Setup[.]exe | Triage™

resource
Setup.exe

Setup.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883
MD5 9f5fea618279281fdc697b0d43760a16
SHA1 198b4078dd03e7cc8d58c024fcc8956704a87893
SHA512 e80df43046447f29c23ec05a16ffd4003efacec15eca5ad16dbe15345174621f5ad7752a23cd1b5268ec46ae74c283233dbb223e8e2557a9f3c87a70c4f4f6e4
SSDEEP 24576:Z9/YFro7myA9aUx6P2lms+OKMREuMJY3cOz9ra:ZOp9MUxKyKMRfMJMla
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

346KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Affect

SHA256 fb9efeb562fd817252d78023ec09f0a81f478e834bcca263d9679759a089fc1b
MD5 47ca6ff2405757093a39dd21d9a90055
SHA1 dec4f32b7201484609cb2597d126ec11bbac5aef
SHA512 a5b3ca22723ed7fac1903c37093c2cc4daa65fbd25ad2b012e7877b4d6037af3610be79bd293756357f1eafddafb92db464c14dca2ed8d464f6d65baf55fb53f
SSDEEP 1536:oE20UDCrRExD4quxKr/V5V7E/tfFo4+yRqvh8qu9PQCPNDSjYrWq90h5HMAtjRgY:RO71fLV7ItfFx+ySh8f9PnhzCq90h5s6
MD5 SHA1 SHA512 SSDEEP

$TEMP/Amenities

SHA256 b271b477ed275355e180503c8928b9cfc943285eddbb277201548e9cb1cbbdfb
MD5 540e2e531f3ef953ee24e41fc3c4b734
SHA1 fae277f98217519de3154eddf208d15eaca86e13
SHA512 a83a9f1370e5714d042038a4f7047cf880c6dadb8cae8c4db44da93a50431dc3902eaf40f1f84a5ba5a20172f09d4353568263c576fe39a2e5d400923ad8c28d
SSDEEP 1536:0Uv3jWjkB+kb0f+iP8BVuv2mTMCpr7WYDQuDDmpMa34Fpd:0+8JkbM+m8BI+mf5WYt+GO+
MD5 SHA1 SHA512 SSDEEP

$TEMP/Bdsm

SHA256 458b8a482d601b04ecbc85865f2fecb8dd35790be2b7cf272d54efb8f07f341c
MD5 44693bc6ae29647e826324f1cb03b8f8
SHA1 dc08c1144d112116e72227408bd6c6f7a5ba8112
SHA512 c9def728e63aad9d93051bc6e7dfe1c50fe5a183c7c1bdfa30e242c02611cc902dcfa42f7900fbf2e5818a6336e4f3018cccc1272139f061c52a121435e499e6
SSDEEP 12288:vpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:vTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

$TEMP/Birthday

SHA256 0f6bdebfbca53c6d4d9c4ab95090fecf502616c74d8d3e06dd533e84c0be7b4d
MD5 a45b810c4e588f70b6d9f7868cf41021
SHA1 5b06afd2e70a0ec78149ec561302a00d6ef8d9e8
SHA512 4b0687b4ce8f3e4f0e771cc1c32088c2d199159b6433604408f8e8be0dda71d56984857dc9a8de3f0f5213ee20916112adabd33d30c5b45327f688aee429610c
SSDEEP 1536:rg89lD12/Vcvvuvwa2FyVZ8qWHJo/aNyKCaKEx6E+pebCut/b9wbic4:Uwb2/6El2FuZ8jSagRRVpemudhwv4
MD5 SHA1 SHA512 SSDEEP

$TEMP/Cameras

SHA256 fe69bfec7083056b954bedda974eefcf698e8cacc77e70e1d3b52ca2a5a59a7d
MD5 8c2e280e0ae378d740b2290dd32a3b8f
SHA1 4f17a062dc7b4900323ad04858c054d241091bd1
SHA512 cc47a8a97326e927e63cae3f647cd481f537b322187219c7940275e493a3a05128db0f9b305ce448dfe7bd722d1917412770ba15202d939263bded4accdcf2c4
SSDEEP 1536:OxT4VkKIhMNRZF6Jd2BSlmNoEH4mLsgLqbLO0nwxvMbcUC:OxT4VIyRZF62BSMSEH4mLsgLqv5nyBl
MD5 SHA1 SHA512 SSDEEP

