KennySetup (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
KennySetup (1).exe
Size 4.1MB
Sample261107-plagraysft
SHA256 3363d4035c065e306b41bed57e34ca04462c579e29704f1addc9789208cfda6a
MD5 e360d4ef47939b0996bd4aa6cb164084
SHA1 63f1df98c3444caacaa4ac9bba1e2c55623c5d60
SHA512 b0f836c8c02ab4b3892ad9109e71ab8073d26e2edb8395284a737207fb51badb7b5e5ba65377a5c1b3d1fdf2c8c736f6bf6d1e768a2d0142a16103bb83ea387b
SSDEEP 49152:fr/6+LaYCFSyjhurNjfAAnwN18aPOsyNlvhpczD:zcYyStAPNWKOsyNlvhpczD
TLSH
T10016A442A9DF0DA2CFD6537661C752356338BE218A1D4B37B606E9BC79337C1AD1AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

KennySetup (1).exe

.exe 4.1MB

KennySetup (1).exe

IMPHASH c446e0b4a84aa15238b99b055553f51d
SHA256 3363d4035c065e306b41bed57e34ca04462c579e29704f1addc9789208cfda6a
MD5 e360d4ef47939b0996bd4aa6cb164084
SHA1 63f1df98c3444caacaa4ac9bba1e2c55623c5d60
SHA512 b0f836c8c02ab4b3892ad9109e71ab8073d26e2edb8395284a737207fb51badb7b5e5ba65377a5c1b3d1fdf2c8c736f6bf6d1e768a2d0142a16103bb83ea387b
SSDEEP 49152:fr/6+LaYCFSyjhurNjfAAnwN18aPOsyNlvhpczD:zcYyStAPNWKOsyNlvhpczD
TLSH
T10016A442A9DF0DA2CFD6537661C752356338BE218A1D4B37B606E9BC79337C1AD1AB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

c3:86:d1:87:46:37:14:70:f4:96:94:b8:81:4b:df:e6:25:50:a5:22:aa:cf:db:e0:94:cb:7c:e4:e8:03:87:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IP Smirnov Maksim Ilich,O=IP Smirnov Maksim Ilich,L=Nizhny Novgorod,ST=Nizhegorodskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c146d6178696d756d6d633640676d61696c2e636f6d

Chains

Oct 23, 2026

CN=IP Smirnov Maksim Ilich,O=IP Smirnov Maksim Ilich,L=Nizhny Novgorod,ST=Nizhegorodskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c146d6178696d756d6d633640676d61696c2e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Smirnov Maksim Ilich,O=IP Smirnov Maksim Ilich,L=Nizhny Novgorod,ST=Nizhegorodskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c146d6178696d756d6d633640676d61696c2e636f6d

Serial Number

4f:15:de:8f:cc:25:39:c1:b6:8a:fb:fd

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 18, 2026 - Sep 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

comctl32

InitCommonControlsEx

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileW CreateProcessW CreateSemaphoreA DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA GetCPInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFullPathNameW GetLastError GetLocalTime GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoW GetSystemDirectoryW GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesW SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lseeki64 _read _setjmp _setmode _strdup _vscprintf _vsnprintf _wcmdln _wcsicmp _wcsnicmp _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towupper towlower vfprintf wcscmp wcscoll wcsftime wcslen wcsxfrm

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

shell32

SHChangeNotify SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

user32

AdjustWindowRect CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnableWindow GetMessageW GetSystemMetrics GetWindowLongPtrW IsDialogMessageW KillTimer LoadCursorW LoadIconW PostMessageW PostQuitMessage RegisterClassExW SendMessageW SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TranslateMessage

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

283KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

1019B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KennySetup (1).exe

bcrypt

comctl32

kernel32

msvcrt

ole32

shell32

user32

winhttp

wintrust

generic