setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

23.9MB
MD5

cde3f3bde3a3a82bb4999ce1f4b81d14
SHA1

8a96967237355e82b6156631614ebe019a418262
SHA256

a274df4744566cb76ab42d668d163ef8c73efcd43ffac8545f1213cc951ec6ea
SHA512

bda5306ec47e9a43544ae9cc798c020850c3eacbf2678d5a8f59b7408a481290bf9bed751fff1e752eca4c71cd0072d6645a7996438d4adbc0ff2b6bb209e549
SSDEEP

393216:reo6wzR++OQ4MTGK6fFdk+Y9GLxIXOa3BLSdOGWQCqnwgGa7zDOt:xs+OQ47gkdIXOXdlCVfmO

Score

1^/10

Malware Config

Signatures

Files

setup.exe
.exe windows x86

91f4e0cc7a687a97a003ff6206e2edfb

Code Sign

22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30/04/2018, 00:00

Not After

29/04/2021, 23:59

Subject

CN=F.lux Software LLC,O=F.lux Software LLC,POSTALCODE=90049,STREET=929 S. Gretna Green Way,L=Los Angeles,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30/04/2018, 00:00

Not After

29/04/2021, 23:59

Subject

CN=F.lux Software LLC,O=F.lux Software LLC,POSTALCODE=90049,STREET=929 S. Gretna Green Way,L=Los Angeles,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:7f:11:a8:b3:a9:27:8b:bf:62:53:6b:5c:9e:c6:59:ac:2d:35:3f:9e:5a:97:8e:71:66:6c:92:16:6f:3d:d5
Signer

Actual PE Digest

bb:7f:11:a8:b3:a9:27:8b:bf:62:53:6b:5c:9e:c6:59:ac:2d:35:3f:9e:5a:97:8e:71:66:6c:92:16:6f:3d:d5

Digest Algorithm

sha256

PE Digest Matches

false

88:38:57:1d:3a:56:a2:67:ba:7b:ca:6e:9a:ea:2f:78:5f:8e:23:28
Signer

Actual PE Digest

88:38:57:1d:3a:56:a2:67:ba:7b:ca:6e:9a:ea:2f:78:5f:8e:23:28

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW

pdh

PdhCloseQuery

kernel32

LoadResource
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

iphlpapi

FreeMibTable

netapi32

NetUserEnum

secur32

DeleteSecurityContext

shell32

ShellExecuteExW

advapi32

AllocateAndInitializeSid

ole32

CoUninitialize

ws2_32

WSASocketW

ntdll

RtlNtStatusToDosError

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore

powrprof

CallNtPowerInformation

oleaut32

SysAllocString

psapi

GetPerformanceInfo

Sections

.text
Size: 842KB - Virtual size: 842KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 11.7MB - Virtual size: 11.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91f4e0cc7a687a97a003ff6206e2edfb

Code Sign

22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:faCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:faCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

bb:7f:11:a8:b3:a9:27:8b:bf:62:53:6b:5c:9e:c6:59:ac:2d:35:3f:9e:5a:97:8e:71:66:6c:92:16:6f:3d:d5Signer

88:38:57:1d:3a:56:a2:67:ba:7b:ca:6e:9a:ea:2f:78:5f:8e:23:28Signer

Headers

DLL Characteristics

File Characteristics

Imports

user32

pdh

kernel32

iphlpapi

netapi32

secur32

shell32

advapi32

ole32

ws2_32

ntdll

bcrypt

crypt32

powrprof

oleaut32

psapi

Sections

.text Size: 842KB - Virtual size: 842KB

.rdata Size: 378KB - Virtual size: 377KB

.data Size: 2KB - Virtual size: 5KB

.data0 Size: 11.7MB - Virtual size: 11.7MB

.data1 Size: 2KB - Virtual size: 1KB

.data2 Size: 10.9MB - Virtual size: 10.9MB

.reloc Size: 35KB - Virtual size: 34KB

.rsrc Size: 66KB - Virtual size: 65KB

22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

bb:7f:11:a8:b3:a9:27:8b:bf:62:53:6b:5c:9e:c6:59:ac:2d:35:3f:9e:5a:97:8e:71:66:6c:92:16:6f:3d:d5
Signer

88:38:57:1d:3a:56:a2:67:ba:7b:ca:6e:9a:ea:2f:78:5f:8e:23:28
Signer

.text
Size: 842KB - Virtual size: 842KB

.rdata
Size: 378KB - Virtual size: 377KB

.data
Size: 2KB - Virtual size: 5KB

.data0
Size: 11.7MB - Virtual size: 11.7MB

.data1
Size: 2KB - Virtual size: 1KB

.data2
Size: 10.9MB - Virtual size: 10.9MB

.reloc
Size: 35KB - Virtual size: 34KB

.rsrc
Size: 66KB - Virtual size: 65KB