Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

141KB
MD5

704925ecfdb24ef81190b82de0e5453c
SHA1

1128b3063180419893615ca73ad4f9dd51ebeac6
SHA256

8cc871ee8760a4658189528b4a5d8afe9824f6a13faaf1fe7eb56f2a3ad2d04e
SHA512

ca187015812ddfcaa6515f3a5b780183b4a772801aa14b3f785d6dee9b9aa7db6402a7b346623fd24cf4a28f9856683022b10c3d812f8f2888e25bb218cbf216
SSDEEP

3072:fW6vjvEUEzozIGnKyvBhSVeoVdS5jO4yEWzJ1gKs4H+u1ERB:REJWC+SVeoVdSZOqWbgKs4HPQ

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:6 windows x86 arch:x86

0ca5cb26c304d9ba14511fa26b260aac

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e5:02:ba:bd:70:17:95:51:59:c8:cd:36:7c:c7:d0:f5:54:c6:2b:0e
Signer

Actual PE Digest

e5:02:ba:bd:70:17:95:51:59:c8:cd:36:7c:c7:d0:f5:54:c6:2b:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Dashboard.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
GetTokenInformation
OpenProcessToken
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey

kernel32

LocalFree
GetCommandLineW
CloseHandle
MultiByteToWideChar
lstrlenA
GetCurrentProcess
CreateMutexW
GetVersionExW
VerLanguageNameW
GetModuleFileNameW
GetModuleHandleW
HeapSetInformation
GetProcessHeap
GetProcAddress
GetSystemDefaultLCID
LoadLibraryW
CompareStringW
LoadLibraryExW
GetLastError
lstrcmpiW
TlsGetValue
lstrlenW
FindAtomW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
InterlockedCompareExchange
Sleep
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FreeLibrary

user32

GetSystemMetrics
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassA
SetRect
PostThreadMessageW
PostMessageW
SetWindowTextW
ExitWindowsEx
AdjustWindowRectEx
CharNextW
SetWindowPlacement
OffsetRect
GetWindowPlacement
EnableWindow
SetForegroundWindow
ShowWindow
IsWindowVisible
SendMessageW
SetWindowPos
RemoveMenu
GetSystemMenu
GetForegroundWindow
GetMonitorInfoW
MonitorFromRect
SystemParametersInfoW
IsRectEmpty

msvcr80

_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
memcpy_s
_CxxThrowException
memmove_s
wcsstr
wcschr
??_V@YAXPAX@Z
__CxxFrameHandler3
free
calloc
??2@YAPAXI@Z
_recalloc
_vscwprintf
vswprintf_s
malloc
swprintf_s
memset
wcscat_s
wcscpy_s
wcsncpy_s
_vsnwprintf
_wcslwr_s
_wcsicmp
_purecall
_amsg_exit
_invoke_watson
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
??3@YAXPAX@Z

shell32

ShellExecuteW
CommandLineToArgvW
SHAppBarMessage

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoQueryProxyBlanket
CoCopyProxy
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

oleaut32

VariantChangeType
SysFreeString
SysAllocString
VarUI4FromStr
SysStringLen
VarBstrCmp
DispCallFunc
VariantClear
VariantInit

