Setuper_25[.]01[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Setuper_25.01.exe
Size

67.7MB
MD5

626f51544f775502a39adc747c31032c
SHA1

b4b66766714ab53be82143ab81424b98a8cbac64
SHA256

35d601f9d756bcc17a3b1311306eac3bf859c891feca5a218fdf220dcdc643ff
SHA512

6871ee61a12d692bd535125cdb101f1b8265e7707083070e29c189c69cdccc238c8659deb3995e4245bd1000bf9995caa783443102ffd7bc2754d8c70f5313e0
SSDEEP

393216:87eLd/nhouIETpkFh8KbodSLFBJbHRlLieEY9qIjAgOWT2ZR0HYaqz1T67bGjeBm:LLd/WbbMWlLi6TjD4FeBgriZApI/Bi

Score

1^/10

Malware Config

Signatures

Files

Setuper_25.01.exe
.exe windows:6 windows x64 arch:x64

5944ab057b9b206ecba6b88e0f8d8809

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bc:9e:64:8b:50:dd:b3:39:0a:8a:8a
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26-09-2024 12:37

Not After

27-09-2025 12:37

Subject

SERIALNUMBER=0119896,CN=UTILITY ACCESS (SMC-PRIVATE) LIMITED,O=UTILITY ACCESS (SMC-PRIVATE) LIMITED,L=Multan,ST=Punjab,C=PK,1.2.840.113549.1.9.1=#0c12666d37363039383440676d61696c2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#1302504b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

26-09-2024 00:00

Not After

25-11-2035 23:59

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:8f:94:37:71:83:02:53:b0:2c:22:eb:a7:86:8b:30:65:4e:79:8b:e6:6b:d8:e4:a4:c2:38:6c:ff:65:8f:c6
Signer

Actual PE Digest

34:8f:94:37:71:83:02:53:b0:2c:22:eb:a7:86:8b:30:65:4e:79:8b:e6:6b:d8:e4:a4:c2:38:6c:ff:65:8f:c6

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

Imports

kernel32

RaiseException
FreeLibrary
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
MultiByteToWideChar
GetTickCount
FlushInstructionCache
QueryPerformanceFrequency
QueryPerformanceCounter
RtlLookupFunctionEntry
LocateXStateFeature
RtlDeleteFunctionTable
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
GetTickCount64
DuplicateHandle
VerSetConditionMask
VerifyVersionInfoW
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
GetCurrentThreadId
TlsAlloc
GetCurrentThread
CreateThread
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
WriteFile
GetStdHandle
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetCurrentProcessId
InterlockedPopEntrySList
GetModuleHandleW
ExitProcess
Sleep
CreateMemoryResourceNotification
VirtualAlloc
VirtualFree
VirtualProtect
SleepEx
SwitchToThread
SuspendThread
ResumeThread
InitializeContext
SetXStateFeaturesMask
RtlRestoreContext
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ReadFile
GetFileSize
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
SetEvent
ResetEvent
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
CopyContext
WerRegisterRuntimeExceptionModule
RtlInstallFunctionTableCallback
GetSystemDefaultLCID
CloseHandle
RtlUnwind
GetCurrentProcessorNumberEx
FreeEnvironmentStringsW
GetActiveProcessorGroupCount
GetSystemTimeAsFileTime
GetSystemTime
GetEnvironmentStringsW
CreateDirectoryW
GetFileSizeEx
FindFirstFileExW
GetFullPathNameW
FindNextFileW
GetFinalPathNameByHandleW
GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
GetCurrentDirectoryW
WriteConsoleW
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
RemoveDirectoryW
CreateActCtxW
ActivateActCtx
FindResourceW
GetWindowsDirectoryW
LoadLibraryExA
GetACP
LCMapStringEx
FormatMessageW
LocalFree
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
GetThreadGroupAffinity
GetProcessGroupAffinity
GetProcessAffinityMask
QueryInformationJobObject
HeapAlloc
HeapFree
HeapCreate
GetProcessHeap
HeapDestroy
SetConsoleCtrlHandler
GetLocaleInfoEx
GetUserDefaultLocaleName
CreateProcessW
GetCPInfo
RtlAddFunctionTable
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
OpenEventW
ReleaseMutex
ExitThread
CreateMutexW
HeapReAlloc
CreateSemaphoreExW
ReleaseSemaphore
OutputDebugStringA
SetFilePointer
QueryThreadCycleTime
GetNumaHighestNodeNumber
TlsSetValue
TlsGetValue
GetSystemInfo
GetCurrentProcess
OutputDebugStringW
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
GetProcAddress
GetModuleHandleExW
SetThreadErrorMode
FlushProcessWriteBuffers
SetLastError
DebugBreak
GetLastError
WaitForSingleObject
SetThreadAffinityMask
SetThreadIdealProcessorEx
GetUserDefaultLCID
WideCharToMultiByte
DecodePointer
InitializeCriticalSectionEx
GetStringTypeW
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
GetLargePageMinimum
IsProcessInJob
K32GetProcessMemoryInfo
GetLogicalProcessorInformation
GlobalMemoryStatusEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlVirtualUnwind
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
GetExitCodeThread
TryAcquireSRWLockExclusive
CreateFileMappingA

