Set-up[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Set-up.exe
Size 7.3MB
Sample260916-q16n6sbb82
SHA256 3d20655679c8829a6baad001851905927ef1b826e3eea594b7be3f8331211e39
MD5 e9d48daf4748eee45abf308b85e88b71
SHA1 7d49960c966e22ac2df69c79a84c5c48e55b8560
SHA512 2132693d8d1db4171a60251946b73eed091991d48e1fa3f4c8bd32a6467f8c9d4a3ab6cb883b8113fa3df648b2bd0b2c0418a468356a998df4f0b288735a9255
SSDEEP 98304:6z16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX0T:6z16gBrd3gu/XmDZiF0t
TLSH
T1F576F84162D58064F1B32675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Set-up.exe

File Explorer

Set-up.exe

.exe 7.3MB

Set-up.exe

IMPHASH 26d1142062053486e607ffede8dd675c
SHA256 3d20655679c8829a6baad001851905927ef1b826e3eea594b7be3f8331211e39
MD5 e9d48daf4748eee45abf308b85e88b71
SHA1 7d49960c966e22ac2df69c79a84c5c48e55b8560
SHA512 2132693d8d1db4171a60251946b73eed091991d48e1fa3f4c8bd32a6467f8c9d4a3ab6cb883b8113fa3df648b2bd0b2c0418a468356a998df4f0b288735a9255
SSDEEP 98304:6z16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX0T:6z16gBrd3gu/XmDZiF0t
TLSH
T1F576F84162D58064F1B32675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

2954362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Set-up.pdb

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW PathIsRelativeW PathRemoveBackslashW PathIsNetworkPathW PathStripPathW UrlIsW SHGetValueW UrlEscapeW PathFindFileNameW PathRemoveFileSpecW PathRemoveExtensionW PathFileExistsW PathAddExtensionW PathIsFileSpecW PathAppendW PathIsDirectoryW PathRenameExtensionW PathIsSystemFolderW PathFileExistsA PathAddBackslashW PathIsRootW PathStripToRootW

shell32

SHCreateDirectoryExW ord51 SHGetKnownFolderPath ShellExecuteW ShellExecuteExW SHGetSpecialFolderLocation SHBrowseForFolderW ord680 SHGetMalloc SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW

kernel32

FindNextFileW WaitForMultipleObjects CreateFileW CreateEventW SetEvent ResetEvent GetOverlappedResult ReadDirectoryChangesW MultiByteToWideChar WideCharToMultiByte GetFileSizeEx FindClose GetFileAttributesW SetFileAttributesW DeleteFileW GetLocalTime GetTimeFormatW GetDateFormatW GetCurrentProcess DeviceIoControl GetTempPathW GetVersionExW GetComputerNameExW FileTimeToSystemTime GetNativeSystemInfo RaiseException LoadLibraryW GetProcAddress CreateProcessW GetModuleHandleW FreeLibrary InitializeCriticalSectionEx DecodePointer MulDiv GetModuleFileNameW TerminateProcess RemoveDirectoryW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CopyFileW GetExitCodeProcess ReadFile SetLastError lstrlenW LocalAlloc GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW GetFileSize lstrcpyW lstrcmpiW lstrcmpW GetDriveTypeW GetFullPathNameW HeapSize HeapReAlloc HeapDestroy GlobalAlloc GlobalLock GlobalUnlock GetSystemDirectoryW SetDllDirectoryW GetStdHandle AttachConsole FreeConsole GetConsoleWindow AreFileApisANSI TryEnterCriticalSection HeapCreate WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer LeaveCriticalSection SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW GlobalFree VerSetConditionMask FindFirstFileW GetUserDefaultLCID LCMapStringW DuplicateHandle ProcessIdToSessionId TerminateThread CreateThread FindResourceExW GetThreadTimes QueryFullProcessImageNameW GetUserDefaultLangID GetUserDefaultUILanguage SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe CreateDirectoryW ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW GetTimeZoneInformation VirtualFree VirtualAlloc QueryPerformanceFrequency GetCurrentThread SetFilePointerEx ResumeThread SetThreadPriority EnterCriticalSection CompareStringW GetCPInfo EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStringTypeW GetExitCodeThread SwitchToThread GetModuleHandleExW QueueUserWorkItem IsProcessorFeaturePresent LoadLibraryExA VirtualQuery VirtualProtect GetCurrentProcessId GetCurrentThreadId OpenMutexW CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW GetProcessHeap HeapAlloc HeapFree LocalFree GetLastError FormatMessageW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask DeleteCriticalSection RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle WriteConsoleW ExitProcess GetConsoleCP GetConsoleMode IsValidLocale EnumSystemLocalesW ReadConsoleW FindFirstFileExW IsValidCodePage GetACP VerifyVersionInfoW GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSection SetEnvironmentVariableW GetFullPathNameA

