setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 3.8MB
Sample261011-qyb2saae76
SHA256 972d5f43063c6d3656346e8cac0a6bccc464b4ef7ae65e281d256778382ffa12
MD5 c94b1e98d828f24ce14ceadd507e1bf9
SHA1 523c71c3115aebe335a78057cf2d37f99643391c
SHA512 05523098cfdfa75fa6664aeb8e169d5c281b0c2645a3d59573272ffa8071b9cdb6c0efbf6fb3b9fb3106b2db331692969b0047a64cfcb7d6346fcd01dbfc9ed4
SSDEEP 98304:+EqdV6JWGMSUEI4izSUfqs6SbimhteW5TNnSwpjBl/FbJ3f:+b6JWvEViz1qsZbii5BXpjBh1Jv
TLSH
T10C062330BDB1C031D37376704D79F26624EE69302E355A9F63D81ABE1FB44926B04A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 3.8MB

setup.exe

IMPHASH 632f939005ccaa4d7643b0a302c14333
SHA256 972d5f43063c6d3656346e8cac0a6bccc464b4ef7ae65e281d256778382ffa12
MD5 c94b1e98d828f24ce14ceadd507e1bf9
SHA1 523c71c3115aebe335a78057cf2d37f99643391c
SHA512 05523098cfdfa75fa6664aeb8e169d5c281b0c2645a3d59573272ffa8071b9cdb6c0efbf6fb3b9fb3106b2db331692969b0047a64cfcb7d6346fcd01dbfc9ed4
SSDEEP 98304:+EqdV6JWGMSUEI4izSUfqs6SbimhteW5TNnSwpjBl/FbJ3f:+b6JWvEViz1qsZbii5BXpjBh1Jv
TLSH
T10C062330BDB1C031D37376704D79F26624EE69302E355A9F63D81ABE1FB44926B04A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\git-sdk-64\usr\src\MSYS2-packages\p7zip\src\p7zip_16.02.bup\CPP\7zip\Bundles\SFXSetup\ReleaseD\7zSD.pdb

kernel32

VirtualAlloc VirtualFree GetVersionExA GetSystemDirectoryW GetModuleHandleA GetProcAddress LoadLibraryExW lstrcatW lstrlenW CloseHandle GetLastError InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventA CreateSemaphoreA AreFileApisANSI MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameA GetModuleFileNameW LoadLibraryExA LoadLibraryA LoadLibraryW LocalFree FormatMessageA FormatMessageW SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryA CreateDirectoryW CreateFileW DeleteFileA DeleteFileW RemoveDirectoryA RemoveDirectoryW SetFileAttributesA SetFileAttributesW SetFileTime GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetTickCount GetSystemDirectoryA GetWindowsDirectoryA GetWindowsDirectoryW GetModuleHandleW GetTempPathA MoveFileA MoveFileW FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstChangeNotificationW FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetFileAttributesA GetFileAttributesW GetLogicalDriveStringsW GetLogicalDriveStringsA CreateFileA GetFileSize ReadFile SetEndOfFile SetFilePointer WriteFile CompareFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetFileInformationByHandle WaitForMultipleObjects Sleep GetCommandLineW CreateProcessA WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetConsoleCtrlHandler GetProcessHeap GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage DecodePointer FindFirstFileExW FindFirstFileExA WaitForSingleObjectEx OutputDebugStringW OutputDebugStringA HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCurrentThread HeapAlloc HeapFree GetACP ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList EncodePointer RaiseException RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent

user32

CharUpperA ShowWindow CharUpperW DestroyWindow LoadIconA KillTimer SetTimer PostMessageA InvalidateRect GetDC DrawTextW EndDialog MessageBoxW CharPrevExA GetWindowTextLengthW GetWindowTextLengthA GetWindowTextW GetWindowTextA SetWindowTextW SetWindowTextA CreateWindowExW CreateWindowExA RegisterClassW RegisterClassA SendMessageA LoadStringW LoadStringA SystemParametersInfoA MapDialogRect SetWindowLongA GetWindowLongA ScreenToClient GetWindowRect GetDialogBaseUnits GetDlgItem DialogBoxParamW DialogBoxParamA CreateDialogParamW CreateDialogParamA MoveWindow SendMessageW

shell32

DragQueryFileW DragFinish DragQueryFileA ShellExecuteExA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc

ole32

CoInitialize CoUninitialize

oleaut32

VariantCopy VariantClear SysAllocStringLen SysAllocString SysStringLen