Setup_696682[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Setup_696682.exe
Size

10.5MB
MD5

59fb641b45ea923945d4880361e26b5b
SHA1

fff9b9858259e3ed4f01c82934b69154ace364d3
SHA256

ba9f432baaaab1b47392243cf6f23106c0919032f153caa6d624cea9ce2c9eb5
SHA512

33354d8fbba046e28f0576072fb2e1bbccec3bb51093aab3943e72ad8958957d59e70e67e75449d3280cf217c98a604c3754723bd62c99e6f3cd0167ffbd288e
SSDEEP

196608:9/xBrU5j3N6yQVHaiEKYoKe0ZIKfWVoH6HierlU2PFoQV8r2joQVAqCs2m7oQVEX:9/xBA5j3N65EKYoKxWKf2rlU2PFoQV85

Score

1^/10

Malware Config

Signatures

Files

Setup_696682.exe
.exe windows:6 windows x86 arch:x86

0765157a7b9ed94c2c70a9a1a983c3fc

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:d0:64:9e:4d:eb:45:e2:60:b5:3d:30:63:6d:e1:cb
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

09/01/2024, 00:00

Not After

08/01/2025, 23:59

Subject

SERIALNUMBER=20201775850,CN=Sharp Innovations Inc.,O=Sharp Innovations Inc.,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1308436f6c6f7261646f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:e1:b0:4a:32:ac:d0:3b:4d:58:13:66:05:ae:fd:b7:d8:dd:06:97:64:f7:88:4e:9d:6c:d5:88:86:ee:e8:7b
Signer

Actual PE Digest

de:e1:b0:4a:32:ac:d0:3b:4d:58:13:66:05:ae:fd:b7:d8:dd:06:97:64:f7:88:4e:9d:6c:d5:88:86:ee:e8:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

OleUninitialize
CoCreateInstance
RevokeDragDrop
RegisterDragDrop
OleInitialize

kernel32

WideCharToMultiByte
SetFilePointer
PeekNamedPipe
WriteFile
GetDateFormatW
WaitForSingleObject
AttachConsole
WakeAllConditionVariable
GetFileAttributesW
EnumSystemLocalesW
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetConsoleMode
GetCommandLineA
SetThreadPriority
LCMapStringW
TlsSetValue
SetEvent
IsDebuggerPresent
MultiByteToWideChar
LoadLibraryW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetLastError
SetEnvironmentVariableW
GetEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentProcessId
GetFileType
GetCurrentProcess
LoadLibraryA
GetTimeFormatW
GetProcAddress
GetCurrentDirectoryW
WakeConditionVariable
DecodePointer
FreeLibrary
GetModuleFileNameW
GetConsoleOutputCP
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
TlsFree
TryEnterCriticalSection
ReleaseSRWLockExclusive
GlobalLock
lstrlenA
ResumeThread
InitializeSListHead
GlobalAlloc
IsValidCodePage
ReadFile
CreateEventW
CompareStringOrdinal
GetFileSize
FlushFileBuffers
DeleteCriticalSection
IsProcessorFeaturePresent
GetLocaleInfoW
GetSystemDirectoryW
GetFileInformationByHandle
VerSetConditionMask
FileTimeToSystemTime
GetOEMCP
HeapAlloc
SystemTimeToTzSpecificLocalTime
WriteConsoleW
ExitThread
GetFileSizeEx
SleepConditionVariableCS
TerminateProcess
GetStdHandle
SleepConditionVariableSRW
VerifyVersionInfoW
UnhandledExceptionFilter
InitializeCriticalSection
SetPriorityClass
HeapReAlloc
FindFirstFileExW
GetCPInfo
GetModuleHandleA
SetFilePointerEx
GlobalUnlock
CreateFileW
GetFullPathNameW
SetThreadAffinityMask
ReleaseMutex
InitializeCriticalSectionEx
GetDriveTypeW
WaitForSingleObjectEx
FreeLibraryAndExitThread
ResetEvent
GetTickCount
CompareStringW
InitializeSRWLock
CreateMutexW
lstrcatA
HeapFree
LeaveCriticalSection
SetEndOfFile
GetCurrentThreadId
GetModuleHandleExW
QueryPerformanceFrequency
InitializeConditionVariable
DeleteFileW
TerminateThread
ExitProcess
TlsGetValue
GetStartupInfoW
LoadLibraryExW
RtlUnwind
RaiseException
FormatMessageW
ReadConsoleW
EnterCriticalSection
GetTickCount64
GetACP
SetStdHandle
GetLastError
GetCurrentThread
OutputDebugStringW
GetModuleHandleW
GetCommandLineW
SleepEx
FreeEnvironmentStringsW
CreateThread
CloseHandle
Sleep
WaitForMultipleObjects
LCMapStringEx
HeapSize
GetProcessHeap
GetFileAttributesExW
EncodePointer
IsValidLocale
MoveFileExW
TlsAlloc
AcquireSRWLockExclusive
GetStringTypeW
GlobalSize
GetUserDefaultLCID

