Setup_685192[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Setup_685192.exe
Size

1.6MB
MD5

a0d7f3955f44196e1e4e2276697e4deb
SHA1

e239bb437434bb13150df5373c69a479f44f67b3
SHA256

b5512055360c91ea626602b49fade59f6de6dab4c5d91a1d6d3d18c1861c13c2
SHA512

6d58ed6502406ea090b66c879c8bda9e0b7e1ba7e5cf36e8b3330486fa40c986607a2aec0b673a9400bcc583bc33be89b76ca52639bf5962e4f44cfc52fbe52c
SSDEEP

24576:1uZnNwUdiu0vQh9Ia2SQwR8+sXSfmTobX8MPqC0S5GMyUUt3lBZQn652PZNwFM1g:e62ouvOsbTqC8lBk7sM1D9QXz

Score

1^/10

Malware Config

Signatures

Files

Setup_685192.exe
.exe windows:6 windows x86 arch:x86

9261e0a0eeb8b0b590d71e10d28c7a55

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:0f:8d:70:28:fa:3c:5d:7b:eb:8a:5a:07:b9:f8:b6
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

12/04/2023, 21:35

Not After

12/04/2024, 21:35

Subject

SERIALNUMBER=91310113MA1GKE078N,CN=Free Time Software Technology Co.\,Ltd,O=Free Time Software Technology Co.\,Ltd,L=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:33:c6:55:10:37:ac:d2:25:5d:00:6c:5b:19:ea:7b:19:a6:01:07:a8:8e:e3:62:69:ad:59:df:3d:bd:36:c2
Signer

Actual PE Digest

25:33:c6:55:10:37:ac:d2:25:5d:00:6c:5b:19:ea:7b:19:a6:01:07:a8:8e:e3:62:69:ad:59:df:3d:bd:36:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtQuerySystemInformation
RtlNtStatusToDosError
NtReadFile
NtWriteFile
NtDeviceIoControlFile
NtCancelIoFileEx
NtCreateFile
RtlCaptureContext
RtlUnwind

kernel32

HeapAlloc
CloseHandle
WakeAllConditionVariable
GetStartupInfoW
TlsGetValue
TerminateProcess
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
GetFullPathNameW
GetDiskFreeSpaceExW
GetFileType
SetLastError
CreateIoCompletionPort
GetConsoleMode
GetProcessHeap
GetCurrentProcessId
CreateFileW
GetStdHandle
SetHandleInformation
GetACP
GetCommandLineA
GetLogicalDrives
IsProcessorFeaturePresent
WakeConditionVariable
GetFinalPathNameByHandleW
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetCPInfo
lstrlenW
ReleaseMutex
EncodePointer
FindFirstFileW
K32GetModuleBaseNameA
GetFileInformationByHandleEx
Sleep
FindFirstFileExW
ReleaseSRWLockShared
TlsAlloc
MoveFileExW
PostQueuedCompletionStatus
LeaveCriticalSection
SleepConditionVariableSRW
GetModuleFileNameW
GetFileInformationByHandle
GetStringTypeW
WriteConsoleW
LCMapStringW
GetCurrentThreadId
GetProcAddress
CreateFileA
GetModuleHandleExW
FlushFileBuffers
GetCurrentThread
GetSystemInfo
SetThreadStackGuarantee
GetTickCount
HeapSize
CreateMutexA
GetProcessTimes
HeapFree
K32EnumProcessModules
SetFilePointerEx
GlobalMemoryStatusEx
CompareStringW
LoadLibraryA
GetQueuedCompletionStatusEx
GetDriveTypeW
WaitForSingleObject
IsValidCodePage
DecodePointer
ExitProcess
UnhandledExceptionFilter
EnterCriticalSection
SetFileCompletionNotificationModes
InitOnceComplete
DeviceIoControl
FreeEnvironmentStringsW
SetStdHandle
GetCommandLineW
QueryPerformanceFrequency
RaiseException
LoadLibraryExW
GetModuleHandleW
DeleteCriticalSection
GetTickCount64
GetOEMCP
WriteFile
AcquireSRWLockShared
AddVectoredExceptionHandler
CreateProcessW
SetEnvironmentVariableW
WaitForSingleObjectEx
MultiByteToWideChar
WideCharToMultiByte
FindClose
GetVolumeInformationW
GetEnvironmentStringsW
TlsSetValue
CreateDirectoryW
GetModuleHandleA
FormatMessageW
OpenProcess
GetProcessIoCounters
CreateThread
QueryPerformanceCounter
TryAcquireSRWLockExclusive
TlsFree
FreeLibrary
FindNextFileW
GetDriveTypeA
GetCurrentDirectoryW
GetEnvironmentVariableW
InitOnceBeginInitialize
GetLastError
InitializeSListHead
GetSystemFirmwareTable
AcquireSRWLockExclusive
SwitchToThread
IsDebuggerPresent
GetConsoleOutputCP
GetCurrentProcess
GetSystemTimes

