setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

143KB
MD5

aded848b0b7f513910299c81e7ae465d
SHA1

7f3b217a47642014127f081a01e0411d7b16d31c
SHA256

9dc8d9a8136b8e4d37d232ee57dbbbc6ca682aeff48939574c5e2ca88beb23b0
SHA512

ed788449eeb79e8ea4908c75b00f52a8e977448dadd86ca9f442337a20d5c41c141b19970b5142ceda08153070374ce45467776d38c2f52f69d60f8d348aabbc
SSDEEP

3072:B1jxgpxJY8ekX5sfiMnNOJiFmsbICQ4WBT5i/x:Ljxg7JYo2i2NaSFcOx

Score

1^/10

Malware Config

Signatures

Files

setup.exe
.exe windows:5 windows x86 arch:x86

f431b12a7cff294742bbc9961d2fcd3b

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

63:7d:b8:99:ad:9a:02:30:c4:3b:95:33:2c:fd:17:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/08/2011, 00:00

Not After

22/08/2014, 23:59

Subject

CN=IVT CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=IVT CORPORATION,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:40:15:0a:27:5b:e2:b3:75:92:26:79:69:af:6d:62:77:af:4e:1d
Signer

Actual PE Digest

46:40:15:0a:27:5b:e2:b3:75:92:26:79:69:af:6d:62:77:af:4e:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIW
StrStrW

kernel32

GetProcAddress
GetModuleHandleW
WideCharToMultiByte
SetEnvironmentVariableW
GetModuleFileNameW
GetPrivateProfileIntW
lstrcatW
lstrlenW
GetCurrentProcess
CreateProcessW
lstrcpyW
GetLastError
GetVersionExW
GetPrivateProfileStringW
ExpandEnvironmentStringsW
MultiByteToWideChar
GetWindowsDirectoryW
GetLocalTime
CompareStringA
CompareStringW
WaitForSingleObject
GetEnvironmentStringsW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
Sleep
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
SetEnvironmentVariableA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InitializeCriticalSectionAndSpinCount
CreateFileW
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
HeapSize
GetLocaleInfoW
GetTimeZoneInformation

advapi32

RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f431b12a7cff294742bbc9961d2fcd3b

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

63:7d:b8:99:ad:9a:02:30:c4:3b:95:33:2c:fd:17:92Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

46:40:15:0a:27:5b:e2:b3:75:92:26:79:69:af:6d:62:77:af:4e:1dSigner

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

advapi32

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 5KB - Virtual size: 5KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

63:7d:b8:99:ad:9a:02:30:c4:3b:95:33:2c:fd:17:92
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

46:40:15:0a:27:5b:e2:b3:75:92:26:79:69:af:6d:62:77:af:4e:1d
Signer

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 5KB - Virtual size: 5KB