DiscordSetup.zip
- SHA256 0e393080cf2bab4c7dca5894cd721c77e1bc1f73344f6167ed30efa1cacc7806
Static task
static1
1 signatures
General
- Target DiscordSetup.zip
- Size 126.2MB
- Sample260803-kwpl7ser5w
- SHA256 0e393080cf2bab4c7dca5894cd721c77e1bc1f73344f6167ed30efa1cacc7806
- MD5 64cb264c93a7269cf632b07b244771b8
- SHA1 c114c2e085ace81c4271053b9aeb1644fdee606d
- SHA512 31f54517a7af0bc4f28bdaf05f740dc7db387e61cc376c128e1576cba71ad331cb73e6819b7b481f1ca0a998213341fbf8258206749a4a8210c3dfff8dcbb9e2
- SSDEEP 3145728:o/Wtp3uf1piApvSZNBbhdDXnYRunq80DrQrpx4e1DFiwM/v:MWtp3E1piovSFDX2F/yX424B/v
- TLSH T1D05833A8A1253ED73EFA1902C67081B63183287D0F36DDAA7B490B56940787737F8DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/clrhost.dll unpack001/nfregdrv.exe
File Explorer
-
DiscordSetup.zip.zip 126.2MB
-
DiscordSetup.exe.exe 114.7MB
-
clrhost.dll.dll 8.6MB
-
nfregdrv.exe.exe 3.6MB
-
run.bat381B
DiscordSetup.exe
- IMPHASH d953c6a4c5071420214f2037f02a103c
- SHA256 53a1ffdd70357ddc89a36d0bc689d11438f2786df4c832e7d7dad52e9a1774eb
- MD5 5cca98a29daab85c44dea26067eb20d8
- SHA1 b84087b182fa1fd7176845e0c989f48feb19ed7e
- SHA512 3b52ec7a1c6b5dd0f2005bf0a285dc8f0c9f6062a832707d9435af40e734c7df6581afda5622a8be4557fcaa007999306d1342bb2e4aa6d4aa195d497b514dde
- SSDEEP 3145728:FfY/j1s5U0Qk/3sK5dfQdVPBG6gXQmOQ3/EtnymD7wlmZl:9Y/j16U0QM3sxVPfPUsFy+ool
- TLSH T1874833A871543FD3EDBACC3E8670C1B62C626C380B22986A6749375594338B337E5DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
80:16:c3:99:a6:ad:39:2a:7b:a0:53:5c:9d:5f:9c:64:ac:54:db:f0:14:4f:1c:d8:0d:a6:b5:f9:8f:6e:82:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 8, 2025
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0d:e9:cf:2e:71:83:64:a0:06:2e:0d:83:09:3e:34:d7
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 24, 2024 - Sep 24, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
45829
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\code\Squirrel.Windows\src\Setup\bin\Release\Setup.pdb
kernel32
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
lstrlenW
GetTempPathW
GetLastError
GetTempFileNameW
MoveFileW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
DeleteFileW
GetModuleFileNameW
GetCurrentProcess
LoadLibraryW
FreeLibrary
InitializeCriticalSectionEx
FreeResource
LoadResource
FindResourceW
SizeofResource
LockResource
CreateDirectoryW
VerSetConditionMask
CopyFileW
GetFileAttributesW
CreateFileW
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
MultiByteToWideChar
LocalFileTimeToFileTime
WideCharToMultiByte
WriteFile
SetFileTime
CreateProcessW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
RaiseException
GetSystemDirectoryW
SetDefaultDllDirectories
GetCurrentThreadId
DecodePointer
OutputDebugStringW
SetEndOfFile
LocalFree
VerifyVersionInfoW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
HeapSize
HeapReAlloc
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
ReadConsoleW
WriteConsoleW
comctl32
InitCommonControlsEx
Name
.text
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
114.5MB
Virtual Size
114.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33140,
count=151, id=261, version=33140,
count=20, id=259, version=34321,
count=19, id=260, version=34321,
count=21, id=260, version=33140,
