Set-up[.]exe | Triage™

resource
Set-up.exe

Set-up.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 c6ef786a64766a67fbff2999dbc014ec4695f939dd8323657690aee558171d2c
MD5 6f184631aaedd004d7a7a110fa98fa18
SHA1 789f82a175342bbb26ecbaa7cf5c426ea3487e05
SHA512 9dcf41699e105ca24f2a8ea69ac9c9cd510bc6a0f7255c3c52dec25c6c0bee2a1bd701788356eb58b1d21c1e6f13a4c9250d48c1dc179195ea61b654baf7d0e2
SSDEEP 24576:nXAJ1L2Y4zOH3Tj96YXhe9q9ZiyfhLmB8mN5Ex8LqejXESafo:wJ1P4SVDy2hSxN508LpjUSOo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Gray.iso

SHA256 f66567fd9661cd5cdd99462d8761c786375704500586dc209a845490f4ba0f68
MD5 40d7c46a3cef4cbc0433d0968beba633
SHA1 dead82fd571a588c947b4a76e58dd2b6312b26ad
SHA512 6ead3991bcfcc0d81ca378e3ff2ae35ad4c79e6d15da7beb336e5cbe3d3a17295bb0481b0e96b9ccab3f0e47da1ce65b6ae4e29d2b1d01423e4a90e3ad0ddfbe
SSDEEP 1536:wMYafjgchu/rKLV9SpMTHns+iUN/Nx5GKRi3kmEIwKcbbJxNLEK:ca7gcIrKLJHnxVn43kmG3ZJ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Livesex.iso

SHA256 d8b77f329fd897d75b99490746c73dc6c9020a62ec448121f06d1d09e483c474
MD5 47e3f2585fea550d56331d32d3eb20d2
SHA1 e3c4c6baa64e5296918da1a98da992572685c6e0
SHA512 abf58dcff8652ea75e8b73f94e441d125e9992c827c6a6daa8b69652ba0d730861c073fd7360db4da439daeb7d4b5aaeeb58bc2d58514e5a447d75d5502d17d1
SSDEEP 1536:7nBZNOxwAAuEdwq9W8lYaqFXBdjFF5zoxKtPD:7nBjOuATEdu8l3qFXBd/5oW
MD5 SHA1 SHA512 SSDEEP

CensusDirections/Determining.iso

SHA256 f0ebbe2bac86c5de9b7d5de6be0f5391fc1d951f189694086808aa6405f35823
MD5 c661457f8fd6300f99f4e7a93bcb7593
SHA1 6dd758f34c2f1f38cbcd94612e616a242256cb34
SHA512 ab197d6ff89de103445e6f3c6d6cbdfd7ba9547fe2883b6ce552e5c8a7428b10479f3e36b422e67f0422b739f1a431ddc7ab91989b4be3dd8e2c97b90a7d2171
SSDEEP 384:BzNvbHecz3mdEzJRxH7NndLaRzBLOcYq7Qjy/kQfX+:BzNvzzWMJXH7TaZBOuSy/kQ2
MD5 SHA1 SHA512 SSDEEP

CensusDirections/Transmission.iso

SHA256 1b79ac6c52180d558317a6d20d07d422d5d85450a6df206918535409a87a5e05
MD5 8e55f857bb0c458c6a6d9f66bc29009d
SHA1 9534c89aa7f452e4d78bbcb6f6fc43c8abdf2a30
SHA512 bfacea1cceeb94b872da1082af9356790590a032798e2d532ef3b2f04e1fafe39d41394e217351af5a02ee5c220d44c55c0cd3bce460be4a2d20856aff216bb1
SSDEEP 1536:eLkmtwUm2WiLo8QESDI15uoCJ8Kz0D46sg3CJYqE4T86XglVLVY:LmtoUaEFWqKzi753jQ
MD5 SHA1 SHA512 SSDEEP

