setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

894KB
MD5

6efd434c9d9a8f48396510e02598eed4
SHA1

bdaa2775549b0f2f912e0b3868ee4a1dfd42b478
SHA256

95eb186fd4fee49c90fb61f362e6ea85cd4405dcc667dd0c05f1b52dc298e500
SHA512

11cfcf014a4141490f8d81e48d4c0d6cc259bf55fda52102e25079dd82f1edd9772ea57d9bd6d88f894830e6e4a94d02906b582a4ca63cb9034b85fb0495a23d
SSDEEP

12288:PrC78gwn0jOYiyd4z0nd1R5DJp66/grUqAenT+BvQrOg:DptYiydZnd1n66Ir2oTMvQrR

Score

1^/10

Malware Config

Signatures

Files

setup.exe
.exe windows:5 windows x86 arch:x86

0926779da4060b760a39b46291db5c5a

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:a1:ee:ff:44:80:e8:e3:31:7d:60:90:d7:ed:28:f5:08:79:9f:cc
Signer

Actual PE Digest

1f:a1:ee:ff:44:80:e8:e3:31:7d:60:90:d7:ed:28:f5:08:79:9f:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\builds\CCP\2.0\source\dev\AAMEE_CloudPackager\target\win\Release\MsiInvoker.pdb

Imports

msi

ord8
ord120
ord114
ord92
ord158
ord160
ord32
ord248
ord159

gdi32

CreateFontW

user32

wsprintfW
SendMessageW
CreateWindowExW
ShowWindow
LoadImageW
SetWindowTextW
EnableMenuItem
GetSystemMenu
GetDlgItem
EndDialog
DialogBoxParamW

ole32

CoInitialize
CoUninitialize
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CLSIDFromProgID
OleRun
CLSIDFromString
CoCreateInstance

oleaut32

SysAllocString
GetErrorInfo
VariantInit
VariantClear
VariantCopy
SysFreeString

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
PathFileExistsW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathRenameExtensionW

kernel32

GetModuleHandleExW
ExitThread
GetTimeZoneInformation
GetFileType
SetStdHandle
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
IsValidLocale
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
ExitProcess
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
FindFirstFileExW
UnregisterWait
GetACP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
SetEndOfFile
VirtualProtect
LocalFree
GetCurrentProcessId
GetLastError
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
Sleep
CloseHandle
CreateMutexW
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
GetTempPathW
CreateDirectoryW
MultiByteToWideChar
DecodePointer
GetProcAddress
GetCurrentProcess
GetExitCodeProcess
RaiseException
DeleteCriticalSection
GetFileSize
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
FindClose
GetModuleHandleW
CreateProcessW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
FreeLibrary
GetStdHandle
LoadLibraryW
GetCommandLineW
GetEnvironmentVariableW
FreeConsole
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetCurrentThreadId
GetLocalTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
OpenMutexW
InitializeCriticalSectionEx
GetModuleFileNameW
GetFileAttributesW
MoveFileExW
lstrcmpW
GetUserDefaultLangID
GetUserDefaultUILanguage
TerminateProcess
DuplicateHandle
HeapSize
CreateEventW
SetEvent
HeapReAlloc
CreateThread
ResetEvent
HeapAlloc
GetProcessHeap
GetThreadTimes
GetUserDefaultLCID
LCMapStringW
GetStringTypeW
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
TryEnterCriticalSection
EncodePointer
QueryPerformanceCounter
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
VirtualQuery
OutputDebugStringW
HeapFree

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
CommandLineToArgvW

Sections

.text
Size: 407KB - Virtual size: 407KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0926779da4060b760a39b46291db5c5a

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

1f:a1:ee:ff:44:80:e8:e3:31:7d:60:90:d7:ed:28:f5:08:79:9f:ccSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

gdi32

user32

ole32

oleaut32

shlwapi

kernel32

advapi32

shell32

Sections

.text Size: 407KB - Virtual size: 407KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 9KB - Virtual size: 13KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 293KB - Virtual size: 293KB

.reloc Size: 22KB - Virtual size: 21KB

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

1f:a1:ee:ff:44:80:e8:e3:31:7d:60:90:d7:ed:28:f5:08:79:9f:cc
Signer

.text
Size: 407KB - Virtual size: 407KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 9KB - Virtual size: 13KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 293KB - Virtual size: 293KB

.reloc
Size: 22KB - Virtual size: 21KB