SETUP[.]EXE | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SETUP.EXE
Size

81KB
MD5

b1a3b36f23c209dd6467b91dfdadd8eb
SHA1

bd0be46df967a8593cd0a2b8b759d0aa2ca9a9e7
SHA256

64c4e60a7b5c3799fba275082a05b68dd5b6ab03d63af0cdb31c59bca57297b5
SHA512

bb7f0e5c223a80532cc53a25725f9cf075b30b95a64e337283bfe92bcb2bc0b0ba8b2835c94d2d9497c17e6ce7237a30d4eb1ee008ed8cb041083ebdb60ab210
SSDEEP

1536:VlqL7H/0Bn4nbTfd+mtM96Md4DnaI0oN98Tq:6HOn4SuDaToN98u

Score

1^/10

Malware Config

Signatures

Files

SETUP.EXE
.exe windows x86

be9bb5be96279547b706123ff53a230e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:0e:72:90:dd:bb:fa:3c:3d:ce:c1:57:25:73:2f:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/08/2011, 00:00

Not After

25/08/2012, 23:59

Subject

CN=Jiangsu Qinheng Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Jiangsu Qinheng Co.\, Ltd.,L=Nanjing,ST=Jiangsu,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:c0:30:ba:8e:cd:57:25:88:90:2c:75:90:ed:d9:a0:bd:a3:95:9b
Signer

Actual PE Digest

7e:c0:30:ba:8e:cd:57:25:88:90:2c:75:90:ed:d9:a0:bd:a3:95:9b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Jiangsu Qinheng Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Jiangsu Qinheng Co.\, Ltd.,L=Nanjing,ST=Jiangsu,C=CN

17/02/2012, 03:27
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetWindowsDirectoryA
WinExec
lstrlenA
GetCurrentDirectoryA
GetCurrentProcess
GetProcAddress
GetModuleHandleA
CreateThread
Sleep
GetLastError
LoadLibraryA
GetPrivateProfileSectionA
GetPrivateProfileStringA
DeleteFileA
CopyFileA
SetLastError
LocalAlloc
LocalFree
GetVersion
GetUserDefaultLangID
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetTimeZoneInformation
SetFilePointer
WriteFile
GetSystemDirectoryA
CloseHandle
HeapAlloc
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
SetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FindFirstFileA
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA

user32

UpdateWindow
CharUpperA
IsDlgButtonChecked
EnableWindow
FindWindowExA
EnumChildWindows
GetWindowTextA
SendDlgItemMessageA
SetDlgItemTextA
DefWindowProcA
GetDlgItem
ShowWindow
LoadIconA
SetWindowTextA
SendMessageA
EndDialog
MessageBoxA
DialogBoxParamA

comctl32

ord17

cfgmgr32

CM_Reenumerate_DevNode
CM_Locate_DevNodeA

setupapi

SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoA
SetupDiGetDriverInfoDetailA
SetupDiSetDeviceRegistryPropertyA
SetupDefaultQueueCallbackA
SetupOpenInfFileA
SetupDiGetActualSectionToInstallA
SetupOpenFileQueue
SetupInitDefaultQueueCallbackEx
SetupInstallFilesFromInfSectionA
SetupCommitFileQueueA
SetupCloseFileQueue
SetupCloseInfFile
SetupTermDefaultQueueCallback
SetupCopyOEMInfA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList
SetupDiDestroyDriverInfoList

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be9bb5be96279547b706123ff53a230e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

23:0e:72:90:dd:bb:fa:3c:3d:ce:c1:57:25:73:2f:4aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

7e:c0:30:ba:8e:cd:57:25:88:90:2c:75:90:ed:d9:a0:bd:a3:95:9bSigner

Signature Validations

Verification

17/02/2012, 03:27 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

comctl32

cfgmgr32

setupapi

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 39KB

.rsrc Size: 8KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

23:0e:72:90:dd:bb:fa:3c:3d:ce:c1:57:25:73:2f:4a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

7e:c0:30:ba:8e:cd:57:25:88:90:2c:75:90:ed:d9:a0:bd:a3:95:9b
Signer

17/02/2012, 03:27
Valid: false

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 39KB

.rsrc
Size: 8KB - Virtual size: 4KB