Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

86KB
MD5

7eb912e2d4933a4016a2ec45413a17c6
SHA1

47ff0b19e7de7124a3739030af86b3f9e616b6a7
SHA256

193fcd48bb8cb92a330a5a15effc0df43a3f90dab348ccd26afcccb3c880a531
SHA512

ecc049e5e95f225eb9c576ec420ada897a1596d32bc05371c4d113782f4b956513b68e93148c09b320cb749cb32fe6e2bf5e2369ae9b3785c6bcb5e2316a7c8d
SSDEEP

1536:ki8hgX1PdzaodhYdyyyygPo2C9+WZnqxMQP8ZOs0JJ+ZUzEBv+0:ki8hiVd1yyyyygPo2OX/gBqZUzEZ+0

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:5 windows x86 arch:x86

7bb20f355de311301d813a50a81237a4

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:23:7f:00:26:05:9e:54:50:76:3f:e0:61:b3:3a:a0:d8:97:9c:85:bb:02:5d:b7:a5:1c:9d:4f:6d:b7:d0:57
Signer

Actual PE Digest

14:23:7f:00:26:05:9e:54:50:76:3f:e0:61:b3:3a:a0:d8:97:9c:85:bb:02:5d:b7:a5:1c:9d:4f:6d:b7:d0:57

Digest Algorithm

sha256

PE Digest Matches

true

3a:21:39:94:9a:66:e0:11:32:72:32:5c:db:50:36:31:9f:f2:4d:19
Signer

Actual PE Digest

3a:21:39:94:9a:66:e0:11:32:72:32:5c:db:50:36:31:9f:f2:4d:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Setup.pdb

Imports

kernel32

HeapSetInformation
LoadLibraryW
GetProcAddress
MultiByteToWideChar
LCMapStringW
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
WideCharToMultiByte
HeapSize
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
GetStringTypeW

setupengine

Run

Exports

Exports

_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7bb20f355de311301d813a50a81237a4

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9bCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

14:23:7f:00:26:05:9e:54:50:76:3f:e0:61:b3:3a:a0:d8:97:9c:85:bb:02:5d:b7:a5:1c:9d:4f:6d:b7:d0:57Signer

3a:21:39:94:9a:66:e0:11:32:72:32:5c:db:50:36:31:9f:f2:4d:19Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

setupengine

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 23KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

14:23:7f:00:26:05:9e:54:50:76:3f:e0:61:b3:3a:a0:d8:97:9c:85:bb:02:5d:b7:a5:1c:9d:4f:6d:b7:d0:57
Signer

3a:21:39:94:9a:66:e0:11:32:72:32:5c:db:50:36:31:9f:f2:4d:19
Signer

.text
Size: 23KB - Virtual size: 23KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 2KB - Virtual size: 1KB