Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

455KB
MD5

c544a0e2e173c94fa9069c73e7af6367
SHA1

1b8040c145d6cb2af6d1d9c1dc6878d51820e53b
SHA256

9d8547266c90cae7e2f5f5a81af27fb6bc6ade56a798b429cdb6588a89cec874
SHA512

f47694025fad1c67b727c9836d3663fa0f251a46e855e78e4c323beac1d82d13632e10d16e06e0d81718953ed6e06ee5e918195268ba988f3e555b432f1784a7
SSDEEP

3072:JrD9fI1D2oKZrGp4Lczp9+fOZveTHdHZ0Cp2Sb0Q0F:U1D2XGp4LczSOle5Zzp2Wg

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:5 windows x64 arch:x64

d6cc3458161fd6b90922f0135215a1d2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:b0:ad:28:26:6c:cd:04:ea:cc:19:54:6d:d4:9d:85
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-10-2016 00:00

Not After

03-10-2019 23:59

Subject

CN=Genie9 LTD,O=Genie9 LTD,POSTALCODE=W6 7BA,STREET=26 – 28 Hammersmith Grove,L=London,ST=Hammersmith,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:b2:42:21:10:53:3d:7f:93:50:6d:b9:4b:7a:d5:ef:ec:8a:4e:39
Signer

Actual PE Digest

da:b2:42:21:10:53:3d:7f:93:50:6d:b9:4b:7a:d5:ef:ec:8a:4e:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\Code\Timeline\branches\Timeline Offline\x64\Release\GDBUpdate.pdb

Imports

migrationlibrary

??1SqlMigration@GSSqlConvertor@@QEAA@XZ
?Migrate@SqlMigration@GSSqlConvertor@@QEAA?AW4ErrorCodes@2@PEB_W0@Z
?SetCommonPaths@SqlMigration@GSSqlConvertor@@QEAA?AW4ErrorCodes@2@PEB_W000000@Z
??0SqlMigration@GSSqlConvertor@@QEAA@XZ

gslogging

?WriteLog@CGSLog@LOGGER@@QEAAHPEBDW4_Severity@@0H0@Z
??1CGSFuncLog@LOGGER@@QEAA@XZ
?SetFileName@CGSLog@LOGGER@@QEAAXPEB_W@Z
?StartLogging@CGSLog@LOGGER@@QEAAHXZ
?g_GSLog@@3VCGSLog@LOGGER@@A
?SetAdvancedLog@CGSLog@LOGGER@@QEAAXH@Z
?Log@CGSLog@LOGGER@@QEAAXPEA_WZZ
?WriteLog@CGSLog@LOGGER@@QEAAHPEB_WW4_Severity@@PEBDH2@Z
??0CGSFuncLog@LOGGER@@QEAA@AEAVCGSLog@1@QEBDPEBD@Z

mfc100u

ord4261
ord4232
ord4274
ord4253
ord4219
ord4223
ord4256
ord3857
ord13687
ord3850
ord2577
ord13003
ord6837
ord13009
ord5910
ord10414
ord12208
ord5064
ord2286
ord10798
ord3362
ord2859
ord2858
ord2759
ord10841
ord3282
ord5255
ord9024
ord5840
ord885
ord1877
ord3163
ord9216
ord4199
ord7315
ord12677
ord12014
ord1838
ord3277
ord776
ord1190
ord9770
ord2093
ord2533
ord319
ord2038
ord13827
ord2092
ord12790
ord7870
ord5584
ord8038
ord8063
ord10846
ord2354
ord12251
ord5338
ord2663
ord2884
ord2885
ord10101
ord9747
ord10805
ord11363
ord10763
ord7968
ord13681
ord13680
ord13752
ord13769
ord13765
ord13767
ord13768
ord13766
ord2355
ord7088
ord2791
ord2794
ord12255
ord4270
ord2731
ord2846
ord10926
ord373
ord7321
ord7246
ord11463
ord13475
ord4570
ord2117
ord11157
ord11158
ord13002
ord6836
ord13008
ord8221
ord3543
ord3484
ord11542
ord6853
ord1716
ord13782
ord10658
ord12889
ord11150
ord6898
ord13191
ord13188
ord13193
ord13190
ord13192
ord13189
ord3295
ord5049
ord10910
ord10918
ord7094
ord9189
ord10922
ord10891
ord11523
ord4473
ord4737
ord4907
ord8174
ord4715
ord4910
ord4476
ord4612
ord4457
ord6669
ord6670
ord6660
ord4610
ord7096
ord9019
ord8037
ord5894
ord1883
ord928
ord5562
ord5616
ord3320
ord926
ord1204
ord3486
ord1953
ord1944
ord4131
ord12387
ord837
ord1868
ord6895
ord1270
ord878
ord6609
ord9138
ord12842
ord12836
ord10712
ord10713
ord5790
ord1900
ord4240
ord4244
ord4248
ord4236
ord4265
ord4228
ord1497
ord1490
ord1492
ord1486
ord5340
ord1479
ord910
ord344
ord1276
ord1418
ord10928
ord12359
ord3704
ord2760
ord8084
ord9734
ord5998
ord10892
ord13001
ord7803
ord6453
ord10626
ord4348
ord11175
ord296
ord280
ord286
ord287
ord890
ord1288
ord1290
ord1454
ord1457
ord7609
ord2541
ord285
ord5052
ord2527
ord266
ord2050
ord265
ord1278
ord4935

msvcr100

free
memset
_CxxThrowException
__CxxFrameHandler3
memcpy
_errno
_wfopen
_wcserror
wcsncpy
_wcsnicmp
_swprintf
memmove
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
wcstok
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBD@Z
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
fclose
fseek
wcsncmp
ftell
fwrite
fread
strncpy
wcstol
wcschr

kernel32

Sleep
GetFileAttributesW
CreateFileW
GetProcessHeap
HeapSize
HeapReAlloc
CreateDirectoryW
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
FindClose
FindNextFileW
GetDiskFreeSpaceExW
CloseHandle
GetCommandLineW
DeleteFileW
HeapFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
TerminateThread
GetCurrentProcess
CopyFileW
GetModuleFileNameW
lstrlenW
lstrcpyW
FindFirstFileW

user32

MessageBoxExW
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow
PostMessageW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathStripToRootW
PathAddBackslashW
PathFileExistsW
PathRemoveBackslashW

msvcp100

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1_Container_base12@std@@QEAA@XZ

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6cc3458161fd6b90922f0135215a1d2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0e:b0:ad:28:26:6c:cd:04:ea:cc:19:54:6d:d4:9d:85Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

da:b2:42:21:10:53:3d:7f:93:50:6d:b9:4b:7a:d5:ef:ec:8a:4e:39Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

migrationlibrary

gslogging

mfc100u

msvcr100

kernel32

user32

advapi32

shell32

comctl32

shlwapi

msvcp100

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 367KB - Virtual size: 366KB

.reloc Size: 2KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0e:b0:ad:28:26:6c:cd:04:ea:cc:19:54:6d:d4:9d:85
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

da:b2:42:21:10:53:3d:7f:93:50:6d:b9:4b:7a:d5:ef:ec:8a:4e:39
Signer

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 367KB - Virtual size: 366KB

.reloc
Size: 2KB - Virtual size: 2KB