setup[.]exe | Triage™

setup.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 5738fef8f30ca45683d3526e8ded8bb144383523e2259f1c3fc68e4d7480d891
MD5 65c6be8e98d80d3ea1a2075e79b53d9c
SHA1 7a722c2b5ca5cd7104ced4f030071846468a331d
SHA512 5e0782a6adab4e18402a2dc41c4702f7823796c5650327c5d2dc1514eb3eab3e0c16aec9c9fa17a8b2fc95e8693117ff773fefa0e91240e1887a43cbbfd954b8
SSDEEP 24576:y0aOzaxVMy8TQsTtxDI5pbwCXyLHIQ0LmJxCuDtEmwQj5WG/n5Vv:y0z6cQMxSpbhQ0LUCuRrwQ1Z/5l
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a7:55:da:1a:ab:b6:67:9d:27:db:d3:8a:27:89:95:cb:b0:a2:b3:b2:a1:71:fd:ef:6c:42:25:68:c3:6d:91:e2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Xing Wang,O=Xing Wang,L=Shanghai,C=CN,1.2.840.113549.1.9.1=#0c1277786865726540686f746d61696c2e636f6d

Chains

Jun 27, 2025

CN=Xing Wang,O=Xing Wang,L=Shanghai,C=CN,1.2.840.113549.1.9.1=#0c1277786865726540686f746d61696c2e636f6d

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Xing Wang,O=Xing Wang,L=Shanghai,C=CN,1.2.840.113549.1.9.1=#0c1277786865726540686f746d61696c2e636f6d

Serial Number

48:b0:6e:db:11:6d:54:be:21:d5:16:56:d9:1c:f2:46

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2023 - Nov 23, 2026

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/Rs.wbk

SHA256 9a6c9af4b0e0bd330401cc4edccf3de82d56b5a0edb90d09054b9694df30881d
MD5 b399e767750de6aae3fbfb3e6d68bc4a
SHA1 6a82b62b8356e4bfa1ee72a396873554b0923437
SHA512 50967aad234703ad6b7c3f512b36eb7e2d29c55d48fe5798736c298d42a6336914d5b6e61531bf722b64cc31c51b59a144c02d47b4bcc9e1ec325830951304d3
SSDEEP 1536:KNbJdQ0Bp447FaRV8Lt8+KQFDZchT32zb4VCe2R4pzwiyhuSXgMGMijFFx:KhuoL7aJ2PzRykJXQMGMSFFx
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Annually.wbk

SHA256 abe86d64e7f843bf9807b6ca91a977538c4cf03414d05d3a9b39b2926a2b612a
MD5 bbbc01f17cbe73c30ebffa2efa9cbec5
SHA1 a430918aa975968d72755a8eda697c62acbc41d1
SHA512 d000df3c8fec997913a433d67ca9828359739adfbf78dbc57a61004944ecc99a513ce08cb9174ee36ed90c6cc4109119d0381510e7cc457313a2d76193e5deef
SSDEEP 384:cDSto8Ct4MMx0wcaveo62r7VwKuKX+Q65sQTPt/xALVENmPgR2r:cDSS8o4Xcavew7V9VuQq9ylPs2r
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Erp.wbk

SHA256 9190b2a0460b74bdcaeb84a9fa97deae4639e26a40e2079072a4e0aee4253937
MD5 d5547a78f923b94e5d9f1635cc10974f
SHA1 f3f4b52d6513063ca5977ae63b189e969ef3d9f0
SHA512 6621ff038105ea14919a76d9b9b8800f5cf84fac1f885402203f81303fae337520031a0c508f96d56c96a89a9b2ad209449b9e4c318610a223c4c973ea945dce
SSDEEP 1536:vJ2NFCLMSFPtEVZKYd2eogZi1kyl22YD44jwQS79lyPJz:vJ2N5KPAh4tgU141dne9MPJz
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Founded.wbk

