setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 772KB
Sample260810-3cam2sbb59
SHA256 70a0ac48dda49bb4f376439150dc677e6368715a26cb8541d18cc6f0e8df9a40
MD5 92c91c1bf4717fd5d2cb50b4a2a243e7
SHA1 a2ae59c27506b2aab3ce79508f22d4f1e7d9d0e5
SHA512 346e2e4650efee32df0fcaf110e7ff24f6948c75bfcd74d0109c238135bf6d384e43f88f70bf096ca565150d0c9819ecc0d3d752dea1db59398dc7bfc99712c2
SSDEEP 12288:ADnvivRUO3vdMn3y132afS8FsDdFteMb01JQntLOCObre1:ADKvj3k3yRFsftemOba
TLSH
T133F4422656D8B979E3F69B307FF252D3BB69BC523834CC0E11D503090969A42FDA076E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 772KB

setup.exe

IMPHASH 81fd276d49dcfb5944ab1253641f139e
SHA256 70a0ac48dda49bb4f376439150dc677e6368715a26cb8541d18cc6f0e8df9a40
MD5 92c91c1bf4717fd5d2cb50b4a2a243e7
SHA1 a2ae59c27506b2aab3ce79508f22d4f1e7d9d0e5
SHA512 346e2e4650efee32df0fcaf110e7ff24f6948c75bfcd74d0109c238135bf6d384e43f88f70bf096ca565150d0c9819ecc0d3d752dea1db59398dc7bfc99712c2
SSDEEP 12288:ADnvivRUO3vdMn3y132afS8FsDdFteMb01JQntLOCObre1:ADKvj3k3yRFsftemOba
TLSH
T133F4422656D8B979E3F69B307FF252D3BB69BC523834CC0E11D503090969A42FDA076E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.pdb

kernel32

GetNativeSystemInfo EndUpdateResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW ReadFile OpenProcess GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte RaiseException InitializeCriticalSectionAndSpinCount GetCurrentProcessId Sleep HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW MulDiv GetTickCount GetExitCodeProcess LoadLibraryW GetTempPathW SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA HeapReAlloc HeapSize WriteConsoleW ReadConsoleW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW SetEndOfFile OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile GetStringTypeW HeapAlloc HeapFree GetACP GetModuleHandleExW ExitProcess MultiByteToWideChar VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW ScreenToClient GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow GetFocus SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA SetCursor MsgWaitForMultipleObjects

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord8 ord78 ord150 ord92