Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

721KB
MD5

a03884698f1f6b59f85e222223c768f8
SHA1

49c62d6797e50545e319250a2ef466778b6dd5dc
SHA256

6e8a42df0a127782971fa5a35a2c60ac8fda69befb5ff0363f27d0da4a6ed0c5
SHA512

f26d15ec424507c7a6ab3fe21e1350cc9e40e333c569223de24357ebd412778a2632a134956ed7b4c182fc966bab57f8e5e615df8119d7db14f0bec69a137625
SSDEEP

12288:pvxt7hsmc7NMGetu8SO1qAzetXpKffpt2:8mc5MBsO1zaXpKp0

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:4 windows x86

704f5e1b317542d9ac48a45347427922

Code Sign

0a
Certificate

Issuer

CN=AN Certification Authority,O=AN,C=CZ

Not Before

25/03/2022, 21:04

Not After

24/03/2024, 21:04

Subject

CN=Ai4rei/AN,O=AN,C=CZ

bd:f8:8d:e9:84:ac:a8:60
Certificate

Issuer

CN=AN Certification Authority,O=AN,C=CZ

Not Before

08/02/2021, 16:23

Not After

09/02/2121, 16:23

Subject

CN=AN Certification Authority,O=AN,C=CZ

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b3:52:35:41:db:51:39:e9:84:3e:86:34:83:ce:27:c0:b1:d6:96:19
Signer

Actual PE Digest

b3:52:35:41:db:51:39:e9:84:3e:86:34:83:ce:27:c0:b1:d6:96:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetClassInfoExA
GetAsyncKeyState
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
GetMessageA
ShowWindow
PostMessageA
GetDlgItem
CreateDialogIndirectParamA
MessageBoxA
LoadAcceleratorsA
FindWindowA
GetWindowLongA
SetWindowTextA
SendMessageA
PostQuitMessage
DestroyWindow
SetTimer
GetParent
IsDlgButtonChecked
SetWindowLongA
GetSysColorBrush
GetSysColor
DefWindowProcA
CallWindowProcA
DestroyIcon
LoadImageA
PeekMessageA
MsgWaitForMultipleObjects
EnableWindow
KillTimer
EnumDisplaySettingsA
CreateWindowExA
GetWindowTextA
EnumChildWindows
MessageBoxIndirectA
GetWindowRect
GetNextDlgTabItem
GetSystemMetrics
IsWindowEnabled
GetDlgCtrlID
DialogBoxParamA
DefDlgProcA
SetWindowPos
EndDialog
GetWindow
IsChild
SetFocus
GetFocus
LoadCursorA
LoadIconA
SystemParametersInfoA
RegisterClassExA
WaitMessage
CallMsgFilterA
MapWindowPoints
SetRect
AdjustWindowRectEx
GetMenu
SetForegroundWindow
LoadStringA
IsWindowVisible
OffsetRect
FindWindowExA
GetWindowThreadProcessId
CheckDlgButton
CreateDialogParamA
GetDC
ReleaseDC
SystemParametersInfoW

gdi32

CreateFontA
GetDeviceCaps
GetObjectA
CreateCompatibleDC
SaveDC
SelectObject
BitBlt
RestoreDC
DeleteDC
SetTextColor
SetBkColor
DeleteObject

comctl32

ImageList_Destroy
ImageList_Create
ImageList_Add
InitCommonControlsEx

advapi32

RegOpenKeyExA
OpenProcessToken
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegFlushKey
RegQueryValueExA
RegDeleteValueA
RegCloseKey

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

HttpQueryInfoA
InternetCloseHandle
InternetSetOptionA
InternetOpenUrlA
InternetReadFile
InternetQueryDataAvailable
InternetQueryOptionA
InternetOpenA

shell32

SHFileOperationA
ShellExecuteExA

kernel32

GetACP
ReadFile
LeaveCriticalSection
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
FlushFileBuffers
TlsGetValue
TlsAlloc
TlsSetValue
HeapSize
GetVersion
GetSystemTime
GetSystemTimeAsFileTime
MoveFileA
ExitProcess
DuplicateHandle
RtlUnwind
InterlockedExchange
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
OutputDebugStringA
GetCurrentThreadId
Sleep
GetTimeZoneInformation
SetEnvironmentVariableA
SetEndOfFile
GetStartupInfoA
GetStdHandle
CreateProcessA
GetSystemDirectoryA
GetTempPathA
VirtualAlloc
DeleteFileA
GlobalAlloc
GlobalFree
FindResourceA
SizeofResource
EnterCriticalSection
EnumSystemCodePagesA
FindFirstFileA
DeleteCriticalSection
InitializeCriticalSection
GetCPInfo
MultiByteToWideChar
MulDiv
FindResourceExA
LoadResource
LockResource
WideCharToMultiByte
FreeResource
SetErrorMode
LoadLibraryA
FreeLibrary
CreateFileA
CreateDirectoryA
SetLastError
GetTickCount
lstrcpynA
GetLocaleInfoW
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
CompareStringW
CompareStringA
GetUserDefaultLCID
EnumSystemLocalesA
IsBadCodePtr
GetOEMCP
GetLocaleInfoA
lstrlenA
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
CreatePipe
GetFileSize
SetFilePointer
FindNextFileA
FindClose
TerminateProcess
GetCurrentProcessId
OpenProcess
RaiseException
CreateMutexA
WaitForSingleObject
ReleaseMutex
InterlockedDecrement
SetStdHandle
InterlockedIncrement
GetProcAddress
GetModuleHandleA
GetLastError
GetModuleFileNameA
CloseHandle
ResumeThread
CreateThread
WritePrivateProfileStringA
GetVersionExA
GetPrivateProfileIntA
WriteFile
GetExitCodeProcess
GetFileAttributesA
GetPrivateProfileStringA
FormatMessageA
GetLocalTime
GetCommandLineA
GlobalMemoryStatus
GetCurrentProcess

Sections

.text
Size: 240KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

704f5e1b317542d9ac48a45347427922

Code Sign

0aCertificate

bd:f8:8d:e9:84:ac:a8:60Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

b3:52:35:41:db:51:39:e9:84:3e:86:34:83:ce:27:c0:b1:d6:96:19Signer

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

comctl32

advapi32

version

wininet

shell32

kernel32

Sections

.text Size: 240KB - Virtual size: 237KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 16KB - Virtual size: 130KB

.shared Size: 4KB - Virtual size: 1KB

.rsrc Size: 392KB - Virtual size: 391KB

.reloc Size: 20KB - Virtual size: 17KB

0a
Certificate

bd:f8:8d:e9:84:ac:a8:60
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

b3:52:35:41:db:51:39:e9:84:3e:86:34:83:ce:27:c0:b1:d6:96:19
Signer

.text
Size: 240KB - Virtual size: 237KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 16KB - Virtual size: 130KB

.shared
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 392KB - Virtual size: 391KB

.reloc
Size: 20KB - Virtual size: 17KB