GstMere/Caroline.iso

SHA256 3593fc0bace2c22cf27d72b4ea1c91e96835e41c8382b7c7e9edcecc876bb9be
MD5 dc9fffd450242d4b8df3fb6e9f3b48fc
SHA1 082ec6df24ba2ae3ebc6ca1e66866e678da0bf80
SHA512 e1d37136b4159957a1f6519646206b440d098300d8642c565932ba50babb18474ce86515239808dbf9257847baedc51c3d7676501f9d7ff270cc8418fe48f3e5
SSDEEP 1536:DqowqZvsFLj14CQWVJQPAd7ijmaZia5mvd01eYQK23E0:xB0LdQcJQgGjmapj1eP7n
MD5 SHA1 SHA512 SSDEEP

TalkingBiggest/Replication.iso

SHA256 7f0471302268c05636a3ab9a99e27e1501d2ad0aa6f2e1d4f06a22548e02d824
MD5 19f41b5461dc539caeb293c4485f10e8
SHA1 b30ad447d55f7637dad971f9ee87b316dec12a28
SHA512 72f49af89b5857298525a7f18b705ea64e5904dcb36e54e94410c3cf25a6c87d1822fd62db643ff5c31dfff07902098b32bd3176e49a32f34f58b6ff8477bf22
SSDEEP 1536:CSGFCznPzdz9odWDB7bNlIypQs+K0dY2pfpARtyMuJ4iNwamp8zVHZ7Z:C3FCfdzKcDtI6SdBfMtsJZN1mp2VHZ9
MD5 SHA1 SHA512 SSDEEP

ThreatenedToyota/Counseling.iso

SHA256 9f6b51a7da716e352399ad053d1b49398b5ac31fdd449018cdc41d4a3c9ad50a
MD5 773e4477460688827fb611f82b468d1f
SHA1 1cb9912d8a3499a0c0a17e3fea26d648c5eb175b
SHA512 ac7d9c7c5af96b89e83ea05db5047c4ab8a665cb8f9a9b8ae601e3f495ca565ec265d765308b60ccac2dce1bd16f19f9f512689e0791ba5a4ce70572f25a4eee
SSDEEP 1536:d3nFVxt+jUS2+hDm2BF6gcPiwGuwg1L7Quv0DEu79:dfWUSnJeHPiwNiEm9
MD5 SHA1 SHA512 SSDEEP

ThreatenedToyota/Providers.iso

SHA256 bf59f4cc21f6ed1f779446574e4f14cb724bd96077c7347838ef3c057afcee73
MD5 69febac0219748d2bb93effe6267f442
SHA1 eddd5d4f567758a7ec54f74be8dd4ae91dc4c3a7
SHA512 97b67ceb962c139d9b6188c68afbca08b75a246f66e74819301f554c274e9ab5b2ffdec55de6e45afa25fdbcf3852609770c02a7ad67d8a433359c8b01554a15
SSDEEP 1536:O4VGLwczXZY/71eH6dtFhRCdLsoRxXhqA1eEtLxWl+lgusyQFB8KzKd/jKwZbN:5VGMczXZYheaZhUsuzBeEt1RsjjlKd/N
MD5 SHA1 SHA512 SSDEEP

ThreatenedToyota/Warranties.iso

SHA256 d0ae9550735cf9befa445563846e413e7123bc04f7e4e3a73ee853f3f92f0092
MD5 4c7c9857e8484bc224230e24e4f1f153
SHA1 0c1e24a907360f337319b2ddd1f07692cac89c09
SHA512 0642cce63b3ca7be6f2308e75b01f09593a904fcb1bec59eedede8ad1010c5c02107d5bb991ffe268a0e5a54300d7b9a08fbf885d0cba3bc8e76098ffa9f6bc5
SSDEEP 12288:aR47JJZjaBUS05LgNyYhLmZLMSDpZ6BOTDu+X5Exg7Bs/ix:IsJZ3ZUyYhLm66ZOyL5Exgeqx
MD5 SHA1 SHA512 SSDEEP