gdi32

CreateCompatibleDC
RemoveFontMemResourceEx
CreateBitmap
CreateRectRgn
GetGlyphIndicesW
GetKerningPairsW
SaveDC
SetMapMode
DeleteDC
RestoreDC
GetOutlineTextMetricsW
SelectObject
CreateFontIndirectW
DeleteObject
GetGlyphOutlineW
GetTextMetricsW
GetRegionData
CombineRgn
CreateDIBSection
GetDeviceCaps
ExcludeClipRect
StretchDIBits
CreateRectRgnIndirect
SetMapperFlags

shell32

ShellExecuteW
ExtractAssociatedIconW
DragQueryFileW

oleaut32

SysAllocString
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy

user32

SetWindowTextW
RegisterClassExW
ReleaseCapture
RedrawWindow
GetSystemMenu
CreateCaret
PostMessageW
CreateWindowExW
UnhookWindowsHookEx
PeekMessageW
GetMonitorInfoW
EmptyClipboard
CreateIconIndirect
GetWindowRect
VkKeyScanW
SendMessageW
GetActiveWindow
EnableMenuItem
ShowWindow
SetFocus
GetAsyncKeyState
SystemParametersInfoW
GetCursorPos
DefWindowProcW
ReleaseDC
IsChild
ToUnicode
EnumDisplayMonitors
CallNextHookEx
GetMessageExtraInfo
AttachThreadInput
MapWindowPoints
GetDesktopWindow
GetWindowLongW
LoadCursorW
GetWindowTextW
SendNotifyMessageW
EnumChildWindows
SetWindowLongW
wsprintfA
EndPaint
SendMessageTimeoutW
GetWindowThreadProcessId
SetClipboardData
DestroyWindow
GetDC
SetCursor
GetMessagePos
OpenClipboard
CloseClipboard
BeginPaint
ShowCaret
DestroyCaret
UpdateLayeredWindow
SetCursorPos
GetKeyboardState
MapVirtualKeyW
DispatchMessageW
GetUpdateRgn
GetCapture
BringWindowToTop
DestroyCursor
DestroyIcon
GetMessageTime
MonitorFromWindow
TrackMouseEvent
UnregisterClassW
SetCapture
SetCaretPos
SetWindowsHookExW
SetLayeredWindowAttributes
GetMessageW
EnumWindows
IsWindowVisible
SetWindowPos
MessageBeep
TranslateMessage
GetWindowInfo
GetForegroundWindow
GetAncestor
GetParent
GetWindowPlacement
IsWindow
WindowFromPoint
GetFocus
InvalidateRect
GetClipboardData

advapi32

CryptCreateHash
CryptImportKey
CloseServiceHandle
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptEncrypt
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey

ws2_32

WSAEnumNetworkEvents
WSAIoctl
WSAEventSelect
getaddrinfo
WSACreateEvent
__WSAFDIsSet
bind
closesocket
select
listen
WSAResetEvent
WSAStartup
getpeername
WSAWaitForMultipleEvents
getsockname
send
WSASetLastError
ntohs
connect
recvfrom
recv
getsockopt
htonl
htons
WSACloseEvent
sendto
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
freeaddrinfo
gethostname
accept
socket

winmm

timeGetTime
timeBeginPeriod

imm32

ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext
ImmAssociateContext
ImmNotifyIME
ImmSetCandidateWindow
ImmIsUIMessageW
ImmAssociateContextEx

dxgi

CreateDXGIFactory

bcrypt

BCryptGenRandom

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFindExtension
CertGetCertificateChain
CertOpenStore
PFXImportCertStore
CryptQueryObject
CertFreeCertificateContext
CertFreeCertificateChainEngine
CryptStringToBinaryW
CertGetNameStringW
CertCreateCertificateChainEngine
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertFindCertificateInStore

Sections

.text
Size: 9.8MB - Virtual size: 9.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 408KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0765157a7b9ed94c2c70a9a1a983c3fc

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

b3:d0:64:9e:4d:eb:45:e2:60:b5:3d:30:63:6d:e1:cbCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

de:e1:b0:4a:32:ac:d0:3b:4d:58:13:66:05:ae:fd:b7:d8:dd:06:97:64:f7:88:4e:9d:6c:d5:88:86:ee:e8:7bSigner

Headers

DLL Characteristics

File Characteristics

Imports

ole32

kernel32

gdi32

shell32

oleaut32

user32

advapi32

ws2_32

winmm

imm32

dxgi

bcrypt

crypt32

Sections

.text Size: 9.8MB - Virtual size: 9.8MB

.rdata Size: 408KB - Virtual size: 407KB

.data Size: 33KB - Virtual size: 39KB

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 159KB - Virtual size: 159KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

b3:d0:64:9e:4d:eb:45:e2:60:b5:3d:30:63:6d:e1:cb
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

de:e1:b0:4a:32:ac:d0:3b:4d:58:13:66:05:ae:fd:b7:d8:dd:06:97:64:f7:88:4e:9d:6c:d5:88:86:ee:e8:7b
Signer

.text
Size: 9.8MB - Virtual size: 9.8MB

.rdata
Size: 408KB - Virtual size: 407KB

.data
Size: 33KB - Virtual size: 39KB

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 159KB - Virtual size: 159KB