setup[.]exe | Triage™

resource
setup.exe
unpack001/$PLUGINSDIR/nsExec.dll

setup.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 dd5691dd8c38d6c0d5958373603fffc3e0bec43b279f1a49154ba0dec3d5deee
MD5 b784eaba119c0fc6ad65c71b2bf43faa
SHA1 7efb03a39f7e71fd968d7153178fd24bb2900459
SHA512 223605fd28cad88da31fb493b07f33d63b49866b6571c8c3c276fa9ca4eb86e5adc413a074dd337e2943d58a1e9d56b313d19265aed1f31f91ff086ac0ea86b4
SSDEEP 24576:X0a5/Vlizg4zL7rwU/bwPYUCLiB1ypyrXcQ94lSQ8xb:X7VtUj/kPF3mQWlOxb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

RegisteredCosmetic/Apparent.mov

SHA256 b0ef944bbd50bb0e894615e48f9260ee41fa84946bf98146e46edfebe2373c95
MD5 e6205f1c406946ddadbe72667d054911
SHA1 b7812d0157189a4ba15300a295c7414a743e91d7
SHA512 b15c46028319f4e1020ad9f510c5eb21d35614d00d9494871693f6e8225b817c7691c05d9474d877542505ba8b15090490e316be86b630ac10db021e1540eae9
SSDEEP 3072:Hz4qubhRKSZzMeL4CImcUOvVrQkkbaeutOam7y:Hz2OGNIfHVaLutOXO
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Composer.mov

SHA256 ec7f35db62b8d33eeb4145e8f9bdeb5c3103850b33cb93c91e895f13bfd955a4
MD5 5d4e799bf65cf624e91331930d871a40
SHA1 50ae9c84baed311154f6862cfd1ca2c3f9fdd4e0
SHA512 963e4031a1d56ccd21482ca55551af7840a254b3548b1831d2a6e01dac663c91ceb2224e682d8a30f0438cfe8a52b554c52af5aec942e36f7d5a7c9e879979d4
SSDEEP 1536:ZNaE4NHF+Y17nIvHqsztfxU3La6KWD2Jvtz0116hak93VCZ/QBiZHWF/EL1+:P4NHgybIvqs1xU7qDtoWh/93+/8eH8aM
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Director.mov

SHA256 6655f9bda4fc52877ea5e8a02f6ada1cec97fe640e4c969182864d20f4aca30d
MD5 8089958a7dc5915eccdddddb90295799
SHA1 d7e84690ce4fcd0af06e67f50c35ee9307ecd93a
SHA512 4e5f79f6690a812d1d9351f526bbb3df78207b15aa8bc110d667df9934ce5d1d1bd820ac343b88c8f86691ddd07de2c3c815fa15d11c317097b47ea28467fefd
SSDEEP 1536:iAtiCmoDbnB8Z3JGHDpQbgUdg7Gy33Rayx+FSt5GJ1UJArlPM:btBnB8KD2O7GoRayIFSCrWA5M
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Editorial.mov

SHA256 987022fd3125aae480c13e04c97ffb8bffe8826c3c49d29ce067500e26a077c2
MD5 23d72d4e2446e6b5245e1761f85364b8
SHA1 283731f0b9dbeb9a5038395209982f8969eaa60c
SHA512 b93573bb7eb1d6385f727fdafde165be1e399cfe2a9ba0c507967200c48ca2d7dd9386123a10fb476add0eef6d5611b615d679e85c72cdffd14f668c38dcdd14
SSDEEP 12288:+ZjnJrkZNxYbDZjhJB8q9I69m7d8N7yqm4ekyCP85FDBKL755Vs:+ZFsNQ7JB8om7d8N7kDvCPAFUN5Vs
MD5 SHA1 SHA512 SSDEEP

Assist

SHA256 d4b2e6ca2503aba30f7f27d6d4d390bb8d3b2dea32989aba6cd24c86a2be062a
MD5 892789c04cfca168a1420c9d94184ac7
SHA1 36b5e778ce574085d2a2046ada7398beb827e027
SHA512 dc1e02e754a364e95626342594f15d277c261a2fa90880301d90a153664ea421cf5ce6fcd487c382b97c5502eb9790d1a2fca5c91edd88ee35db4c665db61e04
MD5 SHA1 SHA512