Bidding

SHA256 aad31f3cdcd7326f2f0a5220680ce3b009c0dc582ec7232bbed036697a502415
MD5 21c26d2ca292c9fde3f9daa11dbc1ba2
SHA1 5a5ee089f2300417b7bd1076eb233d2d12ae20ba
SHA512 2174a79983481a517e06b2bbdaef7725b17dc3677042a0f2661dfd55ec8ef2978accd7fbf2bacb570014610cf67654d5d9b11de30671c83764c5c2a85bfd84a4
SSDEEP 3072:MR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLO:NCThp6vmVnjphfhnvO5bLO
MD5 SHA1 SHA512 SSDEEP

Bk

SHA256 f8a21bc91cfde4254a5305471705d991e02e7f851f0f107ed5f31d8a895786b4
MD5 ddac075eb3b1027c6797fae2f6faf9a4
SHA1 0dcbc2e9debd3a6071040c2f0601dd94e1a68ea2
SHA512 647641f0dd7de6765bbee1681b006babf956a2d73f1e74501a65271c700c88146b18a574f3b466c1cedca34746b7a31e0768a0293948c4bf3d1170107d71230b
SSDEEP 1536:5Kaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZq:l6whxjgarB/5elDWy4Zq
MD5 SHA1 SHA512 SSDEEP

Broadband

SHA256 fd89d3d7b09f8949bbf58366459bfc4504c462fdba729aa2b67c5e24970ed630
MD5 cd932209f0bdd6f3f35317dde4357ccb
SHA1 fa40f9c32523edd728ed62e57c85dad9ebea314c
SHA512 2d3b9f6618fe12371611ffd1e52e8d66aa7aeecd54b2c039725b4c521b649848afaf1d3fd7c6064b19082d8d6dab3da4cb8a6cca4c0e89117aaef5439f307cae
SSDEEP 1536:IE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUW:DPtCZEMnVIPPBxT/sZydTmRxlHSg
MD5 SHA1 SHA512 SSDEEP

Clip

SHA256 9ae14ed61cb3012111d08f0ed85deed5ed20ccdede9035a39a86f6a7400a8cba
MD5 758893cf0f6ed15e7bfa47d3b45e2b3a
SHA1 e4143559273959cf73670d6bca685b2b4b16dc3c
SHA512 48f753c081fab96e2eb06b0cc435719e8a2415c715a428c3b8031c939baf9df4b4a8fc1ced862b7d29f0b3c7d6edad9168babade51db82400aa690a0b04305aa
SSDEEP 3072:ZzW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBN8:ZzWWt/Dd314V14ZgP0JaAOz04pq
MD5 SHA1 SHA512 SSDEEP

Confidential

SHA256 08b27bcca11a3fe201a481188650286699d0f11ce8b18c6aeceeed6cfe8e2697
MD5 fc2034de0a312b5113b65a5e5f093434
SHA1 90d2c1eaa731843c5e5641a5b1d051f2c767fb5d
SHA512 f38eacb5daf24b8aad5ec555fbbe1b17feaa07475915aede6be602911b1035d673d9b1f25dfa850e9403176f1aa0bd4fffdf4d9e116dc982b4620e6e04e816cd
SSDEEP 768:nbOU7aI4kCD9vmPukxhSaAwuXc/mex/SY:NimuzaAwusP7
MD5 SHA1 SHA512 SSDEEP

Gcc

SHA256 961cc9994cf4544d4f50b5feb11bf7b6c48cd01f719c5f204593c9e08e7af480
MD5 3fb5b10805952f764c5919bdb6ccc5f1
SHA1 776986f0d2ba15780ea0dd6d702b2633fbc268a7
SHA512 96b73396e26dede182dc1f5f3baba5b8224fa52ffb95276909e93793663b5e68c2ab1a717d4ee4c1bc685d2a9893259f3fda23c503ae925b487bfbb9d0751adb
SSDEEP 3072:ENxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBM:EzcNPj0nEo3tb2j6AUkBM
MD5 SHA1 SHA512 SSDEEP

