Client_Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Client_Setup.exe
Size 1.6MB
Sample261107-v3sybaew2m
SHA256 dfc3afd6b468c9d65b480fd76e922e95da222bd45fb6259b99f1d52f752b9662
MD5 9a4e6a1c160832665709a86fd4a93fd3
SHA1 4ecfec25dde6104332c507832324c37cd0afedb0
SHA512 7ec2c4fead1768265a262d6270e5c3003fbd7377e39e59f768fc9b0420add2d1bde2ba891933364bed4efd797000c5ddab61f8093033282e16d45c32b73e8070
SSDEEP 24576:zP8qA/zN74BBH0nNdIbp6ltjAXck7yyuqouWfBFgGgUL+M:hAEH42ckg7fdhn
TLSH
T1B4758D4AB3A440FCE067C1B8CF1B9617E772B8091330AA9F57D14ED66F136619A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Client_Setup.exe

File Explorer

Client_Setup.exe

.exe 1.6MB

Client_Setup.exe

IMPHASH 74afdb9a08e1b24aa08fe0ad1cfb896e
SHA256 dfc3afd6b468c9d65b480fd76e922e95da222bd45fb6259b99f1d52f752b9662
MD5 9a4e6a1c160832665709a86fd4a93fd3
SHA1 4ecfec25dde6104332c507832324c37cd0afedb0
SHA512 7ec2c4fead1768265a262d6270e5c3003fbd7377e39e59f768fc9b0420add2d1bde2ba891933364bed4efd797000c5ddab61f8093033282e16d45c32b73e8070
SSDEEP 24576:zP8qA/zN74BBH0nNdIbp6ltjAXck7yyuqouWfBFgGgUL+M:hAEH42ckg7fdhn
TLSH
T1B4758D4AB3A440FCE067C1B8CF1B9617E772B8091330AA9F57D14ED66F136619A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1169488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider

wininet

HttpOpenRequestW InternetOpenW HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetReadFile InternetSetOptionW InternetConnectW

iphlpapi

GetAdaptersAddresses

dxgi

CreateDXGIFactory

ws2_32

WSAStartup inet_ntop

advapi32

GetUserNameW RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCloseKey RegEnumValueA

user32

EnumDisplayDevicesA GetDC GetSystemMetrics ReleaseDC

gdi32

DeleteDC GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap GetObjectA DeleteObject BitBlt

kernel32

LCMapStringW CompareStringW GetLocaleInfoW VirtualProtect IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation IsValidCodePage GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetACP GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle LoadLibraryExW HeapAlloc ReadFile GetVolumeInformationW GetCurrentProcess WriteFile GetModuleFileNameW GetEnvironmentVariableA CreateFileW GetCommandLineA GetLogicalDriveStringsW MultiByteToWideChar GetTickCount64 GetLastError GetDiskFreeSpaceExW GetCurrentThread SetDllDirectoryA LoadLibraryA CloseHandle GetSystemInfo GetThreadContext GetProcAddress LocalFree GetFileSize GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CheckRemoteDebuggerPresent AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RtlUnwind HeapCompact HeapDestroy UnlockFile LockFileEx GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 GetModuleHandleW CopyFile2 GetFileInformationByHandleEx GetLocaleInfoEx LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId InitializeSListHead UnhandledExceptionFilter RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW IsProcessorFeaturePresent ExitProcess TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Client_Setup.exe

bcrypt

wininet

iphlpapi

dxgi

ws2_32

advapi32

user32

gdi32

kernel32

generic