Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

452.8MB
MD5

8038353251c3354dfb9449c95dacd6fa
SHA1

912625aa341a407a40f92f8cd187d4123f7c0988
SHA256

f8433d6f19db029e973b40f72ccc3f24d5b22a04b82d83c612db8976ab405d1c
SHA512

eab8f82ae234896c59b5b33d979632ef25fed8e41dbef337b8261840a910019ea1612984b697fba7787939e6fee677486eb6e1223f52b986effd41bad2c4f32a
SSDEEP

24576:RsSmmZsh68p+rXSdf5VsLddr9NV9zbdlKrfnIG2QOAWIcRKXhuDoFhBlQT:WHpASdxyLdH39PdgsGLcjoFhBlc

Score

N/A

Malware Config

Signatures

Files

Setup.exe
.exe windows x86

2027605e9a316732179727fdd9633e1f

Code Sign

79:8d:97:82:db:6a:71:a7:4f:af:40:6e:ae:70:e1:98
Certificate

Issuer

CN=www.piglet.com

Not Before

03-01-2023 13:09

Not After

03-01-2024 13:29

Subject

CN=www.piglet.com

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

79:8d:97:82:db:6a:71:a7:4f:af:40:6e:ae:70:e1:98
Certificate

Issuer

CN=www.piglet.com

Not Before

03-01-2023 13:09

Not After

03-01-2024 13:29

Subject

CN=www.piglet.com

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:c8:78:f9:6c:1e:8f:79:47:d8:ca:65:52:c2:30:87:77:d2:fa:0e:19:ef:98:ae:99:18:54:cc:da:45:41:bf
Signer

Actual PE Digest

21:c8:78:f9:6c:1e:8f:79:47:d8:ca:65:52:c2:30:87:77:d2:fa:0e:19:ef:98:ae:99:18:54:cc:da:45:41:bf

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=www.piglet.com

15-12-2022 13:57
Valid: false

8d:69:76:62:d4:84:32:61:c9:b3:ac:4e:2c:ff:44:6a:1c:7f:08:d7
Signer

Actual PE Digest

8d:69:76:62:d4:84:32:61:c9:b3:ac:4e:2c:ff:44:6a:1c:7f:08:d7

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=www.piglet.com

15-12-2022 13:57
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualProtect
GetVersionExA
GetModuleHandleA
GetCommandLineA
GetStartupInfoA

user32

ReleaseDC

gdi32

CreateDCA

ole32

CoCreateInstance

oleaut32

VariantInit

Sections

.text
Size: 1024B - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2027605e9a316732179727fdd9633e1f

Code Sign

79:8d:97:82:db:6a:71:a7:4f:af:40:6e:ae:70:e1:98Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

79:8d:97:82:db:6a:71:a7:4f:af:40:6e:ae:70:e1:98Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

21:c8:78:f9:6c:1e:8f:79:47:d8:ca:65:52:c2:30:87:77:d2:fa:0e:19:ef:98:ae:99:18:54:cc:da:45:41:bfSigner

Signature Validations

Verification

15-12-2022 13:57 Valid: false

8d:69:76:62:d4:84:32:61:c9:b3:ac:4e:2c:ff:44:6a:1c:7f:08:d7Signer

Signature Validations

Verification

15-12-2022 13:57 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

oleaut32

Sections

.text Size: 1024B - Virtual size: 212KB

.bss Size: - Virtual size: 168KB

.rsrc Size: 35KB - Virtual size: 36KB

.rdata Size: 2.3MB - Virtual size: 2.3MB

79:8d:97:82:db:6a:71:a7:4f:af:40:6e:ae:70:e1:98
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

79:8d:97:82:db:6a:71:a7:4f:af:40:6e:ae:70:e1:98
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

21:c8:78:f9:6c:1e:8f:79:47:d8:ca:65:52:c2:30:87:77:d2:fa:0e:19:ef:98:ae:99:18:54:cc:da:45:41:bf
Signer

15-12-2022 13:57
Valid: false

8d:69:76:62:d4:84:32:61:c9:b3:ac:4e:2c:ff:44:6a:1c:7f:08:d7
Signer

15-12-2022 13:57
Valid: false

.text
Size: 1024B - Virtual size: 212KB

.bss
Size: - Virtual size: 168KB

.rsrc
Size: 35KB - Virtual size: 36KB

.rdata
Size: 2.3MB - Virtual size: 2.3MB