Gg

SHA256 b47110f9f5e1f037f6a3e93a5d8479da49c9aa7a2bfe296f38577d1437a63023
MD5 09205096e116a7919016104f11ce4b10
SHA1 b25c89b3880eb2f581f69704ed9ad6a86d8eb4d9
SHA512 05f49f7fab1cc8ae8fdf33e93e9ace5e56491dad7ee6fd437c824db2011b1084cce0945c9c02081b61668d0e9309d48eda12aebc0129612f11c6f942c9a56751
SSDEEP 1536:EYhWoXElJUzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5Y:EGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf3
MD5 SHA1 SHA512 SSDEEP

Grave

SHA256 746eee8e45eb74bebfef8fddb54024fc8c6032882e5f8f10bb173cbc6768faf3
MD5 2f6ba503b5550d584c94c65cf5c4766a
SHA1 913b122bf1e479ba6ed67db8267ae3dcdecf4de4
SHA512 1834fc8f22be07a2b7da884b75af19285e52ceeb1148dd945923cea361a55773634f0e738aff2e6944fabcb825ec7399e0ed405fa0b5cbf0c3833350b2583f7c
MD5 SHA1 SHA512

Markets

SHA256 15ddfda8c4a67e14d9b2628e9a1985f5c2f5b2f567606010d9ebf570b1e4fb05
MD5 658c3c6a9bd7533c0c5c98cd68ee3db4
SHA1 6275ba9575dd8de71db2f18181769e5e08bbcc50
SHA512 ef55c37b4ea46f53a1b92e114d2533a2435eb4bc4968a799ea13d3add00d4e1a712ebed5ed9e9b309e3d3e0334ec911f45b6ca17ddf5db559a82b17adc716f37
SSDEEP 1536:SG/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8E:lgF4qv+32eOyKODOSpQSAU4CE0Imbi8E
MD5 SHA1 SHA512 SSDEEP

Navigate

SHA256 afb7d228246332f47fb1061e09336d975ccb565c6fb4aded6a01e3015a16bb45
MD5 bdf031d036e66f1ba00c66f5f1a8b7a0
SHA1 d1379e5b95689b342c4894ce2f5c42008e0714b2
SHA512 f0d7d5bd9ea878dc9de5fe113139f4ab8730eb695d24099f738678ca470b2bcdb5d5463215449643bbbec59fa39da703d2d95dcf5e7ad81a907656350728b6ce
SSDEEP 768:1r2+9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:x2+9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Pirates

SHA256 89cc33ea359b9d0b576e7fbc19f1c44b0bc36b7e86a1f08fbd0d17d708bef9b4
MD5 2ab33617fb6cdae3789d585327edb7dc
SHA1 e80726e0f4b9a3645672b638140a87cc6310af5b
SHA512 9dcfa65689a547908625f95d95f26e6295cb86e3eefef23a557108aa7dac4752e28f03286769142046503c7394e167ebde2882e04afd468c4b11527fe6df78dd
SSDEEP 1536:e1/AD1EsdzVXnP94SGGLpRB6M28eFvMV4:eZg5PXPeiR6MKki
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

Set-up.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Gray.iso

$TEMP/Livesex.iso

CensusDirections/Determining.iso

CensusDirections/Transmission.iso

GstMere/Caroline.iso

TalkingBiggest/Replication.iso

ThreatenedToyota/Counseling.iso

ThreatenedToyota/Providers.iso

ThreatenedToyota/Warranties.iso

Bidding

Bk

Broadband

Clip

Confidential

Gcc

Gg

Grave

Markets

Navigate

Pirates