setup-win32-bundle_V2[.]exe [.]zip

Sharing

Copy URL Twitter E-mail

General

Target
setup-win32-bundle_V2.exe .zip
Size 333KB
Sample261110-267dfacb96
SHA256 aae0c4ae6ef7983a1447e0a17c6998d6630bef0040db19d277b93e5362741faf
MD5 64827b7d81a5c4623d117521be7a4e8a
SHA1 51a67581962a8b2abce1dfddefb4c6d619e26e4f
SHA512 cd61bd80ce84cc75c01efa3a5231ce064c212770342e10ae733b937a418e5d3f28be4498d03cb97064b2bfbd754e8fae4038d519a2f5a261a178ea4deb118cc0
SSDEEP 6144:bpzUdsgsAW4PbhiOIce4DDTx3fgrd8wcgUbQCkFlglQiDs7V5iNQXHn9jWF4Y9:CfbhilIHTlqd8wEQfmfDSG4Hgh
TLSH
T13E74230D3CD6A75499E7AFC32EA05F207D9746A2D885C089D0CF37BCB85879C19B8395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/setup-win32-bundle_V2.exe.bin

File Explorer

setup-win32-bundle_V2.exe .zip

.zip 333KB
setup-win32-bundle_V2.exe.bin

.exe 578KB

setup-win32-bundle_V2.exe .zip

SHA256 aae0c4ae6ef7983a1447e0a17c6998d6630bef0040db19d277b93e5362741faf
MD5 64827b7d81a5c4623d117521be7a4e8a
SHA1 51a67581962a8b2abce1dfddefb4c6d619e26e4f
SHA512 cd61bd80ce84cc75c01efa3a5231ce064c212770342e10ae733b937a418e5d3f28be4498d03cb97064b2bfbd754e8fae4038d519a2f5a261a178ea4deb118cc0
SSDEEP 6144:bpzUdsgsAW4PbhiOIce4DDTx3fgrd8wcgUbQCkFlglQiDs7V5iNQXHn9jWF4Y9:CfbhilIHTlqd8wEQfmfDSG4Hgh
TLSH
T13E74230D3CD6A75499E7AFC32EA05F207D9746A2D885C089D0CF37BCB85879C19B8395
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

setup-win32-bundle_V2.exe.bin

IMPHASH 42d651751c1d75ed4fa8fe71751854ff
SHA256 3bc16539ab5493a0a5a2b82bb1ae04a0ef9ad55147dbf83c00725e642c8d9d7b
MD5 886372918b481608165ad50e1eda3756
SHA1 2d983d812685face8945a4ce8acde4bb64a3f3da
SHA512 fccd9ffc802bc1a120d892245e9ffdb204ec0cb34962057b4f0f66f250d83ace0704499319dc08dfa9be2917ce10bbbac1ce801bc6103926cba4e87998a66c6c
SSDEEP 12288:IzNB0JfiwSdYSui8zZH94I3H1v1Qj2gF5A+CDC6M:0NsfiTdYSuVzZH9tH1v1QRBL
TLSH
T1C7C45C33F559C032E6F10573B82897303D6CA3341F518BAAD6C4A9C97AA8C855FB7276
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188273

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent\_work\66\s\build\ship\x86\burn.pdb

advapi32

RegCloseKey RegOpenKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegQueryValueExW RegDeleteValueW CloseEventLog OpenEventLogW ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

PeekMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage GetMessageW TranslateMessage MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

gdi32

DeleteDC DeleteObject SelectObject StretchBlt GetObjectW CreateCompatibleDC

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CLSIDFromProgID CoInitializeSecurity

kernel32

GetCPInfo GetOEMCP IsValidCodePage CloseHandle CreateFileW GetProcAddress LocalFree HeapSetInformation GetLastError GetModuleHandleW FormatMessageW lstrlenA lstrlenW MultiByteToWideChar WideCharToMultiByte LCMapStringW Sleep GetLocalTime GetModuleFileNameW ExpandEnvironmentStringsW GetTempPathW GetTempFileNameW CreateDirectoryW GetFullPathNameW CompareStringW GetCurrentProcessId WriteFile SetFilePointer LoadLibraryW GetSystemDirectoryW CreateFileA HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindClose GetCommandLineA GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW MoveFileExW GetCurrentProcess GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection ReleaseMutex TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW GetVersionExW VerSetConditionMask FreeLibrary EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo GetModuleHandleExW GetWindowsDirectoryW GetSystemWow64DirectoryW GetCommandLineW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetUserDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ReadFile SetFilePointerEx DuplicateHandle InterlockedExchange InterlockedCompareExchange LoadLibraryExW CreateEventW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers DecodePointer WriteConsoleW GetModuleHandleA GlobalAlloc GlobalFree GetFileSizeEx CopyFileW VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime GetTimeZoneInformation SystemTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery GetComputerNameW SetCurrentDirectoryW GetFileType GetACP ExitProcess GetStdHandle InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException LoadLibraryExA

rpcrt4

UuidCreate