Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 38.9MB
Sample240709-avjpfswhqq
SHA256 a62ef8b3fdece9258ccaa159eb72469dcc67bcdef94281a1079ccb1f3b058c47
MD5 e43590cf5c0bbc73af1d6532e9803258
SHA1 e242676637f8566b26dc2b6bba920a1e950ced5f
SHA512 c806030884a7d4d27a13dd8afcb83e97c1d964159e7f612defebcd905db31cda924b2a3efcc8a9f3055747fc939c31b0f2346021ffef2b427ae5ab74253eb3f9
SSDEEP 786432:r8dl217gZe+0fGuKiahOXPRfWkfmy7sf3z4LMTQPa5UQ5bw0Kno4razqEzfBZxYb:YO17gZe+TXQ/8key7/sQS59KzGOEzjxA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Setup.exe

.exe 38.9MB

Setup.exe

IMPHASH f8ecbd149465a0494d2d649a3de17654
SHA256 a62ef8b3fdece9258ccaa159eb72469dcc67bcdef94281a1079ccb1f3b058c47
MD5 e43590cf5c0bbc73af1d6532e9803258
SHA1 e242676637f8566b26dc2b6bba920a1e950ced5f
SHA512 c806030884a7d4d27a13dd8afcb83e97c1d964159e7f612defebcd905db31cda924b2a3efcc8a9f3055747fc939c31b0f2346021ffef2b427ae5ab74253eb3f9
SSDEEP 786432:r8dl217gZe+0fGuKiahOXPRfWkfmy7sf3z4LMTQPa5UQ5bw0Kno4razqEzfBZxYb:YO17gZe+TXQ/8key7/sQS59KzGOEzjxA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

1e:b5:0a:83:ea:5e:2f:53:90:04:c5:a4:85:43:c0:fd:08:c6:cb:87:00:78:6f:a0:f5:dd:bd:18:e3:39:49:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 14, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Digest

a0:fb:b0:69:47:d9:59:a8:ce:b0:8e:24:92:5a:4e:68:d2:92:e8:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jun 14, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 17, 2022 - Jun 17, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 17, 2022 - Jun 17, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

281770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb

comctl32

ord17

kernel32

LoadLibraryW lstrcmpW lstrcmpiW GetSystemDefaultLangID GetUserDefaultLangID VerLanguageNameW CompareFileTime CreateDirectoryW FindClose FindFirstFileW FindNextFileW SetFileAttributesW GetSystemTimeAsFileTime GetPrivateProfileStringW MoveFileW LocalFree FormatMessageW GetSystemInfo MulDiv RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExW GetVersion GetLocalTime IsValidLocale GetCommandLineW GetFileAttributesW GlobalAlloc GlobalFree FlushFileBuffers VirtualQuery IsBadReadPtr GetDiskFreeSpaceExW GetExitCodeProcess GetCurrentThread GetLocaleInfoW InterlockedExchange LoadLibraryExA DecodePointer LCMapStringW RtlUnwind IsDebuggerPresent MoveFileExW WriteProcessMemory VirtualProtectEx GetSystemDirectoryW FreeLibrary SetThreadContext GetThreadContext CreateProcessW ResumeThread TerminateProcess ExitProcess GetCurrentProcess Sleep WaitForSingleObject DuplicateHandle RemoveDirectoryW DeleteFileW SetCurrentDirectoryW lstrlenW lstrcmpA SystemTimeToFileTime ResetEvent SetEvent FindResourceExW OpenProcess GetProcessTimes ReadConsoleW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeFormatW GetDateFormatW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetFileType HeapReAlloc GetStartupInfoW TlsFree TlsSetValue IsProcessorFeaturePresent CompareStringA CompareStringW lstrcatW GetVersionExW InterlockedDecrement InterlockedIncrement CreateEventW QueryPerformanceFrequency GetTempFileNameW CopyFileW GetTickCount GetExitCodeThread CreateThread FindResourceW GlobalUnlock GlobalLock SizeofResource LockResource LoadResource lstrcpyW GetWindowsDirectoryW SetErrorMode GetTempPathW FlushInstructionCache ExpandEnvironmentStringsW lstrcpynW GetModuleFileNameW GetProcessHeap HeapFree HeapAlloc WriteFile SetFilePointer ReadFile WideCharToMultiByte MultiByteToWideChar lstrlenA UnmapViewOfFile MapViewOfFile CreateFileMappingW CloseHandle GetFileSize CreateFileW SetLastError GetLastError LoadLibraryA GetSystemDirectoryA GetProcAddress GetModuleHandleW TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCurrentThreadId HeapSize GetModuleHandleExW GetStdHandle EncodePointer

user32

CreateWindowExW SetTimer KillTimer LoadCursorW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW PostQuitMessage GetSysColorBrush CharPrevW SendDlgItemMessageW wvsprintfW LoadImageW CreateDialogParamW MoveWindow SetCursor GetWindow GetDlgItemTextW SetFocus EnableWindow SetForegroundWindow SetActiveWindow SetDlgItemTextW IsDialogMessageW FindWindowW SubtractRect IntersectRect SetRect FillRect GetSysColor GetWindowRect GetDC GetSystemMetrics GetDlgCtrlID CreateDialogIndirectParamW DestroyWindow IsWindow SendMessageW MessageBoxW CharNextW WaitForInputIdle SetWindowLongW GetWindowLongW GetClientRect EndPaint BeginPaint ReleaseDC ExitWindowsEx CharUpperW GetWindowDC SetWindowPos SetWindowTextW GetDlgItem EndDialog DialogBoxIndirectParamW ShowWindow GetDesktopWindow MsgWaitForMultipleObjects PeekMessageW wsprintfW LoadIconW

gdi32

UnrealizeObject CreateHalftonePalette GetDIBColorTable SelectPalette RealizePalette GetSystemPaletteEntries CreatePalette CreateFontW GetObjectW SetTextColor SetBkMode GetDeviceCaps CreateSolidBrush CreateFontIndirectW SetStretchBltMode StretchBlt SelectObject DeleteDC CreateDIBitmap CreateCompatibleDC BitBlt DeleteObject GetStockObject TranslateCharsetInfo

advapi32

GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken OpenProcessToken SetEntriesInAclW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegEnumValueW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegOverridePredefKey RegOpenKeyW

shell32

SHGetMalloc SHGetFolderPathW SHBrowseForFolderW ShellExecuteW CommandLineToArgvW ShellExecuteExW SHGetPathFromIDListW

ole32

CoCreateInstance CoCreateGuid CLSIDFromProgID CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoInitializeSecurity CoInitialize

oleaut32

RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocStringLen SysFreeString SysReAllocStringLen SysStringLen SysAllocString SysStringByteLen SysAllocStringByteLen VarBstrCat VarBstrFromDate VariantClear VariantChangeType GetErrorInfo VarUI4FromStr SystemTimeToVariantTime

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

generic