setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 387KB
Sample260827-s5pybsxcph
SHA256 c3580375138f33370268c637e9aa19947a318ff46a1a582076c0caa0bd18ddb6
MD5 8cea60a864d72de5098229e261d8c24c
SHA1 783176660cf5d9424ab439a659f8fa8e4bade12a
SHA512 8ffcccd07f706c1c3719f5f1e0fe10aeb1ff210e810e8c882fdf08ba9c1d97714ce0916a9a1a357cacd4c2992936c06c94bd6eadaff97d4c13a54e84ccdddd74
SSDEEP 6144:GqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD307ojDuUlXYeO:G7IRWDvFa+nhmuF3Y0scAeDuUlXp
TLSH
T1C7844B2267E49031E8F322B45A7D26215A7EBCB15B3581CB539036EEDD70AD2DE3074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 387KB

setup.exe

IMPHASH cfa06eb8ecb157d3e1e5170182639085
SHA256 c3580375138f33370268c637e9aa19947a318ff46a1a582076c0caa0bd18ddb6
MD5 8cea60a864d72de5098229e261d8c24c
SHA1 783176660cf5d9424ab439a659f8fa8e4bade12a
SHA512 8ffcccd07f706c1c3719f5f1e0fe10aeb1ff210e810e8c882fdf08ba9c1d97714ce0916a9a1a357cacd4c2992936c06c94bd6eadaff97d4c13a54e84ccdddd74
SSDEEP 6144:GqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD307ojDuUlXYeO:G7IRWDvFa+nhmuF3Y0scAeDuUlXp
TLSH
T1C7844B2267E49031E8F322B45A7D26215A7EBCB15B3581CB539036EEDD70AD2DE3074B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

189761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.pdb

kernel32

Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcessId GetNativeSystemInfo SetFilePointer HeapSetInformation CreateEventW SetEvent SizeofResource LockResource LoadResource FindResourceW GetVersionExW CompareStringW GetFileAttributesW GetModuleFileNameW ExpandEnvironmentStringsW GlobalFree OpenProcess GetSystemDirectoryW DeleteFileW GetTempFileNameW GetTempPathW LocalFree FormatMessageW ReadFile GetTimeFormatW GetDateFormatW CreateDirectoryW CopyFileW WideCharToMultiByte GetWindowsDirectoryW GetSystemInfo GetCurrentProcess GetEnvironmentVariableW GetModuleHandleW GetVersion CreateFileW EndUpdateResourceW Sleep GetDiskFreeSpaceExW DeleteCriticalSection CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection MulDiv lstrlenW GetExitCodeProcess SetEndOfFile GetTickCount FindFirstFileW FindNextFileW FindClose GlobalAlloc LoadLibraryW UpdateResourceA BeginUpdateResourceA InterlockedCompareExchange FindResourceA DeleteFileA lstrlenA CreateFileA UpdateResourceW BeginUpdateResourceW GetEnvironmentVariableA SetStdHandle WriteConsoleW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP GetProcessHeap MultiByteToWideChar LCMapStringW GetStringTypeW GetLocaleInfoW IsValidCodePage GetOEMCP GetACP IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapAlloc IsProcessorFeaturePresent GetSystemTimeAsFileTime QueryPerformanceCounter HeapCreate GetCurrentThreadId InterlockedExchange SwitchToThread GetLastError WaitForSingleObject CloseHandle GetProcAddress FreeLibrary WriteFile SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc GetFileType InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA RaiseException GetCommandLineW GetStartupInfoW RtlUnwind HeapFree InterlockedDecrement GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount

gdi32

GetStockObject EnumFontFamiliesExW CreateFontIndirectW DeleteObject CreateCompatibleDC GetDeviceCaps GetObjectW DeleteDC SelectObject GetTextMetricsW GetTextExtentPoint32W

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

MessageBoxA ShowScrollBar GetClientRect SendMessageA SetClassLongW SetWindowTextW LoadCursorW SetCursor CreateDialogIndirectParamW SetForegroundWindow EnableWindow GetFocus SetFocus ScreenToClient MoveWindow LoadIconW SetDlgItemTextW SendMessageW GetDlgItem MsgWaitForMultipleObjects PeekMessageW IsDialogMessageW TranslateMessage DispatchMessageW DestroyWindow ShowWindow SendDlgItemMessageW GetWindowRect SystemParametersInfoW ExitWindowsEx MessageBoxW DrawTextW GetSystemMetrics GetDC GetDialogBaseUnits ReleaseDC CreateDialogParamW LoadImageW

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord8 ord150 ord78 ord92