user32

CharNextW BringWindowToTop TranslateAcceleratorW GetClassNameW SetCapture GetDlgItem GetParent RegisterWindowMessageW ReleaseCapture SetForegroundWindow InvalidateRect GetForegroundWindow GetSysColor AttachThreadInput IsChild DestroyAcceleratorTable ClientToScreen RedrawWindow InvalidateRgn IsWindow SetFocus ScreenToClient FillRect GetFocus GetWindow IsIconic BeginPaint EndPaint GetWindowTextW GetSystemMetrics GetMessageW DefWindowProcW GetWindowLongW DestroyWindow SetWindowPos CreateWindowExW SendMessageW RegisterClassExW GetActiveWindow DispatchMessageW CreateAcceleratorTableW SetWindowTextW CallWindowProcW GetWindowTextLengthW GetWindowThreadProcessId wsprintfW PostThreadMessageW TranslateMessage LoadCursorW SetWindowLongW PostQuitMessage GetDesktopWindow GetClassInfoExW GetDC MessageBoxW ShowWindow GetAsyncKeyState ReleaseDC PostMessageW UnregisterClassW GetClientRect EnumWindows MoveWindow GetShellWindow LoadImageW SystemParametersInfoW EnableMenuItem LoadIconW GetSystemMenu GetClassLongW AppendMenuW SetClassLongW GetWindowRect

gdi32

DeleteDC GetObjectW DeleteObject CreateSolidBrush GetDeviceCaps SelectObject CreateCompatibleBitmap GetStockObject BitBlt CreateCompatibleDC

advapi32

SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW GetTokenInformation CreateWellKnownSid LookupPrivilegeValueW OpenProcessToken RegFlushKey RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegSetValueExW LookupAccountSidW RegOpenKeyExW RegEnumValueW EqualSid InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW GetUserNameW CredWriteW CredReadW CredDeleteW CredFree CredEnumerateW AdjustTokenPrivileges

ole32

CoCreateGuid CoAddRefServerProcess OleRun CoUninitialize CoInitialize CLSIDFromString CreateStreamOnHGlobal CLSIDFromProgID CoGetClassObject CoCreateInstance StringFromGUID2 OleInitialize OleUninitialize OleLockRunning CoTaskMemAlloc CoTaskMemFree CoReleaseServerProcess

oleaut32

VariantChangeType SysAllocStringLen SysStringLen SysFreeString VariantInit SysAllocString OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysAllocStringByteLen VariantCopy SysStringByteLen DispCallFunc GetErrorInfo VariantClear

bcrypt

BCryptCloseAlgorithmProvider BCryptVerifySignature BCryptGenerateSymmetricKey BCryptSetProperty BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptGetProperty

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW CryptProtectData CryptUnprotectData CryptStringToBinaryW CertOpenStore CertFindCertificateInStore CertFreeCertificateContext CertCreateCertificateContext CryptHashCertificate2 CryptImportPublicKeyInfoEx2 CertVerifySubjectCertificateContext CertAddCertificateContextToStore CertCloseStore

secur32

GetUserNameExW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain