setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 2.2MB
Sample261014-e7ecqags4l
SHA256 87fa903d40c845c1f7c1a9d6835bd4a753fb538310077569027cadcd6f367352
MD5 8b7cf356b62666634062df5608148b36
SHA1 f298dc99a3128d2624e5c01bff22ef373bad6888
SHA512 97cbf1a053b303f2adc706805179130a081c5c7d825043ca3dcc4905f229027299f31c14fe32ef988858fe972fcc00d1e94b0ef20e201eba562f589ed1934a73
SSDEEP 49152:Mrtu2vfWbqsJ4qpSWeTSeTVopCN6LsxB9j+4Q0wMmBfACB+LBlKGnR1+uWiYisfq:CtDvfWbqsJ4qpSWeTSeTVopCN6LsxB9D
TLSH
T19BB5C49152348921DBFA1D342B385AE28E20BFDB01ACF19D0B1DF91DE9B3AD348795C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 2.2MB

setup.exe

IMPHASH ce577db4737444c3de8c6053a053957d
SHA256 87fa903d40c845c1f7c1a9d6835bd4a753fb538310077569027cadcd6f367352
MD5 8b7cf356b62666634062df5608148b36
SHA1 f298dc99a3128d2624e5c01bff22ef373bad6888
SHA512 97cbf1a053b303f2adc706805179130a081c5c7d825043ca3dcc4905f229027299f31c14fe32ef988858fe972fcc00d1e94b0ef20e201eba562f589ed1934a73
SSDEEP 49152:Mrtu2vfWbqsJ4qpSWeTSeTVopCN6LsxB9j+4Q0wMmBfACB+LBlKGnR1+uWiYisfq:CtDvfWbqsJ4qpSWeTSeTVopCN6LsxB9D
TLSH
T19BB5C49152348921DBFA1D342B385AE28E20BFDB01ACF19D0B1DF91DE9B3AD348795C5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

161794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

libatriagu

gu_set_help_root gu_get_applet_help_dir gu_help

msi

ord8 ord73 ord141 ord44 ord67 ord95

kernel32

FileTimeToLocalFileTime GetTickCount RtlUnwind HeapFree ExitProcess TerminateProcess GetStartupInfoA GetCommandLineA HeapAlloc HeapReAlloc RaiseException GetACP SetStdHandle GetFileType HeapSize GetTimeZoneInformation LCMapStringA FileTimeToSystemTime HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr GetDriveTypeA UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr CompareStringA CompareStringW SetEnvironmentVariableA SetErrorMode GetFileTime GetFileSize GetCurrentDirectoryA GetOEMCP GetCPInfo TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalAlloc GlobalFlags GetProcessVersion FindResourceExA SizeofResource GetThreadLocale GetFullPathNameA GetVolumeInformationA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle CloseHandle GlobalAlloc lstrcmpA GetCurrentThread lstrcpynA SetLastError WideCharToMultiByte lstrlenA InterlockedDecrement InterlockedIncrement GetVersion lstrcatA GetCurrentThreadId GlobalGetAtomNameA lstrcmpiA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcpyA GlobalLock GlobalUnlock FindResourceA LoadResource LockResource GlobalFree OutputDebugStringA GetLocalTime GetEnvironmentVariableA GetModuleHandleA GetPrivateProfileStringA GetShortPathNameA FindFirstFileA FindClose CreateProcessA WritePrivateProfileStringA CopyFileA LocalFree SetFileAttributesA GetTempPathA GetModuleFileNameA CreateDirectoryA DeleteFileA GetFileAttributesA GetComputerNameA LoadLibraryA GetProcAddress FreeLibrary GetVersionExA MultiByteToWideChar GetLastError FormatMessageA GetLocaleInfoA MulDiv GetProfileStringA LCMapStringW

user32

PostThreadMessageA ModifyMenuA SetMenuItemBitmaps CheckMenuItem MoveWindow SetWindowTextA IsDialogMessageA SetDlgItemTextA UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor PeekMessageA DispatchMessageA AdjustWindowRectEx ScreenToClient CopyRect IsWindowVisible GetTopWindow MessageBoxA IsChild WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetWindowTextA GetDlgCtrlID GetKeyState DefWindowProcA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetLastActivePopup GetForegroundWindow SetForegroundWindow GetWindow RegisterWindowMessageA OffsetRect IntersectRect IsIconic GetWindowPlacement GetNextDlgTabItem EndDialog IsWindow CreateDialogIndirectParamA DestroyWindow MapDialogRect SetWindowPos ShowWindow GetCapture MessageBeep UnregisterClassA HideCaret ShowCaret ExcludeUpdateRgn DefDlgProcA GetActiveWindow SetActiveWindow GetAsyncKeyState GetWindowLongA SetFocus GetDlgItem IsWindowEnabled LoadBitmapA SystemParametersInfoA SetWindowLongA GetParent GetClientRect DrawFocusRect RegisterClipboardFormatA GetWindowTextLengthA GetDesktopWindow GetWindowRect InvalidateRect GetSystemMetrics GetFocus LoadIconA SendMessageA GetDC ReleaseDC EnableWindow PostMessageA GetNextDlgGroupItem SetRect CopyAcceleratorTableA IsWindowUnicode CharNextA DestroyMenu PtInRect GetClassNameA GetSysColorBrush LoadCursorA CharUpperA SetWindowContextHelpId GetMessageA TranslateMessage ValidateRect GetCursorPos SetCursor PostQuitMessage InflateRect LoadStringA GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ClientToScreen GetMenuCheckMarkDimensions CreateWindowExA GetMenuState EnableMenuItem

gdi32

OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx IntersectClipRect DeleteObject SetViewportOrgEx GetViewportExtEx GetWindowExtEx CreateSolidBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetMapMode PatBlt CreateFontIndirectA DPtoLP EnumFontFamiliesExA GetTextColor GetBkColor LPtoDP SetMapMode SetBkMode SelectObject RestoreDC SaveDC DeleteDC CreateBitmap GetObjectA SetBkColor SetTextColor GetClipBox GetTextExtentPointA BitBlt CreateCompatibleDC GetStockObject GetDeviceCaps CreateDIBitmap CreateFontA

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA

shell32

ShellExecuteExA

comctl32

_TrackMouseEvent PropertySheetA DestroyPropertySheetPage CreatePropertySheetPageA ord17 ImageList_Destroy ImageList_LoadImageA

oledlg

ord8

ole32

CoFreeUnusedLibraries OleUninitialize CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoInitialize CoUninitialize CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard OleInitialize

olepro32

ord253

oleaut32

SysAllocString SysAllocStringByteLen VariantChangeType SysStringLen VariantCopy VariantTimeToSystemTime VariantClear SysAllocStringLen SysFreeString