$TEMP/Eliminate

SHA256 227c0a7bef3c456647d7573131e8fc0dcd3983e13288d35da675d9a0bf176ebc
MD5 91db20bed71a9d0e1aac5bad5f8d6a9b
SHA1 28f5d8d18ab339b673cd7776918c14e32812402d
SHA512 cf5f887fe006c6559ad5610bab8cc0afbae1c4e9ef2c55915f710efe90c8a09a9d33d6dad6c286a1386bf1addbd7c88d3704ea315a579e88e53b6cef5f2584c1
SSDEEP 1536:jm8EExMM1/4WNGSqXaWj+OBpbHFAD1LrUqOSqc/ycCgv:jmeyM5GtXR+0bs1LrUqOSGkv
MD5 SHA1 SHA512 SSDEEP

$TEMP/Melissa

SHA256 fd00df2aa9c3a903590c392ef0fb081ec8f07fd0844618138a743ee368d920e8
MD5 ae8ece3d790ffd78e6b91a6b64e48fe5
SHA1 78a5b5662c8a7c92eacf2d1094ca635bea67ec62
SHA512 a670f47bfe87bed6e412bbe699bb1662802d0d3950aee69c63a79d0e16c2ed4abd86980f5cc77c9bef18e5957484deee7ed47a60aee95c4c40032983f31e4f85
SSDEEP 1536:qB8PxnoPUlpdwvwOlSblvh+lM2UPGcPQX:I8JougN4klnp
MD5 SHA1 SHA512 SSDEEP

DxSenators/Burlington

SHA256 9bbe702d70718c86a4cf31c8cf89badbb2148cf65b5c1e55f02f94bbf9bb391b
MD5 d396944732116d039ed215fc45daf80b
SHA1 4ba51a03e4082ed3df9e15216693a86bb6889488
SHA512 91c8b219856cdad1ec976903001e24bfa500db3dcb316a95470c713f1e06dbc9f8acc3022407991a6feaf4859366796da9e5d56269b5b214b8817ff4a9a37c78
MD5 SHA1 SHA512

DxSenators/Ja

SHA256 4956b8296c6b0344e97e1a310889240d21f42bf11f2259848e99646d04e9b1ba
MD5 17b202fa8093854fea43232078df4f1b
SHA1 f430b9fcab891cdd8a057b1b8267b312475bb2d9
SHA512 041073de3e8c004f3eee0f8f580bc8a1656fa2e7e4dc3524f2a61bf8630b08dff1c51d7c563c8d4b62fcc6857c48ea7ada0790ab00db026b48443a62b52708cf
SSDEEP 1536:0e+Iml1CfzmW14AghqEo3r95H5h9eRSB5vQ81C69lMXtu4oBkx7+X9xWhD4:0pfqfzmW14AuqEo7Xv9BB2mN9lMXtMBj
MD5 SHA1 SHA512 SSDEEP

DxSenators/Jose

SHA256 2da8df91d10965a9e496f0339e25968d27db9308c2311dbd8ff82dce1c166d97
MD5 7b5b6151e9d1151fac435551f34579ac
SHA1 4ac29aaa2efeb120c6dcbd1909bdb87c170b01ef
SHA512 f53a905a870d01525f85fc127fc2530b0eb745050b276624fcba1a9043c0e56ef576673310b681647c661f4d61f5d9c8dcd3843548fc40738cdd7da8c7e913fa
SSDEEP 384:FfUNZyxnKJN/9LzTTt+W+7WY1tph6JmEJ1Vvq4xlJ+PsKl7ASNpBkXEppPcS7CH+:BUNwaN/9TfAWYfD60EvRPxsstOOYPcT2
MD5 SHA1 SHA512 SSDEEP

DxSenators/Los

SHA256 ec01ce72a1e6f975ea78104ffa2207d9cc737762f2e001591282ec16f3394467
MD5 37abbdfd1a62b68e162ca95ad86e1163
SHA1 7257315d7a98065278f927fc9d531d6a5e81e98e
SHA512 8c22a43647a30371f0fed6d7f8a3cba4596d5ac6d2198db8984b1906fae9cd0923b94ff5117f1a52e1d2fbc6009bdcc42f3f4694ba2629345bf6a2026caf844d
SSDEEP 1536:HNuegbECxNqk1BusGtc43nhfRy/Ye1dD4G8ZCAkdgmLS:YeufusGSQWQeXD4G8ZCAkdxS
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Affect

$TEMP/Amenities

$TEMP/Bdsm

$TEMP/Birthday

$TEMP/Cameras

$TEMP/Eliminate

$TEMP/Melissa

DxSenators/Burlington

DxSenators/Ja

DxSenators/Jose

DxSenators/Los