SET_UP[.]exe | Triage™

SET_UP.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 7feb04dd3086c567c461e43a682dd1bfdf1cde3c8f37338a87656fc81a23ba5d
MD5 3d7985d235dddd50133c9cb4d05e93cf
SHA1 f4760735fac36ee4453905208ee47589526a30c7
SHA512 be25290b5854a81f9b6a14dbdcf87dec08e8b569c65f48fcbca368875a09d95a25513e48597b0b85fc01947dc5993124ae3e52bb0970b9f3d377b7dcf11a1857
SSDEEP 24576:meXBEktOUHeuxZtAmTdNJDfbKs2h1D1riC2x8ev:Tt7TmmTd/fWv1rRaPv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

e9:5b:95:04:98:9c:9a:72:78:c3:86:0c:24:dc:7e:3f:9a:e4:8e:42:41:f8:ee:0b:d6:6d:fd:8b:e6:46:ea:07

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Oct 23, 2024

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

1b:b7:e8:d5:a9:4c:d1:f9:67:cc:bf:77:52:7e:53:bc:2e:f4:84:d9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Oct 23, 2024

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

06:66:77:31:d4:0e:82:68:d0:8c:00:64:3c:7b:ec:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2022 - Jun 24, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

06:66:77:31:d4:0e:82:68:d0:8c:00:64:3c:7b:ec:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2022 - Jun 24, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

.data

SHA256 c56f910b6057a45fbe5062083358ecddf9e603cdb2f2152a95fe80bdc22a4461
MD5 77f0839f8ebea31040e462523e1c770e
SHA1 14806c91c6a06fe4fcb02a8a823ae334457cbdb6
SHA512 1d189125d7bd76d44b169e0885d514f99472c36ca6ceaaa8948bd54861c524b65df00a1cd25d24f7376c0aa4405cc2c139b01d71f6c7633a9218de9760d7892c
MD5 SHA1 SHA512

.rdata

SHA256 05ee265c710ebb6c1280fccc249bbbacf24097d01bc4f9621c554726a40742f3
MD5 cca1ca3fbf99570f6de9b43ce767f368
SHA1 63635b36bd655a189c82d2a8b32e42aa99f985de
SHA512 c0e0c39a80eaa282a5effe0aa76441c7740129024a13dc198ec0d79744a94b82e3f064d63a9e551152c404b592effe3fa3a2cec4da12a9a912137585fbf4a832
SSDEEP 192:xBR1IorPNhxjQFOEopX7Bq343py7JRWVS7yWymPn:HRiaPblQFKnq343pwrWVaymPn
MD5 SHA1 SHA512 SSDEEP

.reloc

SHA256 357de15bae75e04c9adcc68da0f7a11995768c69d2d5ba349c83ed864a22cd66
MD5 d67878c794486f9b40f5900a768f5afa
SHA1 0c335c2431992446508f2f698c41c0c8f06ef91e
SHA512 2f63ef43496951d2371c5ce386a5fff5826526a9bef51da11e5ff5bbf3b6ccc0de9499836c6184485fb2beefd68e26b01da7a4d734dd5c1f6f577878ee4d4278
MD5 SHA1 SHA512

.rsrc/DIALOG/105

SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96
MD5 3409f314895161597f3c395cc5f65525
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b
SHA512 f3e7394fa49325a7ea46728b77a5e819e18d63049d54c6adf36d08619709484f8bbd20206416d3c1440bd70632d99d9a45f3488482353f90aa21aa6ee3915427
MD5 SHA1 SHA512

.rsrc/DIALOG/106

SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729
MD5 2d12c45dc2c029044aaff357141cb900
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b
SHA512 a50dcf605a914f0a6f94b3f815be159c2b729d005a25d6cc9120c4d34445cae2d0b20df3dbdc7672f316010c6a47079265548a1ed5a523896963b1a3ddf98a17
MD5 SHA1 SHA512

.rsrc/DIALOG/111

SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0
MD5 6be4e1387d369cf86e68eacbdd0e81dd
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17
SHA512 b81b287de73282cc5a7337559fbce5af01d1a440f04ee97c6a8e1de0c787ef38936c951b802014b841fc517fe7f2b916266dc8c35cd5de1ad0c630dc2218fa81
MD5 SHA1 SHA512

.rsrc/GROUP_ICON/103

SHA256 efb681dfa0d9c289a8b4c3852c27e03f016443d36c653a88b535f794fd41bdfc
MD5 db6a8edee7e235adc2a23e87e2c08d99
SHA1 9e17b208872ee53cfb3b0f3970060031e94a5fa1
SHA512 691f482e304dcd5fe6d47260a4e674786d092cbfee5053240721f663ef95e10e2348feeb3292735dcaf84f9a67dfa1ef0c975559930faf2b5607d8a8cb711ce9
MD5 SHA1 SHA512