count=55, id=261, version=34321,
count=1, id=262, version=33140,
count=5, id=257, version=33140,
count=158, id=1, productName=Unmarked objects,
count=6, id=265, version=34438,
count=1, id=255, version=34438,
count=1, id=151,
count=1, id=258, version=34438,
clrhost.dll
- IMPHASH e94ea2107aea49bf9742c257e1ecc8d7
- SHA256 a6a4dccc4efe71ae5cb3af4ccb3a99faa246334148a8b02d8662e8241ad6bd0a
- MD5 756d21f0542f6a037214f42be278d367
- SHA1 77260db6a983bb4594fccc5b9c3c2b62f83dac21
- SHA512 20a4e4f300086578c8a204e7f93a9e02acf4d3c03d1ece6e2faea58ebb53ff1c96e41ed7018ec912f7c40937929b8598d2e535e701544491680771011efcdba8
- SSDEEP 196608:B8SL7Uba+ED7odkLaHtv6j4zaDUorkjzCFjOL:m6oba+9caawIxKCFjO
- TLSH T1579633CDB98503A6C463FFB858F28DBFB111FB8565214D0B7A8993401C37A352AB79C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16721245
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
advapi32
ChangeServiceConfigW
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlLookupFunctionEntry
winhttp
WinHttpQueryDataAvailable
kernel32
MoveFileExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
CreateWindowExW
shell32
ShellExecuteW
ole32
CoInitializeEx
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
wininet
HttpOpenRequestA
d3d9
Direct3DCreate9
iphlpapi
GetAdaptersInfo
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
strncpy_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
oleaut32
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
Name
.text
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.T,~
Size
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.UnV
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
..DZ
Size
8.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
nfregdrv.exe
- IMPHASH cd8ff9164200ffb3098092663234dbdf
- SHA256 01a9ccff60dbdf2dce2a6304f01c51ab32b03029fb4648394fb715bc1dc2ce5b
- MD5 de7218aed3ac1635468ee8f3a3b45b9c
- SHA1 c49f1acd0593546d0aaac5de23e92ff6c82c03e8
- SHA512 d46da180eaec6f33ecf6b44f1067c0e5bfc1655d53174467155aa5a32169b741ad93f6f01debe81cc9c863bdbe1ca21420bf595bd4c7cd39a3e40ee6dddb2535
- SSDEEP 98304:P9pu81M/MJaxGER+fOAq2Z+HK3aBJWhrGgLA7MCrOc:Pn1M/MJzERaOA++NLvLc
- TLSH T13B0623AF5BCB2EF0D01ECF74C94971ACB06D3B968AA1DC15B7CD190E4E9222ADD31251
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5761338
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shlwapi
PathStripPathW
kernel32
LocalAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
ExitWindowsEx
advapi32
QueryServiceStatusEx
msvcp140
??0_Lockit@std@@QEAA@H@Z
urlmon
URLOpenBlockingStreamA
ntdll
RtlCaptureContext
vcruntime140
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.$Go
Size
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Z1G
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.4PN
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
run.bat
- SHA256 59ca9c5f9e1568c6af1d5aca8f50054bfeaf9bb0b89a413f619fbd45d4a19a8a
- MD5 804c2bfb30b406175de3822f1e31637c
- SHA1 66560ef3e1b806bdc54dc3d0ceaa9c537cda6c4c
- SHA512 fab382d761b2951fed3d2983f5a343d04a62d7e540328abb3ef1dbc9d138b74eb15651108a6b37dab6c33d53ba11a74322b9dbcc6d3a8412ef868ac4e0e18e10
- TLSH T121E0226ACD41C182322529C007117C075292D8BEEA448C723348838BA9CD9A41A9F3F1
- MD5 SHA1 SHA512 TLSH