Setup[.]exe | Triage™

General

Target
Setup.exe
Size 537KB
Sample260820-wpf72agn5v
SHA256 fae5886f42b7ba83b7ace541faa065dcd91bf5edd852a4f467dad37512e2c8c4
MD5 4a951863fd9a8ebb72c8f6903e758295
SHA1 c35399fb8c121336087f376b6a638403815b5a41
SHA512 c0a5117898655b65086252eb9964c4d06e2734112080fddae76a54a91bfb2844dcd85d7a0b42978869b9442fc496f3285b67229b26c71970a324920e557ccf70
SSDEEP 12288:NuZatuTaqUSrcz5+fDn8/7EDGnCsJZvxmVrhrz9:cIqUqcz5+fDU7Bndx0rhH9
TLSH
T10DC4F16AFEE601FCD07AC17099550525DAB2B8127BA05AEF03A441473F3BAC85F3EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.exe

File Explorer

Setup.exe

.exe 537KB

Setup.exe

IMPHASH fe167fefdb6f386bba75eadfee2f40e5
SHA256 fae5886f42b7ba83b7ace541faa065dcd91bf5edd852a4f467dad37512e2c8c4
MD5 4a951863fd9a8ebb72c8f6903e758295
SHA1 c35399fb8c121336087f376b6a638403815b5a41
SHA512 c0a5117898655b65086252eb9964c4d06e2734112080fddae76a54a91bfb2844dcd85d7a0b42978869b9442fc496f3285b67229b26c71970a324920e557ccf70
SSDEEP 12288:NuZatuTaqUSrcz5+fDn8/7EDGnCsJZvxmVrhrz9:cIqUqcz5+fDU7Bndx0rhH9
TLSH
T10DC4F16AFEE601FCD07AC17099550525DAB2B8127BA05AEF03A441473F3BAC85F3EB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aickiott.pdb

kernel32

GetStdHandle GetConsoleMode ReleaseSRWLockExclusive WaitForSingleObject TryAcquireSRWLockExclusive HeapReAlloc GetFileType GetConsoleWindow GetWindowsDirectoryW GetTempPathW GetCurrentThread GetConsoleCP GetConsoleOutputCP CompareStringW GetStringTypeW LoadLibraryA SetFileInformationByHandle GetEnvironmentStringsW GetCommandLineA GetModuleHandleW HeapFree SetFileTime SetLastError GetFullPathNameW GetProcessHeap GetLastError SetFilePointerEx HeapAlloc WriteConsoleW IsThreadAFiber GetThreadId GetCurrentProcessorNumber GetActiveProcessorCount GetActiveProcessorGroupCount IsProcessorFeaturePresent GetFileInformationByHandle GetFileInformationByHandleEx FlushFileBuffers HeapSize LCMapStringW MultiByteToWideChar GetProcAddress GetModuleHandleA CreateFileW CloseHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect WriteFile

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile RtlGetVersion

user32

GetDesktopWindow GetShellWindow GetFocus GetForegroundWindow

winmm

timeGetTime joyGetNumDevs waveInGetNumDevs midiOutGetNumDevs

Sharing