setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

setup.exe
Size

229KB
MD5

67674854044c6fd7028eb26721fb6d8c
SHA1

4fec22d2668ba9e4648a5b49a947fc0365b9651b
SHA256

1c46e32bd0fb664833d2082c19f9b869c89e66a5741241e621d506784df0f7a9
SHA512

c56b6e7e9c57d6e490527e587cac42eba570ad1f3f701c09ab19a9466b6ad02a71063f0de7ad93b5ab9870077e3afb05650497f1fd624b01ee5be3504fe069d4
SSDEEP

3072:RJzl8s7XHa/ytsum5M+bR+Th+7cOT6nCOZxCgdA5n661vhv361vhvgX70mf3Z:bJcyts56IcTEcOT6n/DA56q3qPmf3Z

Score

1^/10

Malware Config

Signatures

Files

setup.exe
.exe windows x64

937eaa3073048c77dfbd2b4f6af1d796

Code Sign

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-11-2011 22:39

Not After

01-02-2013 22:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:19:96:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2011 20:42

Not After

25-10-2012 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25-01-2006 23:22

Not After

25-01-2017 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:45

Not After

10-01-2013 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:20:28:f2:d3:86:46:21:1a:83:72:19:ee:46:f2:92:e9:4f:4e:df:4f:20:a1:33:61:36:73:2a:f8:86:96:9f
Signer

Actual PE Digest

95:20:28:f2:d3:86:46:21:1a:83:72:19:ee:46:f2:92:e9:4f:4e:df:4f:20:a1:33:61:36:73:2a:f8:86:96:9f

Digest Algorithm

sha256

PE Digest Matches

true

2c:48:05:c7:45:bc:a0:3e:6e:47:33:11:ae:a0:7e:f2:e4:25:80:97
Signer

Actual PE Digest

2c:48:05:c7:45:bc:a0:3e:6e:47:33:11:ae:a0:7e:f2:e4:25:80:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

ImpersonateSelf
RevertToSelf
AccessCheck
OpenThreadToken
AllocateAndInitializeSid
FreeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus

kernel32

FlushFileBuffers
CloseHandle
GetLocalTime
GetTempPathW
CreateFileW
LocalAlloc
LocalFree
HeapSetInformation
GetLongPathNameW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThread
GetLastError
CreateMutexW
LoadLibraryW
GetModuleHandleW
GetVersionExW
GetThreadLocale
GetConsoleWindow
GetConsoleProcessList
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetVersion
GetExitCodeProcess
WriteFile
FindClose
CreateProcessW
GetSystemWindowsDirectoryW
FindFirstFileW
Sleep
GetTickCount
FreeLibrary
GetStdHandle
GetNativeSystemInfo
FormatMessageW
GetModuleFileNameW
GetFileAttributesW
ReadFile
CreateNamedPipeW
lstrlenW
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
GetConsoleCP
SetFilePointer
GetStringTypeW
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapCreate
FlsAlloc
GetCurrentThreadId
FlsFree
GetFullPathNameW
GetPrivateProfileStringW
GetCommandLineW
SetLastError
WaitForSingleObject
FlsSetValue
FlsGetValue
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
SetUnhandledExceptionFilter
RtlPcToFileHeader
RaiseException
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
GetConsoleMode
SetConsoleMode
EncodePointer
DecodePointer
ReadConsoleInputA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

user32

LoadStringW
SendMessageW
CallWindowProcW
GetSystemMetrics
ShowWindow
PtInRect
MessageBoxW
SystemParametersInfoW
LoadImageW
LoadCursorW
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
RemovePropW
GetSysColor
ClientToScreen
SetCursor
GetWindowRect
GetPropW
SetPropW
InvalidateRect
ReleaseCapture
SetCapture
GetCapture
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxParamW
MoveWindow

gdi32

GetObjectW
SetTextColor
DeleteObject
CreateFontIndirectW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysStringLen
SysFreeString
VariantClear
GetErrorInfo
VariantChangeType
VariantInit
SysAllocString

sqmapi

SqmWaitForUploadComplete
SqmStartUpload

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

937eaa3073048c77dfbd2b4f6af1d796

Code Sign

61:1a:f5:ea:00:00:00:00:00:6aCertificate

Extended Key Usages

Key Usages

61:05:19:96:00:00:00:00:00:1bCertificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:05:49:55:00:00:00:00:00:0bCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

95:20:28:f2:d3:86:46:21:1a:83:72:19:ee:46:f2:92:e9:4f:4e:df:4f:20:a1:33:61:36:73:2a:f8:86:96:9fSigner

2c:48:05:c7:45:bc:a0:3e:6e:47:33:11:ae:a0:7e:f2:e4:25:80:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

version

user32

gdi32

shell32

ole32

oleaut32

sqmapi

Sections

.text Size: 174KB - Virtual size: 174KB

.data Size: 9KB - Virtual size: 21KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 2KB - Virtual size: 1KB

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

61:05:19:96:00:00:00:00:00:1b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

61:05:49:55:00:00:00:00:00:0b
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

95:20:28:f2:d3:86:46:21:1a:83:72:19:ee:46:f2:92:e9:4f:4e:df:4f:20:a1:33:61:36:73:2a:f8:86:96:9f
Signer

2c:48:05:c7:45:bc:a0:3e:6e:47:33:11:ae:a0:7e:f2:e4:25:80:97
Signer

.text
Size: 174KB - Virtual size: 174KB

.data
Size: 9KB - Virtual size: 21KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 2KB - Virtual size: 1KB