user32

RedrawWindow
SetTimer
EndPaint
PostQuitMessage
SwitchToThisWindow
GetMessageW
CreateWindowExW
LoadIconW
SetWindowPos
DefWindowProcW
FindWindowA
TranslateMessage
SendMessageA
GetClientRect
RegisterClassExW
GetWindowRect
DispatchMessageW
ShowWindow
FillRect
LoadCursorW
BeginPaint
MessageBoxA
GetSystemMetrics

pdh

PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCloseQuery
PdhOpenQueryA
PdhCollectQueryData
PdhRemoveCounter

shell32

SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteW

shlwapi

PathFileExistsW

advapi32

RegEnumKeyExW
GetTokenInformation
OpenSCManagerA
RegOpenKeyExW
SystemFunction036
LookupAccountSidW
RegCloseKey
QueryServiceStatus
RegEnumValueW
GetUserNameW
RegQueryValueExW
OpenProcessToken
OpenServiceA

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoInitialize
CoInitializeEx
CoInitializeSecurity

gdi32

CreateSolidBrush
GetStockObject

bcrypt

BCryptGenRandom

ws2_32

send
closesocket
bind
getsockname
freeaddrinfo
WSASocketW
getaddrinfo
WSAStartup
WSASend
WSAIoctl
shutdown
connect
getpeername
ioctlsocket
setsockopt
WSACleanup
recv
getsockopt
WSAGetLastError

secur32

LsaGetLogonSessionData
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext
ApplyControlToken
QueryContextAttributesW
DeleteSecurityContext
LsaEnumerateLogonSessions
FreeCredentialsHandle
FreeContextBuffer
AcquireCredentialsHandleA
LsaFreeReturnBuffer
EncryptMessage

crypt32

CertFreeCertificateChain
CertDuplicateCertificateContext
CertGetCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertOpenStore
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateContext
CertDuplicateStore
CertCloseStore

psapi

GetModuleFileNameExW
GetPerformanceInfo

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups

powrprof

CallNtPowerInformation

oleaut32

SysStringLen
SysFreeString
SysAllocString
VariantClear
GetErrorInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 438KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9261e0a0eeb8b0b590d71e10d28c7a55

Code Sign

4a:53:8c:28Certificate

Key Usages

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2bCertificate

Extended Key Usages

Key Usages

0a:0f:8d:70:28:fa:3c:5d:7b:eb:8a:5a:07:b9:f8:b6Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

25:33:c6:55:10:37:ac:d2:25:5d:00:6c:5b:19:ea:7b:19:a6:01:07:a8:8e:e3:62:69:ad:59:df:3d:bd:36:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

pdh

shell32

shlwapi

advapi32

ole32

gdi32

bcrypt

ws2_32

secur32

crypt32

psapi

iphlpapi

netapi32

powrprof

oleaut32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 438KB - Virtual size: 438KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 29KB - Virtual size: 29KB

4a:53:8c:28
Certificate

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

0a:0f:8d:70:28:fa:3c:5d:7b:eb:8a:5a:07:b9:f8:b6
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

25:33:c6:55:10:37:ac:d2:25:5d:00:6c:5b:19:ea:7b:19:a6:01:07:a8:8e:e3:62:69:ad:59:df:3d:bd:36:c2
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 438KB - Virtual size: 438KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 29KB - Virtual size: 29KB