.rsrc/ICON/1

SHA256 942cb853db9ed5907c485b0e0529245307fa79557f267419053ca83df0cec8e1
MD5 67434deed07e62fcec8ab15faad7bc8d
SHA1 53d03d80956720bb38edf9f42b4364ee208b510c
SHA512 32d213f507e497d30b0828fd4f4693e49bb7c495a861c3e02ef0dc0648f46d0ecaa968514de7fe050599fb66b38c180a3377bcccacd927b9c36e285c9e42bd27
SSDEEP 192:4qePV9eYrSX9166jDKLmRC1rVicZ9DYEtU2ED7MHT/F2YfmMNO16TGafbjXCET5Q:6PDeYcUYKKoVicZdptDED78TEMtfn1TO
MD5 SHA1 SHA512 SSDEEP

.rsrc/ICON/2.ico

SHA256 d75464cb12b3fdf91b73db8499fe0e0fb504fcb83494598380d8c7fd9eedaf51
MD5 787dc60776550a31db90d311b3f4bec5
SHA1 d1bc182ffe6b25649123516c81343ab80321ae15
SHA512 69bb028a10d87387745b775b9a453c250933a2e5e561832bca07189c5f68bfa659202431600da88217efc99ee82497240adb0e389c9c96ae4d4c32d99952b67f
SSDEEP 192:98JKcidDTqwRJSUOCTDoP8wn1XaFSyI3w2E3SP7:9fciYpUO+DoPVA2E3SP
MD5 SHA1 SHA512 SSDEEP

.rsrc/MANIFEST/1

SHA256 46e35d3bb4e0d1dd59f3321fa8b908e7202b9bdf70151f941d58f9bee9c0ba67
MD5 8ac7761540a25f0e446671e95051ad9d
SHA1 dc2cbe444228a356272452dcda6a5f4f58bec4f7
SHA512 7375e939af102200af9facde9a02296f074f06ca0e155b763f51f0bf0c41b66140d6eceaf720194650cb3bd4e5376d94a36bc9fc42fccdb1942894b9d13a1a93
MD5 SHA1 SHA512

.text

SHA256 97e6da0d74b3c02e39efeb02c6f019b353e9891a3ea453f2fa0ecca3c3e526e2
MD5 419d4e1be1ac35a5db9c47f553b27cea
SHA1 81b88fd425125756d41fada07ae1534b10c43c01
SHA512 17fea0a8c963ec9a6bdc562de750a4f8f527f2555f02d9df88b4e9ad41bdbd7fc37c0a303562f4834c195b485cc61284b6e19723bb376c23e08642884b70c121
SSDEEP 768:JsGPXyrvq/Sb6LbQ7eM468vxRu1rnd6ffMmKZS/5hK9G3/2o9+4gn:WGarUa6LowvuhdNYh2Gf9rg
MD5 SHA1 SHA512 SSDEEP

CERTIFICATE

SHA256 f8b83d785245b8e9368052a29894e3b7ec5e5c9ab1238cca34dbe9ef30b4c3f3
MD5 184cd519dc111d70d96b2a9804d8f1f0
SHA1 c47a4024e18bc74e8f488c628bdb2e7f9e068968
SHA512 e8a25acaa0f2e93f681f61d5eb49dc282428ecbbdf62b8155425a3d9947118e3964ec7d2547b0ed5e6d43dd9fb49ecdd6a2285e136da4a1eb250ebb66887a43c
SSDEEP 384:3Nyb8E9VF6IYijSJIV2vT7iYkvYFQH5xIYilvT7iYEvb5SJIVE8E9VF0NySI3:7EpYi6BvT7iLv4QHYYilvT7ijvU2EV3
MD5 SHA1 SHA512 SSDEEP

[0]

SHA256 65af7b430d580514205c0f6a8ee051a2026f25cfe1a72ecc063f3d9eea96b36f
MD5 059d69bfce8a5a02a44dc984e6b7c4cc
SHA1 ea2ecdd9709df9eb110ca06fe44cd24b55e4fb97
SHA512 a27a6a312243ee3aa93644f5fb6956ce8e071e5e99f6e00ad39b0b2f2f627bf83974515a9622068d4ddb978a7c9f628d1ef76aaa7e2bac132d48776397c847c2
MD5 SHA1 SHA512

[1]

SHA256 b86cd385c4da52688958f3d24141605bc0dff4828cb3cb113bd94d0caee2f92c
MD5 7f84016110bb08cddd8788073407d715
SHA1 eaf707f06010858adbe0fea3ee8957b86abbac2e
SHA512 41da1dcddc01478418478557262fa5a3e93ea8b6df179b76adbd69636e0c37093e763b99c657c8f6551a40402834bf8c1e4b7c96fc4c086bd568667a4382512f
SSDEEP 24576:lBEktOUHeuxZtAmTdNJDfbKs2h1D1riC2x8eV:lt7TmmTd/fWv1rRaPV
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

SET_UP.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

.data

.rdata

.reloc

.rsrc/DIALOG/105

.rsrc/DIALOG/106

.rsrc/DIALOG/111

.rsrc/GROUP_ICON/103

.rsrc/ICON/1

.rsrc/ICON/2.ico

.rsrc/MANIFEST/1

.text

CERTIFICATE

[0]

[1]