setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 516KB
Sample260909-wnxtdsdb53
SHA256 f6c8ca784fee32b805963e2589348ea787a1ad812830aebe11db3546717b0d92
MD5 29f4f46121d96c7dc5e0f05ded353152
SHA1 75f743195098b816ddde7c57da67c117a9ce2cac
SHA512 6dca7f38fed4ff5a385f5f93986b27f5a6e752fb8e0c8639726f86eb9ae3fe36d49f17145a26a9cb52a8f97369f17e58e9144114c1227ab52337d53a83f5ea60
SSDEEP 12288:cDuWNvtS/PHV4c1JwX2afK+ixeCz0eMb01JQntLOCr+eM10:cDlvEPTJmix5z0emr2
TLSH
T19CB4171366ECBCB5E17216706B7B97D0CB6EFC201931C61F23D4052E9A7C582B921BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 516KB

setup.exe

IMPHASH 81fd276d49dcfb5944ab1253641f139e
SHA256 f6c8ca784fee32b805963e2589348ea787a1ad812830aebe11db3546717b0d92
MD5 29f4f46121d96c7dc5e0f05ded353152
SHA1 75f743195098b816ddde7c57da67c117a9ce2cac
SHA512 6dca7f38fed4ff5a385f5f93986b27f5a6e752fb8e0c8639726f86eb9ae3fe36d49f17145a26a9cb52a8f97369f17e58e9144114c1227ab52337d53a83f5ea60
SSDEEP 12288:cDuWNvtS/PHV4c1JwX2afK+ixeCz0eMb01JQntLOCr+eM10:cDlvEPTJmix5z0emr2
TLSH
T19CB4171366ECBCB5E17216706B7B97D0CB6EFC201931C61F23D4052E9A7C582B921BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217767

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Q:\cmd\27\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

kernel32

GetNativeSystemInfo EndUpdateResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW ReadFile OpenProcess GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte RaiseException InitializeCriticalSectionAndSpinCount GetCurrentProcessId Sleep HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW MulDiv GetTickCount GetExitCodeProcess LoadLibraryW GetTempPathW SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA HeapReAlloc HeapSize WriteConsoleW ReadConsoleW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW SetEndOfFile OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile GetStringTypeW HeapAlloc HeapFree GetACP GetModuleHandleExW ExitProcess MultiByteToWideChar VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW ScreenToClient GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow GetFocus SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA SetCursor MsgWaitForMultipleObjects

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord8 ord78 ord150 ord92