SHA256 7110cc78768fd63b2e09c9602e6129e00d675e11bfac46bee1caf0d7ad7cd6ff
MD5 7f5a6b92e57debf983e29b7f81f3c9c7
SHA1 90693721f16a9ac483a3a39729400f1af6a81d42
SHA512 a7016ef2bf3f09a067c039df3e35d092da7e1fcd2a5e69a943c48235f145013ce6a5bb3281af303d0a11ebb746918802d069fd0116f4102a55a5a795d4e62415
SSDEEP 768:LRjSi7NDeX/zNA8/joLNrBjvOAQ6TPBZoICFh8Y2Bly6yup5w3Id+atbcJZoV33y:pSi7NCL6iYO+PBXu8YO58IcaVcJZoF3y
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Gm.wbk

SHA256 5130cb09a890f038cb675711a8cb997c3a66b2265b4e18d147638f427c5408d6
MD5 9be28bef1027523a84a4f9bb97a3cd18
SHA1 ce82b85140a85adf770738ce8ebc1acc3440b6c0
SHA512 91590f8634c9d9e1d6881ecc7016e317939978e5cfdfe2534b498ceb9666fed774e1cf8bfba3678978042f0fbfb79f284ba2b5223d4c7db7eff86224e845a5c1
SSDEEP 1536:YB9G5sUkpdcGX4HuaA9ejEVHWN7J3G3nJVI5g7njOyGCwA:C98sUkAi4HuaAvQBo3nJV1vOyGCwA
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Launched.wbk

SHA256 b46be58beca75779878516087a986b5c9c1bfae000519b9c6e419353993cf73e
MD5 970b12d9de3b6456b47b1fa07f9f47db
SHA1 5521baddeb989873a09500880e53bc91bb7fa1d2
SHA512 e9388fd1dffaf58beceeb4a920e334a9a3d1e504bcddfede05cb514e6de1d55f61d18e9c9a81d0512ab755398678baafe52e50acb417b1a683bfcd9b10c55516
SSDEEP 12288:9bIgIaNynPuYulmw+xoJyriN7ikFo9qFjqwDRCnR:7ePWlQqJyiCUFjqwDRE
MD5 SHA1 SHA512 SSDEEP

Ap

SHA256 b85a8dbac4505618e6f35054321c73a1f24436e8a3578152ed85c4d7cad07ec8
MD5 b804095cdcb415afaee074e98e1706fc
SHA1 370a1158505949e00700480c349d9dba28181f26
SHA512 e2f7659e76d6209edf22de5fd3c9f4602b4a1fd2080b7675f776ee1f60981a05b13333b6a6b0cde2bf2efcc5075d93bc14913cbfd09627d3137450ac3abb1288
SSDEEP 1536:sLmbZzW9FfTubb1/Dde6YF640L6wy4Za9IN3YRYfv2j62SfuVGHj1vtK7h6Rw:sLezW9FfTut/Dde6u640ewy4Za9coRCc
MD5 SHA1 SHA512 SSDEEP

Bondage

SHA256 e0bb528f261ce87ac5e0fc467abf864ddb6c9165b51d1476f6ac16cd07dce112
MD5 b0f95798f8437a5aa762490f771bda6a
SHA1 3dea757bf0d9bb103e973b34cd6302435caed563
SHA512 3b3beb394cfcc7d77d4735012c21da04c0a66d0e2837dbc11c7426a22f3063ec3b21fcd57e7e35834e80136f17a445ed29a150d7ebfee7a55a72233f7d5ce8dd
SSDEEP 3072:RPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+Aqj:RPj0nEo3tb2j6AUkB0CThp6vmj
MD5 SHA1 SHA512 SSDEEP

Decorating

SHA256 76233ee2c5910d6fe816bec81561fee58ace9c442ac203f8183b342e85cee755
MD5 d8c4b30b367d4d5507550626fd3b0703
SHA1 5c77ffbcc68cbdf8a8a5413ef57e453922a4ddc3
SHA512 f3292452013e33e02ccd887f1532be0011e999eb7588ab2e37e66f4e5763c06f38ae0720dec0bc3ebf0225492164a0923aa48510d145f6a23e7e77f06c95cdcf
SSDEEP 768:Uc/mex/SGKAGWRqA60dTcR4qYnGfAHE9M:HPdKaj6iTcPAsM
MD5 SHA1 SHA512 SSDEEP

