setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 258KB
Sample261022-2an7zsys3p
SHA256 3d343daa888e30d5d0e02e811ff847350136a6a9abf46ee020d2aff2672a16ea
MD5 30c71e35f983df666d188ab021f2a2ba
SHA1 23b7ab96c08d4d731186a685fec1c5d672073771
SHA512 858092d7c02d13a648cff5aac41253069b038c182e360dac470c819fa0236821d996a8b29c36055b57ac35d698e0b6c678e6dbc7be80cfa44cecad16a37cf139
SSDEEP 6144:lfWS5FYJSzhVjzr7wFhIhJZVZDMJQHbVYPt3gYX:lluAznjzP4W1VZDM3PtX
TLSH
T1D2445A5A73B40CE8F823817DC592DB06EB72B8524760E6CF47A086576F236E19C3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 258KB

setup.exe

IMPHASH db4fe1b248bbe09b9293a79f4578cbb4
SHA256 3d343daa888e30d5d0e02e811ff847350136a6a9abf46ee020d2aff2672a16ea
MD5 30c71e35f983df666d188ab021f2a2ba
SHA1 23b7ab96c08d4d731186a685fec1c5d672073771
SHA512 858092d7c02d13a648cff5aac41253069b038c182e360dac470c819fa0236821d996a8b29c36055b57ac35d698e0b6c678e6dbc7be80cfa44cecad16a37cf139
SSDEEP 6144:lfWS5FYJSzhVjzr7wFhIhJZVZDMJQHbVYPt3gYX:lluAznjzP4W1VZDM3PtX
TLSH
T1D2445A5A73B40CE8F823817DC592DB06EB72B8524760E6CF47A086576F236E19C3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

114032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord17

shell32

SHGetPathFromIDListW ShellExecuteExW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetMalloc ShellExecuteW

gdi32

SelectObject DeleteObject CreateFontIndirectW GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteDC SetStretchBltMode GetDeviceCaps GetCurrentObject StretchBlt

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

user32

LoadImageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect ClientToScreen MessageBeep GetClientRect GetDC DrawTextW EnableMenuItem GetSystemMenu GetSystemMetrics EnableWindow SetFocus GetDlgItem DialogBoxIndirectParamW IsWindow CreateWindowExA DrawIconEx DefWindowProcW SystemParametersInfoW MessageBoxA GetKeyState CallWindowProcW GetClassNameA GetParent GetDesktopWindow GetWindowLongW GetSysColor ScreenToClient GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW ReleaseDC GetWindowDC GetMenu KillTimer SetTimer CharUpperW SetWindowPos DestroyWindow CreateWindowExW DispatchMessageW GetMessageW wsprintfW wsprintfA SendMessageW BringWindowToTop ShowWindow EndDialog LoadIconW wvsprintfW CopyImage

ole32

CoInitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

VariantClear SysFreeString OleLoadPicture SysAllocString SysAllocStringLen

kernel32

HeapSize FlushFileBuffers GetConsoleOutputCP SetFilePointerEx WriteConsoleW GetConsoleMode GetStringTypeW SetStdHandle GetFileType GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter VirtualFree VirtualAlloc WaitForMultipleObjects GetFileInformationByHandle SetFileTime SetFilePointer SetEndOfFile ReadFile GetFileSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection IsBadReadPtr lstrcpyW FormatMessageW LocalFree GetSystemDirectoryW SuspendThread GetTickCount lstrlenW GetCommandLineW CloseHandle GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatus WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW GetStartupInfoW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetDiskFreeSpaceExW SetFileAttributesW Sleep CreateThread GetExitCodeThread GetLocalTime SystemTimeToFileTime GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CompareFileTime CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW WriteFile GetTempPathW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA GlobalAlloc GlobalFree MulDiv lstrcmpW lstrcmpiA lstrcmpiW lstrlenA FindResourceExA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetSystemDefaultUILanguage SetThreadLocale GetUserDefaultUILanguage GetSystemDefaultLCID SetEnvironmentVariableW CreateFileW GetDriveTypeW GetCurrentProcess GetVersionExW SetProcessWorkingSetSize GetModuleFileNameW InitializeCriticalSection SetEvent ResetEvent CreateEventW GetCurrentThreadId TerminateThread

Name

.text

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

comctl32

shell32

gdi32

advapi32

user32

ole32

oleaut32

kernel32

generic