setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 220KB
Sample260825-rmwgqaar4x
SHA256 9cfeb47fc2cb0fb79616ed12bd1b72d56073b76c214cf27ae2580d48534986b2
MD5 51d9a0f6065b15cb1adb71bf980467ac
SHA1 8a9ca886bf4024b1abfb3ef43fc279456a90da4e
SHA512 08a1e4481bca95547333f15141bbfc2c1e14b6d97f6442dadbe50fdccdef424b2fea694496250dde2802a8991dd433c06937d3934a519a4fca3daf13c0123f2b
SSDEEP 6144:vqsWf6zG85KGWVjf6amaxQOumDTjpXsGKLu8N:jW1FGWdf6GxQUDHtmx
TLSH
T163248D2635E080B3F983003065B87F76F6FAFE7617715883D7482F4A6E76996C226316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 220KB

setup.exe

IMPHASH 6d7cafcbdf5e617c4ea4629562f7d27f
SHA256 9cfeb47fc2cb0fb79616ed12bd1b72d56073b76c214cf27ae2580d48534986b2
MD5 51d9a0f6065b15cb1adb71bf980467ac
SHA1 8a9ca886bf4024b1abfb3ef43fc279456a90da4e
SHA512 08a1e4481bca95547333f15141bbfc2c1e14b6d97f6442dadbe50fdccdef424b2fea694496250dde2802a8991dd433c06937d3934a519a4fca3daf13c0123f2b
SSDEEP 6144:vqsWf6zG85KGWVjf6amaxQOumDTjpXsGKLu8N:jW1FGWdf6GxQUDHtmx
TLSH
T163248D2635E080B3F983003065B87F76F6FAFE7617715883D7482F4A6E76996C226316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerLanguageNameA GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

shell32

SHBrowseForFolderA SHGetMalloc SHGetPathFromIDListA

comctl32

ord17

kernel32

WideCharToMultiByte DeleteFileA lstrlenW WriteFile InterlockedIncrement InterlockedDecrement QueryPerformanceFrequency CreateEventA Sleep lstrcatA CompareStringA CompareStringW GetVersionExA SetFilePointer SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime FreeLibrary GetProcAddress LoadLibraryA LockResource LoadResource SizeofResource FindResourceA CreateProcessA GetSystemDefaultLCID GlobalHandle SetCurrentDirectoryA GetPrivateProfileSectionA WaitForSingleObject GetSystemInfo GetModuleFileNameA IsValidCodePage FlushFileBuffers LocalFree FormatMessageA GetDiskFreeSpaceA _lclose OpenFile GetDriveTypeA lstrcpynA CreateDirectoryA GetFileAttributesA RemoveDirectoryA GetExitCodeProcess GetCurrentProcess GetCurrentThread GetLocaleInfoA CreateFileA UnhandledExceptionFilter GetOEMCP GetACP GetCPInfo SetUnhandledExceptionFilter IsBadWritePtr GetLastError VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSection TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId HeapSize HeapReAlloc LeaveCriticalSection EnterCriticalSection GetVersion GetCommandLineA GetStartupInfoA GetModuleHandleA TerminateProcess ExitProcess RaiseException HeapFree HeapAlloc RtlUnwind SystemTimeToFileTime QueryPerformanceCounter ResetEvent SetEvent SearchPathA FindFirstFileA VirtualProtect GetFileType VirtualQuery FindClose GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr LCMapStringA LCMapStringW SetStdHandle GetFileSize GlobalAlloc CloseHandle GlobalLock ReadFile GlobalUnlock GlobalFree SetLastError CopyFileA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW MultiByteToWideChar CreateThread GetExitCodeThread GetTickCount lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GetPrivateProfileIntA GetTempPathA SetErrorMode GetWindowsDirectoryA GetTempFileNameA WritePrivateProfileStringA lstrcpyA GetPrivateProfileStringA CreateFileMappingA MapViewOfFile UnmapViewOfFile VirtualAlloc lstrlenA SetHandleCount GetStdHandle FreeEnvironmentStringsA

user32

GetWindowTextLengthA GetWindowTextA MoveWindow GetWindowPlacement DrawIcon DestroyIcon GetDlgCtrlID SetWindowTextA FillRect GetSysColor GetSysColorBrush IsDialogMessageA GetParent EnableWindow GetDlgItemTextA SetCursor UpdateWindow GetClassInfoA wvsprintfA LoadStringA SendMessageA GetWindowRect SetRect FindWindowA IntersectRect SubtractRect IsWindow CharPrevA CreateDialogParamA MessageBoxIndirectA CharNextA MessageBoxA WaitForInputIdle GetWindowLongA BeginPaint EndPaint SetWindowLongA GetClientRect ClientToScreen SetWindowPos GetWindowDC EndDialog GetDlgItem ShowWindow DialogBoxParamA GetDesktopWindow wsprintfA MsgWaitForMultipleObjects PeekMessageA DefWindowProcA PostMessageA KillTimer PostQuitMessage SetTimer LoadIconA LoadCursorA RegisterClassA CreateWindowExA GetMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC ExitWindowsEx SendDlgItemMessageA DestroyWindow CharLowerBuffA GetSystemMetrics

gdi32

SetBkMode SetTextColor GetObjectA CreateFontIndirectA CreateSolidBrush CreateCompatibleDC SelectObject BitBlt GetTextExtentPointA DeleteObject GetStockObject GetSystemPaletteEntries CreatePalette GetDeviceCaps SelectPalette RealizePalette CreateDIBitmap DeleteDC TranslateCharsetInfo

advapi32

RegQueryValueA RegOpenKeyA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegCloseKey RegCreateKeyExA RegEnumValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenThreadToken RegSetValueExA

ole32

CoTaskMemFree CoCreateGuid CreateItemMoniker StringFromCLSID StgIsStorageFile StgOpenStorage CoCreateInstance CoUninitialize CoInitialize GetRunningObjectTable

oleaut32

VariantChangeType SysAllocString SysAllocStringLen SysStringLen SysReAllocStringLen SysFreeString VariantClear