjectAndWait SetThreadLocale SetNamedPipeHandleState SetLastError SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SetCurrentDirectoryW ResumeThread ResetEvent RemoveDirectoryW ReleaseMutex ReadFile QueryPerformanceCounter OpenProcess OpenMutexW MultiByteToWideChar MulDiv MoveFileExW MoveFileW LockResource LocalFree LocalFileTimeToFileTime LoadResource LoadLibraryExW LoadLibraryW LeaveCriticalSection IsDBCSLeadByte IsBadWritePtr InitializeCriticalSection GlobalFindAtomW GlobalDeleteAtom GlobalAddAtomW GetWindowsDirectoryW GetVersionExW GetVersion GetUserDefaultLangID GetTickCount GetThreadLocale GetSystemTimeAsFileTime GetSystemInfo GetSystemDirectoryW GetStdHandle GetShortPathNameW GetProfileStringW GetProcAddress GetPrivateProfileStringW GetOverlappedResult GetModuleHandleW GetModuleFileNameW GetLogicalDrives GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileSize GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryW GetComputerNameW GetCommandLineW GetCPInfo FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushFileBuffers FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime EnumCalendarInfoW EnterCriticalSection DeviceIoControl DeleteFileW DeleteCriticalSection CreateThread CreateProcessW CreateNamedPipeW CreateMutexW CreateFileW CreateEventW CreateDirectoryW CopyFileW CompareStringW CompareFileTime CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SaveDC RoundRect RestoreDC RemoveFontResourceW Rectangle RectVisible RealizePalette Polyline Pie PatBlt MoveToEx MaskBlt LineTo LineDDA IntersectClipRect GetWindowOrgEx GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontsW Ellipse DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap Chord BitBlt Arc AddFontResourceW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

mpr

WNetOpenEnumW WNetGetUniversalNameW WNetGetConnectionW WNetEnumResourceW WNetCloseEnum

comctl32

InitCommonControls InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

ole32

OleUninitialize OleInitialize CoTaskMemFree CLSIDFromProgID CLSIDFromString StringFromCLSID CoCreateInstance CoFreeUnusedLibraries CoUninitialize CoInitialize IsEqualGUID CoDisconnectObject

shell32

ShellExecuteExW ShellExecuteW SHGetFileInfoW ExtractIconW SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHBrowseForFolderW

comdlg32

GetSaveFileNameW GetOpenFileNameW

Name

.text

Size

1012KB

Virtual Size

1011KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

341KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

mpr

comctl32

ole32

shell32

comdlg32

generic