SUSPICIOUS — setup.exe
SUSPICIOUS — setup.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100). 1 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
149c054b6c38a38321583bf4f8c263b4bdf633f7ef9450e44d8b2e73a31b1704 - SHA-1:
35cf44e9bd37ef5187d5690447fc30f3c1076311 - MD5:
b7b7916c2bdc7662c88774a025adcd06 - imphash:
483f0c4259a9148c34961abbda6146c1 - ssdeep:
196608:FQZ+nJvozUqTQY6NElQsd5QPHljZYPxFRJ/XmeiadD:FQwnaIC6ypOPh05dD - TLSH:
T13D6A3331233339A1F85EC805FA46AAAE5D379AF5E074EF4610D5785E33E28B7A51010E - Submitted as: setup.exe
- File type: pe · Size: 9161770 bytes
- Verdict: suspicious (49/100)
Detections (1 of 56 engines)
- capa (capabilities): capability:execution/powershell
MITRE ATT&CK
Why this verdict
The suspicious score of 49/100 is the fusion of 2 weighted signals:
- execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
Embedded domains
- schemas.microsoft.com
- 69.ly
- d.fi
- d6.io
- 5.su
File paths
- u:\x
- m:\X
- K:\;;
- l:\ee
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report