setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

473KB
MD5

091a63c72bcd08fb4529f0330fd1a61b
SHA1

6d0f1a2737667d43b46fee07eccb1cc6378d5f6e
SHA256

2136ba10211176fe472596f94cb2e55981662c596279a2d8aa84aca1293c0d84
SHA512

97d757bdb4aefe10718f61db90ba1938f937f062b88d6db5ee5ea9ec00c8acaf9018ffe890994ff57303797bc9ca39495764a0a75e137592db6b39b195adb142
SSDEEP

6144:vFAkzPKn86AxN3vKIdwz7vGeFcYIx06LzV8QYezajWOzkPVm79UzCF:ikzPK8r73vKkwz77cYMxLh5OjlSmWzQ

Score

1^/10

Malware Config

Signatures

Files

setup.exe
.exe windows:5 windows x86 arch:x86

2f3e844c9c2a9aff344b49004cc1679a

Code Sign

63:7d:b8:99:ad:9a:02:30:c4:3b:95:33:2c:fd:17:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/08/2011, 00:00

Not After

22/08/2014, 23:59

Subject

CN=IVT CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=IVT CORPORATION,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:a5:b6:15:87:56:82:20:07:95:c0:a1:fe:09:e6:83:fc:7e:ea:e1
Signer

Actual PE Digest

7b:a5:b6:15:87:56:82:20:07:95:c0:a1:fe:09:e6:83:fc:7e:ea:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\work\soc_src\bluesoleil2\src\BaseVersion\SetUp\SetupExe\Debug\setup.pdb

Imports

shlwapi

StrStrIA

kernel32

GetCurrentProcess
GetProcAddress
GetModuleHandleA
SetEnvironmentVariableA
GetModuleFileNameA
GetPrivateProfileIntA
lstrcatA
GetWindowsDirectoryA
GetLastError
lstrlenA
WaitForSingleObject
CreateProcessA
GetPrivateProfileStringA
ExpandEnvironmentStringsA
GetLocalTime
CompareStringA
lstrcpyA
Sleep
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
HeapValidate
IsBadReadPtr
CloseHandle
FlushFileBuffers
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
RaiseException
DebugBreak
MultiByteToWideChar
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
InterlockedIncrement
InterlockedDecrement
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapDestroy
HeapCreate
HeapFree
VirtualFree
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
CreateFileA
GetProcessHeap
VirtualQuery
FreeLibrary
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetEndOfFile
ReadFile
GetLocaleInfoW
GetTimeZoneInformation

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA

Sections

.text
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f3e844c9c2a9aff344b49004cc1679a

Code Sign

63:7d:b8:99:ad:9a:02:30:c4:3b:95:33:2c:fd:17:92Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

7b:a5:b6:15:87:56:82:20:07:95:c0:a1:fe:09:e6:83:fc:7e:ea:e1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

advapi32

Sections

.text Size: 374KB - Virtual size: 374KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 5KB - Virtual size: 13KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 9KB - Virtual size: 8KB

63:7d:b8:99:ad:9a:02:30:c4:3b:95:33:2c:fd:17:92
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

7b:a5:b6:15:87:56:82:20:07:95:c0:a1:fe:09:e6:83:fc:7e:ea:e1
Signer

.text
Size: 374KB - Virtual size: 374KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 5KB - Virtual size: 13KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 9KB - Virtual size: 8KB