OfficeSetup[.]exe | Triage™

General

Target
OfficeSetup.exe
Size 7.1MB
Sample260730-nkbsrawfng
SHA256 1cc74fd803b1b21533ffa082a5ffda0630fea3be43e623fbac8c547e686f81ff
MD5 544a7b2c6517d2cbb94ec50b5fc6e154
SHA1 d49ba6f409baf86269c0b80fa55aa181bfd6a01a
SHA512 3cf4a210259f541b9bc1555024eb57796d1808e94c4aab5e08b83cacd96783e75199f7a0d93b1a31515cc049b9865dc4c85fd1b909dc909b0145ae0fa2a40a13
SSDEEP 196608:eVNNXIyYD8H0CUjVeSh26V6R8udMR5BKNqJ6twBCLsRefQh:4NIyYD8H0CIVTRs80Rw/
TLSH
T1B5766C22AA9440A5F572C2726E396F5B4D69BDF10B33805FE384176D0974A83B63DF23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OfficeSetup.exe

File Explorer

OfficeSetup.exe

.exe 7.1MB

OfficeSetup.exe

IMPHASH 01f4d042095b3df955b82a57ce07dcf6
SHA256 1cc74fd803b1b21533ffa082a5ffda0630fea3be43e623fbac8c547e686f81ff
MD5 544a7b2c6517d2cbb94ec50b5fc6e154
SHA1 d49ba6f409baf86269c0b80fa55aa181bfd6a01a
SHA512 3cf4a210259f541b9bc1555024eb57796d1808e94c4aab5e08b83cacd96783e75199f7a0d93b1a31515cc049b9865dc4c85fd1b909dc909b0145ae0fa2a40a13
SSDEEP 196608:eVNNXIyYD8H0CUjVeSh26V6R8udMR5BKNqJ6twBCLsRefQh:4NIyYD8H0CIVTRs80Rw/
TLSH
T1B5766C22AA9440A5F572C2726E396F5B4D69BDF10B33805FE384176D0974A83B63DF23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

4183186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\dbs\el\omr\Target\x86\ship\click2run\en-us.pre\SetupBootstrapper.pdb

oleaut32

GetErrorInfo SysStringLen SysAllocString VariantClear VariantInit SysFreeString SetErrorInfo

kernel32

SetWaitableTimerEx VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetStdHandle CompareStringW VirtualProtect EnumSystemLocalesW GetOEMCP ExitProcess CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA CompareStringEx LocalFree HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary CreateThread GetCurrentThreadId GetExitCodeThread SetProcessMitigationPolicy CreateEventExW WriteFile DeleteFileW WideCharToMultiByte IsWow64Process GetModuleHandleExW ExpandEnvironmentStringsW GlobalFree MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CreateMutexW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetUserDefaultLocaleName FlsFree FlsAlloc LocaleNameToLCID AttachConsole AllocConsole GetStdHandle FreeConsole FindClose UnmapViewOfFile CreateFileA GetFileSize CreateFileMappingW MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FormatMessageA GetSystemTimeAsFileTime GetTickCount64 K32GetProcessMemoryInfo GlobalMemoryStatusEx OpenProcess RaiseException IsValidCodePage GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetSystemDirectoryW GetTempPathW CreateDirectoryW GetFileAttributesExW SetFileAttributesW GetExitCodeProcess GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource ReleaseSemaphore WaitForSingleObjectEx SetEvent CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue ResetEvent EnterCriticalSection LeaveCriticalSection GetVersionExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation HeapAlloc OpenEventW ReleaseMutex CreateMutexExW OpenMutexW GetLongPathNameW GetFinalPathNameByHandleW TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime IsDebuggerPresent FindFirstFileExW MoveFileExW FindNextFileW RemoveDirectoryW ReadFile SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle WaitForMultipleObjects K32EnumProcessModulesEx RtlCaptureStackBackTrace GetFileType SetFilePointer GetOverlappedResult GetFileAttributesW GetFileTime QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList GetTickCount InitOnceExecuteOnce GetSystemPowerStatus GetTimeZoneInformation AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile GetCurrentThread OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus GetStartupInfoW CreateMemoryResourceNotification QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic InitializeCriticalSectionAndSpinCount FindFirstFileW GetThreadLocale lstrcmpW CopyFileW ProcessIdToSessionId GetCommandLineW SetEnvironmentVariableW PeekNamedPipe GetConsoleMode SetConsoleMode CreatePipe SetHandleInformation GetPriorityClass K32EnumProcesses IsValidLocale GetSystemDefaultLocaleName GetUserGeoID GetLocaleInfoEx LCIDToLocaleName LCMapStringEx GetSystemDefaultLCID EnumSystemLocalesEx LoadLibraryExA LockResource GetLocaleInfoW GetUserPreferredUILanguages GetACP GetPhysicallyInstalledSystemMemory GetProductInfo GetConsoleOutputCP ReadConsoleW GetDriveTypeW GetTimeFormatW GetDateFormatW GetSystemPreferredUILanguages K32GetProcessImageFileNameW TryAcquireSRWLockExclusive GetStringTypeW GetFileInformationByHandle CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete SwitchToThread IsProcessorFeaturePresent EncodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwind CreateTimerQueueTimer DeleteTimerQueueTimer GetThreadTimes FreeLibraryAndExitThread ExitThread GetLocalTime

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

381KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

OfficeSetup.exe

oleaut32

kernel32

generic