advapi32

AdjustTokenPrivileges
SetKernelObjectSecurity
RegQueryValueExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
RegOpenKeyExW
RegGetValueW
EventRegister
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
LookupPrivilegeValueW

ole32

CoTaskMemFree
CoInitializeEx
CoGetMarshalSizeMax
CoMarshalInterface
CoUnmarshalInterface
CoReleaseMarshalData
CoGetContextToken
CoGetClassObject
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoRevokeInitializeSpy
CoTaskMemAlloc
CoGetObjectContext
CoCreateGuid
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CLSIDFromProgID

oleaut32

SysFreeString
GetErrorInfo
SetErrorInfo
SysStringLen
CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetElemsize
SafeArrayAllocData
SafeArraySetRecordInfo
GetRecordInfoFromTypeInfo
SafeArrayAllocDescriptorEx
VarCyFromDec
SysAllocString
VariantInit
VariantClear
SysAllocStringLen
VariantChangeType
SafeArrayGetVartype
LoadTypeLibEx
QueryPathOfRegTypeLi
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetDim

user32

MessageBoxW
LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

wcsncat_s
strncat_s
strncmp
strcmp
_wcsnicmp
strlen
isupper
wcscpy_s
wcsncpy_s
_wcsdup
_wcsicmp
strcpy_s
islower
strcat_s
strncpy_s
iswspace
wcsncmp
iswascii
tolower
__strncnt
toupper
_strnicmp
iswupper
towlower
isalpha
isdigit
isspace
_stricmp
towupper
strncpy
_strdup
strtok_s
strnlen
wcsnlen
wcscat_s

api-ms-win-crt-stdio-l1-1-0

setvbuf
__stdio_common_vswprintf
_wfsopen
__stdio_common_vsscanf
fgets
_wfopen
fclose
fputwc
__stdio_common_vfwprintf
fwrite
__stdio_common_vsnprintf_s
fopen
__stdio_common_vfprintf
fputc
fgetc
fgetpos
ungetc
__stdio_common_vsprintf_s
__acrt_iob_func
fflush
fsetpos
__stdio_common_vsnwprintf_s
_set_fmode
fputs
fread
ftell
fseek
_setmode
_dup
_fileno
_flushall
_fseeki64
_get_stream_buffer_pointers
__p__commode

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_wide_environment
_errno
_initialize_wide_environment
_configure_wide_argv
_set_app_type
terminate
_beginthreadex
_seh_filter_exe
_cexit
_exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_wcserror_s
abort
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
exit
_controlfp_s

api-ms-win-crt-convert-l1-1-0

_wtoi
_atoi64
atol
_ltow_s
_wcstoui64
wcstoul
strtoull
strtoul

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
_aligned_free
realloc
calloc
free
_aligned_malloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

tan
expf
exp
tanf
coshf
cosh
cosf
cos
floor
floorf
fma
fmaf
fmod
ceilf
log
log10
asinhf
modff
atanhf
cbrtf
acoshf
modf
atanh
acosh
cbrt
asinh
ceil
log10f
log2
log2f
_fdopen
logf
pow
powf
copysign
copysignf
ilogbf
trunc
truncf
roundf
sin
sinf
atanf
atan2f
sinh
acos
acosf
asin
sinhf
sqrt
tanh
asinf
sqrtf
__setusermatherr
round
atan
atan2
fmodf
tanhf

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s
wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_unlock_locales
___lc_locale_name_func
_free_locale
__pctype_func
setlocale
_lock_locales
___lc_codepage_func
___mb_cur_max_func
_create_locale

api-ms-win-crt-filesystem-l1-1-0

_wrename
_unlock_file
_wremove
_lock_file

Exports

Exports

CLRJitAttachState
DotNetRuntimeContractDescriptor
DotNetRuntimeInfo
MetaDataGetDispenser
g_CLREngineMetrics
g_dacTable

Sections

.text
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CLR_UEF
Size: 512B - Virtual size: 215B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 227KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Section
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5944ab057b9b206ecba6b88e0f8d8809

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

46:bc:9e:64:8b:50:dd:b3:39:0a:8a:8aCertificate

Extended Key Usages

Key Usages

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

34:8f:94:37:71:83:02:53:b0:2c:22:eb:a7:86:8b:30:65:4e:79:8b:e6:6b:d8:e4:a4:c2:38:6c:ff:65:8f:c6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 6.3MB - Virtual size: 6.3MB

.CLR_UEF Size: 512B - Virtual size: 215B

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 19KB - Virtual size: 100KB

.pdata Size: 227KB - Virtual size: 227KB

.didat Size: 512B - Virtual size: 56B

Section Size: 512B - Virtual size: 8B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 31KB - Virtual size: 30KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

46:bc:9e:64:8b:50:dd:b3:39:0a:8a:8a
Certificate

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

34:8f:94:37:71:83:02:53:b0:2c:22:eb:a7:86:8b:30:65:4e:79:8b:e6:6b:d8:e4:a4:c2:38:6c:ff:65:8f:c6
Signer

.text
Size: 6.3MB - Virtual size: 6.3MB

.CLR_UEF
Size: 512B - Virtual size: 215B

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 19KB - Virtual size: 100KB

.pdata
Size: 227KB - Virtual size: 227KB

.didat
Size: 512B - Virtual size: 56B

Section
Size: 512B - Virtual size: 8B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 31KB - Virtual size: 30KB