Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

780.7MB
MD5

51ac47bd95a84ceb743b465715bcf7dd
SHA1

d6da78ee72619b0be862f77787d692de8f7268ab
SHA256

ce5cd38924f1058d7fac361be388430d5748622685830b6a5b1d537485d5cf77
SHA512

858a91ab27fe6a007d36f69810eedc9114c38b704f83da611da5b6b29e28981e0727051c2b9b59623769a355c7895961212db41b03ce238c5b687a67ccf50855
SSDEEP

98304:DaMrmlnScEwB5L5JeYPk3ZFIaYYgSQAOTgUz396e1ItWCE8GKYW:DaMSEMNSn2vEe1IEZHKF

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:5 windows x86 arch:x86

b05216869b9919006113c32bfd5041ff

Code Sign

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9
Certificate

Issuer

CN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m

Not Before

23/11/2023, 09:28

Not After

24/11/2033, 09:28

Subject

CN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:99:d0:cd:ca:a1:e0:e9:b3:8f:c0:10:15:c3:16:26:c5:e6:d6:8f:f0:de:68:9b:06:f9:38:97:d0:19:00:52
Signer

Actual PE Digest

8f:99:d0:cd:ca:a1:e0:e9:b3:8f:c0:10:15:c3:16:26:c5:e6:d6:8f:f0:de:68:9b:06:f9:38:97:d0:19:00:52

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc

kernel32

GetStringTypeW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharToOemA

advapi32

RegOpenKeyExA

ole32

CoInitializeEx

oleaut32

VariantClear

shlwapi

ord155

Sections

.text
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp…M
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp…4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp…L
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b05216869b9919006113c32bfd5041ff

Code Sign

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8f:99:d0:cd:ca:a1:e0:e9:b3:8f:c0:10:15:c3:16:26:c5:e6:d6:8f:f0:de:68:9b:06:f9:38:97:d0:19:00:52Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Sections

.text Size: - Virtual size: 116KB

.rdata Size: - Virtual size: 28KB

.data Size: - Virtual size: 2.1MB

.vmp…M Size: - Virtual size: 2.9MB

.vmp…4 Size: 1KB - Virtual size: 1KB

.vmp…L Size: 5.0MB - Virtual size: 5.0MB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 60KB - Virtual size: 60KB

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8f:99:d0:cd:ca:a1:e0:e9:b3:8f:c0:10:15:c3:16:26:c5:e6:d6:8f:f0:de:68:9b:06:f9:38:97:d0:19:00:52
Signer

.text
Size: - Virtual size: 116KB

.rdata
Size: - Virtual size: 28KB

.data
Size: - Virtual size: 2.1MB

.vmp…M
Size: - Virtual size: 2.9MB

.vmp…4
Size: 1KB - Virtual size: 1KB

.vmp…L
Size: 5.0MB - Virtual size: 5.0MB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 60KB - Virtual size: 60KB