Enlargement

SHA256 391d22edb252906f805e66b13a8c4acf55e0d4aee7108ba251453be2cf021231
MD5 323bbd5c2f30e702a48de6527aa24ae1
SHA1 dfa5c446829e097392bff98a0b1a6fcc5bbd863b
SHA512 f2aab23e2b18fcdbcef096d38220b28a04b8bb23f10e48521252d23b738d421d923b94c37558da7c65ab3bd7007411b7f2ce9235c18725feeb25e99826ece282
SSDEEP 1536:janHsWccd0vtmgMbFuz08QuklMBNIimuzaAwu4:jQLeAg0Fuz08XvBNbjaAt4
MD5 SHA1 SHA512 SSDEEP

Final

SHA256 552264d69890618b8266fba12edf9e7417fa3c9bae0ef6597e76d9c38b8b55d0
MD5 8a282c493844e9308bb102f3b0d67774
SHA1 845721084330f34c8d7486d3119c972656887458
SHA512 9a9d663afeae78dd91782647cfe9eb1b125da7512d3c57ec08cb871d2816c62895323994f636986c0268c4b654d2235468b9f4dcce40890ac05ce88d9cb3a63d
SSDEEP 3072:0PtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtr:SCOMVIPPL/sZ7HS3zcr
MD5 SHA1 SHA512 SSDEEP

Maritime

SHA256 d53e3ac71f191b113f147b3813cd209db08c853c2c66e5d5c1a617bdfcfdb67a
MD5 a13ab14578c563d93c2fd36ee4f60ae7
SHA1 4941dd77039922bbe0ee580e1ea4405ab631f8b6
SHA512 c0c36a5fae4e655e3d44c0588ebf184a7ae4aa8355e006c605406b0a4e9021b163eafbdeb7e086627fb6b9034d2e000d945b57f31d99ce59af77e891dcfd0575
SSDEEP 3072:QUDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQS8:QUDtf0accB3gBmmLsiS+S8
MD5 SHA1 SHA512 SSDEEP

Merge

SHA256 3b0566685e0f717eb0dcfc7e779550a847783521f04d1fa5981677984d0bfaaf
MD5 584a7f5021ab3cc71330f30771445b39
SHA1 e89473e9669add959e6642aaac7685facb8e5201
SHA512 751aae942c40fb96901a8eabee75aed2732cd675da35777453a9a0272d766bf1a4bc535f8788e0373cfa2b0d11c1d126cd02fe434178526b3cb924d406fef0ae
SSDEEP 1536:4Wyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:4Wy4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Oman

SHA256 bc1f7a1f6876b5abe6365c5cf70476176963e880a9116f73ce7c1aaa190a8e80
MD5 25de37b9e4c47b3dc21b3b148363dc0f
SHA1 bf21daf298c06e3239bcdab324de3541256533d2
SHA512 d5eb607dfa27bcd951ce264648416bafa064f22b29d26f29466cbde6b2173dbee2579e31a4036edb6ebdc89229732a0a2867bba0c5cb1aacee6673057f7e1b24
SSDEEP 3072:0g5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW9:X5vPeDkjGgQaE/l/
MD5 SHA1 SHA512 SSDEEP

Physician

SHA256 5f9c2183cdcf800a30ea749fb82db90d0b089bef1fe2c5a9fd3049b484f25400
MD5 7dc06830662b8e4f3de6589db6948130
SHA1 cedb24529dc4f8ecad823a614126a80f93ff9623
SHA512 76aa6e4fd37ce304bc5c910593be6d8d9abf0e4e09d728b3844508e5466536b69ecd948ac001fcafafd648e3cd111422076a26183af2c96f1ae1718f998165d2
MD5 SHA1 SHA512

Ralph

SHA256 2e68c66c4d9b2af6150a315b46133f2499e44708df0564ce719d90698767aec1
MD5 b828c0b55fbe575c7bff9ed14c4eff0f
SHA1 cd2d206d78f9dabf63546faef3d9974776de49e0
SHA512 6296fb5874cbef226881a657d15af1efb82a216e75b17bfafe055e9293e6fe41a1479c32c986126fd82386d52d966ab58a887de01e5afd159a3e7d5af974476c
SSDEEP 1536:+ynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoMmOrrHL/uDoiouK+r5U:xnBypIbv18mLthfhnueoMmOqDoioO5U
MD5 SHA1 SHA512 SSDEEP

