setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 667KB
Sample261018-wwggdahs21
SHA256 36bd42317c14d1dc0558859f34330aca8b56b43c1405cdb269bd8afb11a1a8cd
MD5 13c903ae4c3cab72a6222620d550eed5
SHA1 052c5b9e3619a67cb310f099ee26f967b8c886fc
SHA512 5d171d04e2736dccd87495c605f2d069a8156db3f3492c02b168f167b9225642bc56f1ab574aa9960859ac332a79e4336e5cf5535c6de992b688c4496aefdb8a
SSDEEP 12288:SMOm++g05n4/0zIF/F9ywG6ph2eMb01JQntLOCQEa80C:SMOm++4mUcwjsemQl80
TLSH
T1CCE40513A6DCBCA5E17206B0AB7787D1CB7EFC205B20C68F23D005595A7D5C2BE21B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 667KB

setup.exe

IMPHASH 73d77a8f6e914c6a62ba001fc9473930
SHA256 36bd42317c14d1dc0558859f34330aca8b56b43c1405cdb269bd8afb11a1a8cd
MD5 13c903ae4c3cab72a6222620d550eed5
SHA1 052c5b9e3619a67cb310f099ee26f967b8c886fc
SHA512 5d171d04e2736dccd87495c605f2d069a8156db3f3492c02b168f167b9225642bc56f1ab574aa9960859ac332a79e4336e5cf5535c6de992b688c4496aefdb8a
SSDEEP 12288:SMOm++g05n4/0zIF/F9ywG6ph2eMb01JQntLOCQEa80C:SMOm++4mUcwjsemQl80
TLSH
T1CCE40513A6DCBCA5E17206B0AB7787D1CB7EFC205B20C68F23D005595A7D5C2BE21B96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dbs\el\ddvsm\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

kernel32

OpenProcess GetNativeSystemInfo EndUpdateResourceW VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW Sleep GetTempPathW GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GetModuleHandleA GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte InitializeCriticalSectionAndSpinCount HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW VerSetConditionMask DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW GetCurrentProcessId MulDiv GetTickCount GetExitCodeProcess LoadLibraryW ReadFile SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA LCMapStringEx WriteConsoleW HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW OutputDebugStringW SetEndOfFile SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile TlsFree TlsSetValue TlsGetValue TlsAlloc HeapFree HeapAlloc GetFileType UnhandledExceptionFilter IsDebuggerPresent RaiseException VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetStdHandle ExitProcess TerminateProcess GetModuleHandleExW

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

SHGetMalloc ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW SetCursor GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects GetFocus SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA ScreenToClient

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord92 ord150 ord78 ord8

shlwapi

UrlUnescapeW

Name

.text

Size

375KB

Virtual Size

375KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

shlwapi

generic