Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

562KB
MD5

459bd5b855d2acb61bfd3557e84ac9b8
SHA1

96564855491d653377862cb306aed94a09c74bef
SHA256

00685a4387ae8c6b51d29ca402fc04279ad7d346fd2a21e871b98cde791cdf9c
SHA512

59f620ba41286932203a102c692ef182912ce9f9abb62ad4d5805700e5e868017d3e4db3173c60dc275720643b5ffbe4927f0777937430495dd3128eb5f93892
SSDEEP

12288:Mjq7j9fgh5CHDMH8hNAzSEED77VRlrd78/:y2x0H8hNcg77Vvd78/

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows x64

3357cfbc2bfad3f1c74cea591fb3c573

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 13:00

Not After

27/01/2017, 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:2d:75:ec:58:cd
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

11/01/2011, 15:40

Not After

10/12/2013, 17:33

Subject

CN=Ploytec GmbH,O=Ploytec GmbH,L=Schopfheim,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c10696e666f40706c6f797465632e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 10:00

Not After

27/01/2017, 11:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:22:cf:4b:64:4c:a0:71:f1:26:35:8f:08:ae:90:8b:56:42:2a:a5
Signer

Actual PE Digest

72:22:cf:4b:64:4c:a0:71:f1:26:35:8f:08:ae:90:8b:56:42:2a:a5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ploytec GmbH,O=Ploytec GmbH,L=Schopfheim,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c10696e666f40706c6f797465632e636f6d

16/08/2011, 23:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetGetConnectedState
InternetOpenW
InternetOpenUrlW
InternetCloseHandle

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiRemoveDevice
SetupDiGetINFClassW
SetupGetStringFieldW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW
SetupFindFirstLineW
SetupOpenInfFileW
SetupDiDestroyDriverInfoList
SetupDiBuildDriverInfoList
CM_Locate_DevNodeW
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
CM_Get_Parent
CM_Get_DevNode_Status
SetupDiSetDeviceInstallParamsW
CM_Get_Device_IDW
CM_Reenumerate_DevNode
CM_Request_Device_EjectW
SetupDiGetDeviceInterfaceDetailW

kernel32

GetCurrentThread
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
lstrlenA
GlobalFlags
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
SetErrorMode
ConvertDefaultLocale
GetStartupInfoW
HeapFree
HeapAlloc
RtlLookupFunctionEntry
RtlUnwindEx
CreateDirectoryW
RemoveDirectoryA
RaiseException
RtlPcToFileHeader
HeapReAlloc
ExitThread
CreateThread
ExitProcess
HeapQueryInformation
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetProcessHeap
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
FreeLibrary
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FreeResource
WideCharToMultiByte
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
lstrlenW
MulDiv
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
MoveFileW
SetFileAttributesW
CreateProcessW
GetExitCodeProcess
GetCurrentProcess
GetTempFileNameW
GetFileAttributesW
GetTempPathW
CreateFileW
DeviceIoControl
LoadLibraryW
GetProcAddress
CopyFileW
RemoveDirectoryW
DeleteFileW
OutputDebugStringW
GetModuleFileNameW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcessId
GetWindowsDirectoryW
GetLocalTime
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
SuspendThread
ResumeThread
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemDirectoryW
WaitForSingleObject
SetEvent
CloseHandle
CreateEventW
Sleep
MoveFileExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetModuleHandleW
GetLastError

user32

SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageA
SendDlgItemMessageW
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassNameW
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
UpdateWindow
GetClassInfoW
GetSysColor
AdjustWindowRectEx
ScreenToClient
ValidateRect
CopyRect
PtInRect
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowLongW
SystemParametersInfoA
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
GetNextDlgTabItem
EndDialog
GetParent
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
ExitWindowsEx
wsprintfW
LoadImageW
EnumChildWindows
GetWindowLongW
GetClientRect
EnableMenuItem
DrawIcon
GetSystemMetrics
EnumThreadWindows
IsWindowVisible
IsWindowEnabled
IsIconic
ShowWindow
SetWindowPos
SetForegroundWindow
MessageBoxW
PostThreadMessageW
EnumWindows
FindWindowW
IsWindow
PostMessageW
GetFocus
GetWindowThreadProcessId
KillTimer
SetTimer
InvalidateRect
PeekMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
LoadIconW
EnableWindow
SendMessageW
DestroyWindow
RegisterClassW
UnregisterClassW
DestroyMenu
LoadCursorW
CreateWindowExW
SetWindowLongPtrW
GetSysColorBrush
SetCursor
PostQuitMessage
GetMessageW
GetCursorPos
GetWindowLongPtrW
DefWindowProcW
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
GetWindowPlacement
GetClassInfoExW

gdi32

SetMapMode
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetStockObject
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegOpenKeyExW
RegQueryValueW
RegEnumKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownW
RegCloseKey
RegCreateKeyExW
OpenSCManagerW
CloseServiceHandle
RegDeleteKeyW
RegCreateKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathFindExtensionW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VariantInit
VariantChangeType

newdev

UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3357cfbc2bfad3f1c74cea591fb3c573

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:1e:44:a5:e2:4eCertificate

Key Usages

01:00:00:00:00:01:2d:75:ec:58:cdCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:1e:44:a5:ec:beCertificate

Key Usages

72:22:cf:4b:64:4c:a0:71:f1:26:35:8f:08:ae:90:8b:56:42:2a:a5Signer

Signature Validations

Verification

16/08/2011, 23:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

wininet

version

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

newdev

Sections

.text Size: 370KB - Virtual size: 370KB

.rdata Size: 121KB - Virtual size: 121KB

.data Size: 12KB - Virtual size: 20.9MB

.pdata Size: 26KB - Virtual size: 26KB

.rsrc Size: 25KB - Virtual size: 24KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

01:00:00:00:00:01:2d:75:ec:58:cd
Certificate

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

72:22:cf:4b:64:4c:a0:71:f1:26:35:8f:08:ae:90:8b:56:42:2a:a5
Signer

16/08/2011, 23:14
Valid: false

.text
Size: 370KB - Virtual size: 370KB

.rdata
Size: 121KB - Virtual size: 121KB

.data
Size: 12KB - Virtual size: 20.9MB

.pdata
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 25KB - Virtual size: 24KB