dmessetup[.]exe | Triage™

resource	yara_rule
static1/unpack001/dmess.exe	aspack_v212_v242

resource	yara_rule
sample	upx
static1/unpack001/uninstall.exe	upx

resource
dmessetup.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/dmess.exe
unpack001/out.upx
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/out.upx

dmessetup.exe

SHA256 6bb55331e039434a95ed3d52a4c7feae9a87965195ac969d854f12370c2a4dac
MD5 18e4662263c45862fc74df6943d7b92d
SHA1 d35d10d518e086986732e7aa0a1061c01ae2e464
SHA512 a12e2112e9bf39394bfac9279f01eaf0bbe8e9a7570c05c952aaa4f3e88a1b50e0c9e4fe143193ebdcc0e7421ea2a40502e4841f2f0086cacacf8ed75417ee07
SSDEEP 6144:lyjOKreLJbU/ylQCfVitM8670bMXe/7fihSSgNP7x362SG+9jsi:lDKyOuQOYKcMXe/7fihbgNF3mH9j/
TLSH
T16A8423D19E8B1974E1CF3735D689D80A277EDDC026779C4220CC4FAA918A7C98E3697C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

198288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH 3764e6c387ce3c76b39936a24d523dce
SHA256 75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84
MD5 4c7d97d0786ff08b20d0e8315b5fc3cb
SHA1 bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c
SHA512 f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a
SSDEEP 192:6KdqJ4Bhf1mdCMI26t510swClJOeFIsm7F1QuPs:6KdE4zAddwR0swqOeFxu
TLSH
T1DB425B625284C8F3E749833D74573717E796162729918ED2CA330BC62A7328E6EF7352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH ee01c5cc33cdb3294484fc93e41c14ad
SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
MD5 2c3c8976d729d28478a789217a882291
SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
TLSH
T1E5B1847223C409B2E65206BB516767E327A2D5303B65B20F8B27628A5C46D73ED3D783
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH aebc3107701149edfc563b8db7a789fd
SHA256 4f945ad53b7aa8ed516b2f58c2ed9f15c13bbdf0e489d71c7347b80583cee5fd
MD5 388c408cff35a38d04e3cda18f63af07
SHA1 9c2aa2ed8b526ace4267acbcf5648b2601019ac4
SHA512 542292d61ff209f6c98c62ebad549024611a7d42fb951f8cc211b886f0d202d5e0da3b754c84c8a00043c748ed527351fc524357412cf88875e6bf729cbba46f
SSDEEP 96:MFJsQxcnqakqeStS6+NMKQwECv0nGhFZxTxZ05hU/61:C9xcnqakCN+N9n0na1K5y61
TLSH
T17ED1D4B7F3C508F3DA8B43703952EB23A333DA216365A1179A5352C5B9928E3DD25712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/dmess.ini

SHA256 fa7a828f0771f89a2b8decf8defac6f0fadc1bfa6fd90027fcb8191c28e56e21
MD5 9bf4d8bfd4938f24cfb90a7f9839ac4f
SHA1 2df0e22af3689513b4df3240f625950a9d3b8c2e
SHA512 105e961a347f6cf4ac4afdecf1b10857a097ef066dfc6fa9b17258f378dce2158803569bb4027058e98af10ae83f0f36eaa7d3c1fb4f6e2b6e0a1b7043fcc56b
TLSH
T11AF0A4C4500593290832D45A592B7DA137E0252846623CE4F5BB68C3A7BADE548EC68E
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

dmess.exe

SHA256 2fa01d7157687694f319e137622f0afbfee0768634f8b130b28a373a31d2dbde
MD5 8107eebcba774c411dd39383288c95f9
SHA1 2a3ac955f77751fe1b16204baf3d7519fd272961
SHA512 a09f8424df50e5a419d39bee8db029ede35820b6914a7b7cfe582ecef35b318f5b18ccc5263c0f0da6929c4dc7b07d5655b024126a5841788dc10f0ba18d5a9a
SSDEEP 6144:nM5ohe09BcNhBQef1c7+jYj8c4JkBEUB7RKs9kQNL1caLnSh1ZvZmk1CkLvjqLor:8ae22Lfi7lIc4Jkb/BuaOhjhmkRZ
TLSH
T1A3742391F2B40D46C1785A3159D3DB125A30CDD9A0C78D7732A6FD6EBFB06839E051A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1044481

