setup[.]exe | Triage™

General

Target
setup.exe
Size 545KB
Sample260819-ampkqstdmb
SHA256 8e4c5d232d6a1d98d88a52565379f1c8e85fe297910fc4d4f526a0f0375932a5
MD5 a8f68066b2e990d00aafc93f7b5f6156
SHA1 fe9a45c7562567ba191ff6c79a375c7ee8af3a65
SHA512 c2eab5571f5519069849b529827237572be0fd1ed30e74c6ba833330d97e08888de8a9824c2db4aa49ec94f73a1c9b02b81a841a734d702179b7cd0c3810df87
SSDEEP 12288:6b971VO6Ym9FT0CrZXt9HmlZs/ekTODtA:y77ZZ9TXmie5A
TLSH
T15CC4F106F75904E9D029C1B9959A1666B7F37C019B20A5EF03A4864B2F27BC46F3EF24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 545KB

setup.exe

IMPHASH 5fdc5e227e7d3c8edf3426ebcd607dda
SHA256 8e4c5d232d6a1d98d88a52565379f1c8e85fe297910fc4d4f526a0f0375932a5
MD5 a8f68066b2e990d00aafc93f7b5f6156
SHA1 fe9a45c7562567ba191ff6c79a375c7ee8af3a65
SHA512 c2eab5571f5519069849b529827237572be0fd1ed30e74c6ba833330d97e08888de8a9824c2db4aa49ec94f73a1c9b02b81a841a734d702179b7cd0c3810df87
SSDEEP 12288:6b971VO6Ym9FT0CrZXt9HmlZs/ekTODtA:y77ZZ9TXmie5A
TLSH
T15CC4F106F75904E9D029C1B9959A1666B7F37C019B20A5EF03A4864B2F27BC46F3EF24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

slaufoiaw.pdb

kernel32

HeapAlloc WaitForSingleObject SetLastError WriteConsoleW HeapFree GetProcAddress CloseHandle MultiByteToWideChar GetLastError GetFileInformationByHandle GetFileInformationByHandleEx GetModuleHandleA GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentThreadId IsProcessorFeaturePresent GetActiveProcessorCount GetActiveProcessorGroupCount GetMaximumProcessorCount SetFileInformationByHandle GetCommandLineW GetCommandLineA GetModuleHandleW HeapSize GetEnvironmentStringsW CreateFileW SetFileTime GetFullPathNameW TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive LoadLibraryA GetLogicalDrives GetACP GetProcessHeaps GetSystemWindowsDirectoryW GetCurrentDirectoryW GetStringTypeW CompareStringW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW IsValidCodePage GetCPInfo HeapReAlloc GetProcessHeap SetFilePointerEx QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW GetOEMCP WideCharToMultiByte FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW FlushFileBuffers GetConsoleOutputCP WriteFile

ntdll

NtReadFile RtlGetVersion RtlNtStatusToDosError NtWriteFile

Sharing