setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 284KB
Sample261023-cf12asy18m
SHA256 8883a96024ddfeca58233e3e3ea62124684468da368befe3c6a7f730ad56ceb0
MD5 7d937072627aff99ae4bb1d9612e6a10
SHA1 5b221be3e17f1a8a677ffc733855959c0a70cea9
SHA512 05248c7f0078162decc90320c8df4d8eef93789905b0f3eb11fd23d15aef4e951a17e39195cc562de16d21383a4173cc423d817302780114a16882b538c9f889
SSDEEP 6144:HT+E1wQbLF+gV2l1SMqfzVYqZJaFy8r12u35fmk:Hd1pnFBVKPAeqZJa9h28
TLSH
T159545A4AB3B448E8F823C17EC9929706EB7278525760E6CF0760475A3F276E09D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 284KB

setup.exe

IMPHASH db4fe1b248bbe09b9293a79f4578cbb4
SHA256 8883a96024ddfeca58233e3e3ea62124684468da368befe3c6a7f730ad56ceb0
MD5 7d937072627aff99ae4bb1d9612e6a10
SHA1 5b221be3e17f1a8a677ffc733855959c0a70cea9
SHA512 05248c7f0078162decc90320c8df4d8eef93789905b0f3eb11fd23d15aef4e951a17e39195cc562de16d21383a4173cc423d817302780114a16882b538c9f889
SSDEEP 6144:HT+E1wQbLF+gV2l1SMqfzVYqZJaFy8r12u35fmk:Hd1pnFBVKPAeqZJa9h28
TLSH
T159545A4AB3B448E8F823C17EC9929706EB7278525760E6CF0760475A3F276E09D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord17

shell32

SHGetPathFromIDListW ShellExecuteExW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetMalloc ShellExecuteW

gdi32

SelectObject DeleteObject CreateFontIndirectW GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteDC SetStretchBltMode GetDeviceCaps GetCurrentObject StretchBlt

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

user32

LoadImageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect ClientToScreen MessageBeep GetClientRect GetDC DrawTextW EnableMenuItem GetSystemMenu GetSystemMetrics EnableWindow SetFocus GetDlgItem DialogBoxIndirectParamW IsWindow CreateWindowExA DrawIconEx DefWindowProcW SystemParametersInfoW MessageBoxA GetKeyState CallWindowProcW GetClassNameA GetParent GetDesktopWindow GetWindowLongW GetSysColor ScreenToClient GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW ReleaseDC GetWindowDC GetMenu KillTimer SetTimer CharUpperW SetWindowPos DestroyWindow CreateWindowExW DispatchMessageW GetMessageW wsprintfW wsprintfA SendMessageW BringWindowToTop ShowWindow EndDialog LoadIconW wvsprintfW CopyImage

ole32

CoInitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

VariantClear SysFreeString OleLoadPicture SysAllocString SysAllocStringLen

kernel32

HeapSize FlushFileBuffers GetConsoleOutputCP SetFilePointerEx WriteConsoleW GetConsoleMode GetStringTypeW SetStdHandle GetFileType GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter VirtualFree VirtualAlloc WaitForMultipleObjects GetFileInformationByHandle SetFileTime SetFilePointer SetEndOfFile ReadFile GetFileSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection IsBadReadPtr lstrcpyW FormatMessageW LocalFree GetSystemDirectoryW SuspendThread GetTickCount lstrlenW GetCommandLineW CloseHandle GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatus WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW GetStartupInfoW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetDiskFreeSpaceExW SetFileAttributesW Sleep CreateThread GetExitCodeThread GetLocalTime SystemTimeToFileTime GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CompareFileTime CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW WriteFile GetTempPathW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA GlobalAlloc GlobalFree MulDiv lstrcmpW lstrcmpiA lstrcmpiW lstrlenA FindResourceExA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetSystemDefaultUILanguage SetThreadLocale GetUserDefaultUILanguage GetSystemDefaultLCID SetEnvironmentVariableW CreateFileW GetDriveTypeW GetCurrentProcess GetVersionExW SetProcessWorkingSetSize GetModuleFileNameW InitializeCriticalSection SetEvent ResetEvent CreateEventW GetCurrentThreadId TerminateThread

Name

.text

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

comctl32

shell32

gdi32

advapi32

user32

ole32

oleaut32

kernel32

generic