Sophisticated

SHA256 42d952dea0f20c3ebe9fb1d033f38795885359fc109d95b824a37ba759054df0
MD5 2a684a205aae6534ee8e6e6354dcbdd1
SHA1 2dc323817f57c35b63d085ffa83f01d4afda30d3
SHA512 4e86c79b3978bff5a0d7fb94201187de41fd42991bde15f3c696cbdf9a1996340100446ad466bb7263593d660ac908d1f96ba4f28fa4769bbc144c616fc57b19
SSDEEP 384:dUsOBIx5MOULtVJBCQs1xaJ3WMygaruSIKlcQljLWWel319stEjFtr+/hdvEK:dUsFxyLtVSQsbZgar3R/OWel3EYr8qK
MD5 SHA1 SHA512 SSDEEP

Trees

SHA256 d31559c9951fca6fe84cd325da53bd1b2169cb79256b46c13a7eee94d0389eef
MD5 553f4f187f0229689a28887aa8bdd204
SHA1 4ef7edfda193393c03086f257103a058ee9bb34d
SHA512 ac9071fa19d739abf54fea7afa4f1d89f78608ff0d7675d2831bf8404426c7129d2f108f8187be6fdf1d49517b5d1952427703a7d295eb248b37eff219a177f8
SSDEEP 768:GVXnQkdFLILu8rbPDmhdimkIXqURPN2mldrfa04VQv7Qf0VosQE7YmFdni8yDJ6h:i+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVT
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Shift.wbk

SHA256 342e83217da8a8223ca5be7ccbf4c531de0e60915f25df6c75382fb1953d6ab5
MD5 534bb724670aff06319d0b342672b15f
SHA1 2872dd04952d5fa40f8e2cd62082c79d06d67a9a
SHA512 796b9386a21a30eaddbd6103a8859e885d8462e089d5a51ad54982351e311305beca49f6a1e73be9350c5d98d65db71e18a700767d6032020b33ddeaaaea97da
SSDEEP 1536:Xwp7duI0+B5cuQZ2nxUOyphY9bm7WPUw978rIkVtQSUqlKPcn8H:AZdu+Dc/gxvssbm7WL97GTIqi
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Subdivision.wbk

SHA256 8ec0a6577c7205b6d36e5fcb9317c12703766c4dd98040eb44fe2f92cf86fc44
MD5 3f64b5893cae5ce3f1881efe617724c0
SHA1 6499b82b0d787a489eda18014133e4090d3853ee
SHA512 192f199cab1c7792e88ec57764287fae1b0fe207e80201300ec96031702e6eda77c15f8c71d7b6ec816c8d611119ad6c08d0dc8a4d5936d26a1dedf71e33edaf
SSDEEP 768:aLS4p6ZVyCtwVOOW2Knpb0rSYyucctrsQ1LGep5QLoKarPHNI34pk+pBQgLR:a24EZVnKOvBTNucctrsQ1LGqQRamrgF
MD5 SHA1 SHA512 SSDEEP

HrefOrientation/Surveillance.wbk

SHA256 341a5ce2b2b17ce4fdd13174f9b1d8dbce8be443690fe10a6c74f80fcb3d259d
MD5 afc001e5ad84bbd0655534f005c112c5
SHA1 408d41e7f7760a2fee89204cacaf9da7e84cd459
SHA512 d8da712ed98df8e321be201e6f72079cd73d735447e1b19b7706b23df81fbec8e0e8b22eccdab630b4a06b1267881f26f4e7c4cac32fbef5c7b961e5c17ad3f1
SSDEEP 1536:UcVnF3wngvyUq7MGc738LDy9AjHyipcrCnTp4v:xVFfW7i73wy9ElTmv
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Rs.wbk

HrefOrientation/Annually.wbk

HrefOrientation/Erp.wbk

HrefOrientation/Founded.wbk

HrefOrientation/Gm.wbk

HrefOrientation/Launched.wbk

Ap

Bondage

Decorating

Enlargement

Final

Maritime

Merge

Oman

Physician

Ralph

Sophisticated

Trees

HrefOrientation/Shift.wbk

HrefOrientation/Subdivision.wbk

HrefOrientation/Surveillance.wbk