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

uxcore

?SetDefaultFocus@NativeHWNDHost@DirectUI@@MAEXXZ
?Destroy@NativeHWNDHost@DirectUI@@UAEXXZ
?RMInitialize@@YGXXZ
?RMUpdateResourceSet@@YG_NPB_WK00@Z
UXCoreInitProcess
UXCoreInitThread
UXCoreUnInitThread
UXCoreUnInitProcess
?RMTerminate@@YGXXZ
?LoadAndCreateElement@CRMDUIParser@@QAEJIPB_WPAPAVElement@DirectUI@@PAV23@K0@Z
?Initialize@NativeHWNDHost@DirectUI@@QAEJPB_W0PAUHWND__@@PAUHICON__@@HHHHHHHPAUHINSTANCE__@@I@Z
?RMLoadIcon@@YGPAUHICON__@@PB_WK0@Z
?Create@HWNDElement@DirectUI@@SGJPAUHWND__@@_NI1PAPAVElement@2@@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?Attach@CRMDUIParser@@QAEJPAVElement@DirectUI@@@Z
BuildDropTarget
??0NativeHWNDHost@DirectUI@@QAE@XZ
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?CreateUnknown@Value@DirectUI@@SGPAV12@PAUIUnknown@@@Z
?CmdContextProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?AccNameProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?AccRoleProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?StrToID@DirectUI@@YGGPB_W@Z
?RMLoadInt@@YGHIHKPB_W@Z
?GetHWND@NativeHWNDHost@DirectUI@@QAEPAUHWND__@@XZ
?RMLoadString@@YGIIPA_WIKPB_W@Z
?Class@Element@DirectUI@@2PAUIClassInfo@2@A
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?Class@Checkbox@DirectUI@@2PAUIClassInfo@2@A
?Class@Hyperlink@DirectUI@@2PAUIClassInfo@2@A
?Class@Progress@DirectUI@@2PAUIClassInfo@2@A
?_ZeroRelease@Value@DirectUI@@AAEXXZ
?ParentProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?GetValue@Element@DirectUI@@QBEPAVValue@2@PBUPropertyInfo@2@H@Z
?ChildrenProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?ClassProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?IDProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?VisibleProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?CreateBool@Value@DirectUI@@SGPAV12@_N@Z
?ContentProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?CreateString@Value@DirectUI@@SGPAV12@PB_WPAUHINSTANCE__@@I@Z
?CreateAtom@Value@DirectUI@@SGPAV12@PB_W@Z
?AccDescProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?g_dwElSlot@DirectUI@@3KA
?StartDefer@Element@DirectUI@@SGXXZ
?EndDefer@Element@DirectUI@@SGXXZ
?CheckedProp@Checkbox@DirectUI@@2PAUPropertyInfo@2@A
?UrlProp@Hyperlink@DirectUI@@2PAUPropertyInfo@2@A
?PositionProp@Progress@DirectUI@@2PAUPropertyInfo@2@A
?CreateInt@Value@DirectUI@@SGPAV12@H@Z
?GetElement@NativeHWNDHost@DirectUI@@QAEPAVElement@2@XZ
?RMLoadCompoundString@@YGIIPA_WIKPB_W@Z
?FindDescendentByClass@Element@DirectUI@@QAEPAV12@PB_W@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?DestroyAll@Element@DirectUI@@QAEJXZ
?UpdateAndGetDesiredSize@Element@DirectUI@@QAE?AUtagSIZE@@HH@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?Navigate@Hyperlink@DirectUI@@2PAEA
?Click@Button@DirectUI@@2PAEA
??1NativeHWNDHost@DirectUI@@UAE@XZ
?OnMessage@NativeHWNDHost@DirectUI@@UAEJIIJAAJ@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?g_hHeap@DirectUI@@3PAXA
?LayoutProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?CreateLayout@Value@DirectUI@@SGPAV12@PAVLayout@2@@Z
?AccessibleProp@Element@DirectUI@@2PAUPropertyInfo@2@A
??0CRMDUIParser@@QAE@XZ

shlwapi

SHGetValueW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ca5cb26c304d9ba14511fa26b260aac

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

e5:02:ba:bd:70:17:95:51:59:c8:cd:36:7c:c7:d0:f5:54:c6:2b:0eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcr80

shell32

ole32

oleaut32

version

uxcore

shlwapi

Sections

.text Size: 97KB - Virtual size: 97KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 32KB - Virtual size: 32KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

e5:02:ba:bd:70:17:95:51:59:c8:cd:36:7c:c7:d0:f5:54:c6:2b:0e
Signer

.text
Size: 97KB - Virtual size: 97KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 32KB - Virtual size: 32KB