Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

561KB
MD5

2f1b91d1936e7be04bcd4ec22a18ca2b
SHA1

3e3db4405f8bfdec28ab8c9bd3e2ecc88c10347c
SHA256

b3b1dfb7f489d461ed24b5354443c08e36bae741818c011855710ac98ad87676
SHA512

b296fd1123419338c98152c4fa3c812dee2fe57952dfe6285708ae54ff5c4f554017580cb28252e499f6417729070d455524d3f043af80c8eb6d6ffb1ddfe6e8
SSDEEP

6144:FhxvpQieB6TiLeE+8nOlAO65ttDvyr5tzQoRsB4KS2Oau4i9VpFEWInwH36s/iQN:VyiLnAt5tRvitqIjau4i9VXIwH9iQqc

Score

N/A

Malware Config

Signatures

Files

Setup.exe
.exe windows x64

20670cbe37a0fe7f08efb9b431a7f64c

Code Sign

01:00:00:00:00:01:17:1b:6b:0d:d6
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

27-12-2007 11:44

Not After

27-12-2010 11:44

Subject

CN=Ploytec GmbH,O=Ploytec GmbH,C=DE,1.2.840.113549.1.9.1=#0c10696e666f40706c6f797465632e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28-01-1999 12:00

Not After

27-01-2014 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22-01-2004 09:00

Not After

27-01-2014 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:33:4b:90:63:1b:cc:ae:c0:dc:c7:03:4c:21:0a:b6:1f:47:bc:ca
Signer

Actual PE Digest

4f:33:4b:90:63:1b:cc:ae:c0:dc:c7:03:4c:21:0a:b6:1f:47:bc:ca

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ploytec GmbH,O=Ploytec GmbH,C=DE,1.2.840.113549.1.9.1=#0c10696e666f40706c6f797465632e636f6d

30-10-2009 12:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetGetConnectedState
InternetOpenW
InternetOpenUrlW
InternetCloseHandle

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiRemoveDevice
SetupDiGetINFClassW
SetupGetStringFieldW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW
SetupFindFirstLineW
SetupOpenInfFileW
SetupDiDestroyDriverInfoList
SetupDiBuildDriverInfoList
CM_Locate_DevNodeW
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
CM_Get_Parent
CM_Get_DevNode_Status
SetupDiSetDeviceInstallParamsW
CM_Get_Device_IDW
CM_Reenumerate_DevNode
CM_Request_Device_EjectW
SetupDiGetDeviceInterfaceDetailW

kernel32

LeaveCriticalSection
TlsGetValue
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
lstrlenA
GlobalFlags
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
SetErrorMode
LocalAlloc
GetStartupInfoW
HeapFree
HeapAlloc
RtlLookupFunctionEntry
RtlUnwindEx
CreateDirectoryW
RemoveDirectoryA
RaiseException
RtlPcToFileHeader
HeapReAlloc
ExitThread
CreateThread
ExitProcess
HeapQueryInformation
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetProcessHeap
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
FreeLibrary
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FreeResource
WideCharToMultiByte
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
lstrlenW
MulDiv
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
MoveFileW
SetFileAttributesW
CreateProcessW
GetExitCodeProcess
GetCurrentProcess
GetTempFileNameW
GetFileAttributesW
GetTempPathW
CreateFileW
DeviceIoControl
LoadLibraryW
GetProcAddress
CopyFileW
RemoveDirectoryW
DeleteFileW
OutputDebugStringW
GetModuleFileNameW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcessId
GetWindowsDirectoryW
GetLocalTime
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemDirectoryW
WaitForSingleObject
SetEvent
CloseHandle
CreateEventW
Sleep
MoveFileExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetModuleHandleW
GetLastError

user32

SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageA
SendDlgItemMessageW
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassNameW
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
GetClassInfoExW
GetClassInfoW
GetSysColor
AdjustWindowRectEx
ValidateRect
CopyRect
PtInRect
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowLongW
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
GetNextDlgTabItem
EndDialog
GetParent
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
ExitWindowsEx
wsprintfW
LoadImageW
EnumChildWindows
GetWindowLongW
GetClientRect
EnableMenuItem
DrawIcon
GetSystemMetrics
EnumThreadWindows
IsWindowVisible
IsWindowEnabled
IsIconic
ShowWindow
SetWindowPos
SetForegroundWindow
MessageBoxW
PostThreadMessageW
EnumWindows
FindWindowW
IsWindow
PostMessageW
GetWindowThreadProcessId
KillTimer
SetTimer
InvalidateRect
PeekMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
LoadIconW
EnableWindow
SendMessageW
DestroyWindow
RegisterClassW
UnregisterClassW
DestroyMenu
LoadCursorW
CreateWindowExW
SetWindowLongPtrW
GetSysColorBrush
SetCursor
PostQuitMessage
GetMessageW
ScreenToClient
GetCursorPos
GetWindowLongPtrW
DefWindowProcW
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
UpdateWindow

gdi32

SetMapMode
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetStockObject
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegOpenKeyExW
RegQueryValueW
RegEnumKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownW
RegCloseKey
RegCreateKeyExW
OpenSCManagerW
CloseServiceHandle
RegDeleteKeyW
RegCreateKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathFindExtensionW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VariantInit
VariantChangeType

newdev

UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20670cbe37a0fe7f08efb9b431a7f64c

Code Sign

01:00:00:00:00:01:17:1b:6b:0d:d6Certificate

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:08:d9:61:1c:d6Certificate

Key Usages

04:00:00:00:00:01:08:d9:61:24:48Certificate

Key Usages

4f:33:4b:90:63:1b:cc:ae:c0:dc:c7:03:4c:21:0a:b6:1f:47:bc:caSigner

Signature Validations

Verification

30-10-2009 12:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

wininet

version

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

newdev

Sections

.text Size: 369KB - Virtual size: 369KB

.rdata Size: 121KB - Virtual size: 121KB

.data Size: 12KB - Virtual size: 20.9MB

.pdata Size: 26KB - Virtual size: 26KB

.rsrc Size: 25KB - Virtual size: 24KB

01:00:00:00:00:01:17:1b:6b:0d:d6
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

4f:33:4b:90:63:1b:cc:ae:c0:dc:c7:03:4c:21:0a:b6:1f:47:bc:ca
Signer

30-10-2009 12:39
Valid: false

.text
Size: 369KB - Virtual size: 369KB

.rdata
Size: 121KB - Virtual size: 121KB

.data
Size: 12KB - Virtual size: 20.9MB

.pdata
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 25KB - Virtual size: 24KB