setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

789KB
MD5

1696f421e5acbf8768ee7ad6bd3b5750
SHA1

4505d024b1a74d08a7261c88cdb0b0ccc709d998
SHA256

fe21bf041adf9b913483ac7bb8477f2160fa5c117a2ee84cbe98f05c6992cdb4
SHA512

bf358115bfe5f92b61b2ba5722673c96bfbba534d52d23d65421eca3440d22fc458c06150e09c219fd18cb7506bad27798b3f5004efc155477a2271db1360a9a
SSDEEP

6144:VU9j8D8F3GLLE2tyjn+n7iH1i/5WhYz/KmsYuNpkKHX2aAzlNjYPDdOHBCGvVpRT:VKj84VGLHik/Lz/BXuALlNcLdUF3qWou

Score

1^/10

Malware Config

Signatures

Files

setup.exe
.exe windows:4 windows x86 arch:x86

fc349687b82a59bedb5788849f9f2c0e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:e9:8c:cc:69:80:0f:62:96:bd:b2:4f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

19/03/2020, 20:39

Not After

05/05/2023, 14:37

Subject

CN=Natus Medical Incorporated,O=Natus Medical Incorporated,L=San Carlos,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6b:10:dc:41:c2:87:9e:32:8c:bb:bf:46:b4:5d:9f:ef:3b:55:d7:61
Signer

Actual PE Digest

6b:10:dc:41:c2:87:9e:32:8c:bb:bf:46:b4:5d:9f:ef:3b:55:d7:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

lstrcpynA
lstrcmpiA
GetFileAttributesA
lstrcatA
FindClose
FindFirstFileA
IsBadReadPtr
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
CreateFileMappingA
VirtualQuery
CompareStringA
CreateDirectoryA
CompareStringW
GetCurrentDirectoryA
ExpandEnvironmentStringsA
SetFileAttributesA
FileTimeToLocalFileTime
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
IsDBCSLeadByte
MoveFileExA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
WriteFile
lstrlenA
Sleep
CloseHandle
CreateProcessA
lstrlenW
GetDriveTypeA
FindResourceExA
GetPrivateProfileIntA
GetFileSize
SetFilePointer
CreateEventA
QueryPerformanceFrequency
ReleaseMutex
GetSystemDefaultLangID
CreateMutexA
SetErrorMode
LoadLibraryA
FreeLibrary
GetDiskFreeSpaceA
VerLanguageNameA
ReadFile
GetTickCount
GetCommandLineA
ExitThread
CreateThread
GetExitCodeProcess
FreeResource
MulDiv
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
GetLocaleInfoA
GetWindowsDirectoryA
InterlockedDecrement
LocalFree
InterlockedIncrement
FormatMessageA
GetTempPathA
GetVersionExA
CreateFileA
GlobalFree
FindResourceA
LoadResource
SizeofResource
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GetSystemDirectoryA
SetCurrentDirectoryA
WaitForSingleObject
ExitProcess
GetCurrentProcess
lstrcpyA
DuplicateHandle
GetThreadContext
VirtualProtectEx
WriteProcessMemory
FlushInstructionCache
SetThreadContext
ResumeThread
GetLastError
SetLastError
DeleteFileA
RemoveDirectoryA
MultiByteToWideChar
WideCharToMultiByte
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
FindNextFileA
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
lstrcmpA
SystemTimeToFileTime
QueryPerformanceCounter
SetEvent
ResetEvent
SearchPathA
VirtualProtect
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetVersion
GetCurrentProcessId
InitializeCriticalSection
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
HeapReAlloc
RaiseException
RtlUnwind
DeleteCriticalSection
InterlockedExchange
GetTempFileNameA
OpenProcess
CompareFileTime
GetProcessTimes
TerminateProcess
GetLocalTime
GetTimeFormatA
GetDateFormatA

user32

CharUpperA
DialogBoxIndirectParamA
WaitForInputIdle
SetActiveWindow
SetForegroundWindow
SetWindowLongA
SetWindowTextA
SendMessageA
GetDlgItem
LoadIconA
EndDialog
MoveWindow
GetWindowRect
wsprintfA
MessageBoxA
SetFocus
BeginPaint
LoadStringA
FillRect
EndPaint
GetMessageA
DefWindowProcA
GetWindow
SystemParametersInfoA
GetSystemMetrics
MapWindowPoints
GetPropA
EnableMenuItem
SetPropA
RemovePropA
GetSysColor
LoadImageA
GetDC
ReleaseDC
CreateDialogParamA
GetParent
GetWindowTextA
IsWindowVisible
CreateDialogIndirectParamA
GetDesktopWindow
ExitWindowsEx
RegisterClassExA
InvalidateRect
IntersectRect
EnumChildWindows
GetWindowDC
GetDlgItemTextA
CreateWindowExA
UpdateWindow
DrawIcon
MapDialogRect
GetClassNameA
CallWindowProcA
DrawFocusRect
InflateRect
DrawTextA
CopyRect
GetClientRect
IsWindowEnabled
FindWindowExA
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
EnableWindow
ShowWindow
SendDlgItemMessageA
PostMessageA
ScreenToClient
SetWindowPos
IsWindow
DestroyWindow
GetWindowLongA
SetDlgItemTextA

gdi32

SetBkMode
SetTextColor
TextOutA
RestoreDC
SetBkColor
CreateSolidBrush
UnrealizeObject
SelectPalette
RealizePalette
BitBlt
CreateCompatibleDC
SelectObject
GetDIBColorTable
GetSystemPaletteEntries
CreatePalette
DeleteDC
CreateHalftonePalette
GetDeviceCaps
TranslateCharsetInfo
GetObjectA
CreateFontIndirectA
DeleteObject
DeleteMetaFile
CreateCompatibleBitmap
CreateDCA
GetStockObject
GetTextExtentPoint32A
CreatePatternBrush
CreateDIBitmap
SetMetaFileBitsEx
SetStretchBltMode
SelectClipRgn
CreateRectRgn
SetPixel
PatBlt
PlayMetaFile
StretchBlt
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SaveDC

advapi32

SetSecurityDescriptorGroup
RegCreateKeyExA
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegDeleteKeyA
RegEnumValueA
RegQueryValueExA
RegDeleteValueA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
RegSetValueExA
SetSecurityDescriptorDacl
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoInitialize
CoUninitialize
CoInitializeSecurity

oleaut32

VariantChangeType
VariantClear
GetErrorInfo
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SysReAllocStringLen

lz32

LZOpenFileA
LZCopy
LZClose

msi

ord87
ord168
ord8
ord136
ord141

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

Sections

.text
Size: 406KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc349687b82a59bedb5788849f9f2c0e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

30:e9:8c:cc:69:80:0f:62:96:bd:b2:4fCertificate

Extended Key Usages

Key Usages

6b:10:dc:41:c2:87:9e:32:8c:bb:bf:46:b4:5d:9f:ef:3b:55:d7:61Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

lz32

msi

rpcrt4

Sections

.text Size: 406KB - Virtual size: 406KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 30KB - Virtual size: 36KB

.rsrc Size: 290KB - Virtual size: 289KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

30:e9:8c:cc:69:80:0f:62:96:bd:b2:4f
Certificate

6b:10:dc:41:c2:87:9e:32:8c:bb:bf:46:b4:5d:9f:ef:3b:55:d7:61
Signer

.text
Size: 406KB - Virtual size: 406KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 30KB - Virtual size: 36KB

.rsrc
Size: 290KB - Virtual size: 289KB