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

250KB

Virtual Size

688KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dmess

Size

39KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

english.lng

SHA256 3f15c71af08d90b3cc5bb83f028329cc5b9a1a0e374e7ba2919a117a36c7e526
MD5 4322f9c762d35cf50260efa0e9be34e4
SHA1 b0a35e1d0d26cd1dab001edb7376bc8ed53b64d2
SHA512 cc40fbf3993414cacf0329f94b235948e1aa02311d478209892d060fa89d18a05b95835c0bfeecf1f307b8a9c0f607a9665e0f076483ad7201e5d279d1411aad
SSDEEP 96:zfgdcDT0EWOI/UqdpK0indgGqmqCRBDfETcs3o7mGNPMJmqfcZI0jtBBG2NFDkg7:zYdcDTbW1x3Cc4s3ojUJDoDkggD7uPS+
TLSH
T139C1B662860C091A05A22579F11176D2FB7150EF83472159D78C8ACE33CABED6BE9FDC
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 6339c78c73ebbbfc29c300ac2da39720586f7b1d956e3971c5db87636690a531
MD5 21791f14bcc23c52dc0c5f8009492930
SHA1 19ac8cf94b5c3114366fcd1f2dc540fa72a46451
SHA512 219342a97c06a86633364d10ebe7c0ef7b11a167c626ebd8f024898b7bb8921c4c3ec25c0ff13bf977958d5d92c6fdad962af318549573f3319b41d63667f920
SSDEEP 768:Lh03BWfzcJpdd4jU3eRo8rwV0GfL7rAX:Lh03grsyj5Rk0gAX
TLSH
T195038D3572C1D873D5735A714BA79272F3B6E7002222B74B1B454FBA6822AC3DE1A203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

russian.lng

SHA256 868ba76d0e1dbf9a76cb6802d7254775c27243ace59e8f2e9ad2b808a108619b
MD5 1e86172825f1ac5f1b5136283190cbe1
SHA1 bfbccae7ed7c6c55145a4632982262e2dc89f102
SHA512 6cf794440e4a44186d1b3b69cd25afe73bad906853a551f47d851b5ed74931c51a4885f9517f6aa03c57e8476af13e74432192a76c62a94c0c589da7618fc633
SSDEEP 192:zsWbIl9AImg0kBk8jUx2y6+5x0ruVC7S1MKU:zAllkD2rSmruVC5
TLSH
T1ADD1D812975C074186640FBC2A57A8601AB400ECA9D5935BC147ABCE37D432872BBA8F
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

uninstall.exe

SHA256 122799443b14b9c9754added23e47c78d911db7f21c161259d90fc328de17d61
MD5 acec234699e5f3ffebfd25dc572466e3
SHA1 1ec63fcd6bf87d8666f03560790f7066d691fd9d
SHA512 76236b6bbf4b92a140f5762fd0d6e995c142221b5a37cdd8daae03665098f90202395420de1f86deffd4d80bb0dd164d3a881271b3e68232d0a0d10f2a2a5f5d
SSDEEP 768:F2jIOVc13KaUcwYbnJAkqAt4LVrLQpjdJ/E9EeDazKuX:FHO2xKAbCkzyLVXCjf/imzKM
TLSH
T1B7D2D1C0E3D0AE58EBF2477E42B38B54263EF8E12239DB2552A01A17ADDF7C74915136
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

198288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH ee01c5cc33cdb3294484fc93e41c14ad
SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
MD5 2c3c8976d729d28478a789217a882291
SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
TLSH
T1E5B1847223C409B2E65206BB516767E327A2D5303B65B20F8B27628A5C46D73ED3D783
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 384d9816dfa5360d07e5db84f427aa8006ee6a6b08527cd9c2c3b89193701c65
MD5 8a065a891cb0f640a986a0c650efd58b
SHA1 a4cb93a4baf1e4b22cd65aa5e9aaaff849fb49ec
SHA512 b87904fb7a982014be6c6b2e8cbe6a42a2a4401fa195d2e984eed26749cbe055856f0b7104ea23e0770acd58d12d53989b288113c3869bafe7accf15a28fc018
SSDEEP 768:Lh03BWfzcJpdd4jU3eRo8rwV0GfL7rk/E9EeX:Lh03grsyj5Rk0gk/iX
TLSH
T170038D7672D0E863D5734A714AB39272F377EB002232B74B1B841F797962AC3DD1A216
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

dmessetup.exe

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

comdlg32

shell32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/dmess.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

dmess.exe

generic

english.lng

out.upx

generic

russian.lng

uninstall.exe

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

dmessetup.exe

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

comdlg32

shell32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/dmess.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

dmess.exe

generic

english.lng

out.upx

generic

russian.lng

uninstall.exe

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

out.upx

generic