Enb

SHA256 ce37a8d712c34a7edec0a37c2fa30c7fb926367fe740e676f9ed759edbf2230f
MD5 41bbd90a4b161c8a500bd84318ab611b
SHA1 d456ea8293148ac747b0f3e33e7dfb277a070d31
SHA512 2ff5ff800e6eb963904015ec52d0bf09807aa4356b23a68f0eaa8645fbed36d0d5fe6d1ae5a4e471431bc5978edd492a2decec2886c897640710da27a9621444
SSDEEP 1536:BCfVYvLutohx6a+A3MDS661CZxbxY/jJHcUoNghw:BSVYvlhx6vA3MD8jjJ8lghw
MD5 SHA1 SHA512 SSDEEP

Government

SHA256 57f85e812426964a351942a91bed25b841ac65613784e3eaf31ef439b0b7c2f4
MD5 0888b214b2d47efbee0f7143f49a86a5
SHA1 d6bd8036372f733e167bdd93b70db3e977ee162d
SHA512 50b031c4b6b0ceb7b150d76ea954a7fe3f3c8807834ddceb2f89c2dc59b1e8e2f3ee24be5d94d1b6c97887465aba51352eef790697b33cf2cc0e3541c7a9c2c7
SSDEEP 1536:DYwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpB:DeVzOqD1IGut
MD5 SHA1 SHA512 SSDEEP

Honest

SHA256 d9e737bb1c226d1e1dffb8ff6788ab7efa243986f7d9e9b64cf25d97827761f9
MD5 188e9da35c01467cf65ee90751c10939
SHA1 ca2ef7e6db11da2c241abf31ee51622be0a0bfc6
SHA512 4ce6346eb3053c1e113266b77e878ea7502ded0e8c5f7450f2f05d009e87f1f56e802e534b959dfe5872120120d4f976530b8e582dc6ce52a2a784fdd16416bf
SSDEEP 1536:vqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsESNvmtpAi6B:vOXT/CfXib+tSijpcVMFXD5ypAT
MD5 SHA1 SHA512 SSDEEP

Jet

SHA256 d41db972ece4cb84e21068ad58d3d39545d2d8e586eb31269e982a3f6157bfc5
MD5 77d941b955f76404c2cf87feda10d716
SHA1 f08f230c89301611b68e1c83f6498a692bfffa5e
SHA512 3937a0f25454aa52c2df1df97bc735532b473b1fec386643394c90a05cee8eb403294cdda347ad80303a074d0e6b450c34e45f96529ad675839df0022d0973bc
SSDEEP 1536:zvAeInT3VCLIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5VqX25G5ClCQEiV2XaRodwTVY:zoegz8StjOrOJGGMBwvqXQGYlawG
MD5 SHA1 SHA512 SSDEEP

Neither

SHA256 bc5745510a605bf5d57cf32458f99edc3b02bcded7f7ce67aff66f0bdca80e4d
MD5 4868eddb9a5c1d9e8860038749787e56
SHA1 41fb94b1710280a61615f032f1fdb131f0e0ea08
SHA512 c5b4ab82cd25b3e932ea0171b3aff02b245cb9c64532ab82f3d59fa31a7018e97215c10bdfb06b24ce41d9996c59d3d3f23771e815be2f66d5071f205e818182
SSDEEP 1536:AeqSkV4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsc8MJ:AzJi2ubSW4wC2mYR+HUD/
MD5 SHA1 SHA512 SSDEEP

Productions

SHA256 f30b544e8d6e09c932daca7eaba1b8b5fc060fcbe4ce11bd12939fef13e213b7
MD5 9afc7c2b0c79f44af9f4342c23f0239b
SHA1 3872c3ee2ced609edd5c916b6d7ae2ffc174d645
SHA512 15f071cf9b0f5c170691a35c884d2ffaecc1ba821a09c56d1a011f4a197a0c4bdb04ec9afdbcdf9e2f6726308a5d2d351333f11d2ba4190ee0a81e8145741947
SSDEEP 1536:79XonOM4O7tiC9jC0O2i94rqWJNm4Ql0/YUdzPrCtTRV5H4K:7BonasL9jC0O2iSW4QlXUxPrCtTRVB4K
MD5 SHA1 SHA512 SSDEEP

Suggestion

SHA256 1a22b337b32070d5ed1bcb116d3a68cb32953c9e20fd68019339f41b827870f4
MD5 0c7bd782cc73f57cb2572eab787b5573
SHA1 3b4a2aa9445554456fd67b396d05bc1e455f5f06
SHA512 2ee1fe9cf0ad8aa633f1387d785fd962503cb93b860ade52a9f2e79bd1bb2eabd6393e4826cf2ff20a73c818470e6be145e88b9b2195d0edc6452f8d401c55a3
SSDEEP 1536:R0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:pZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Terminology

SHA256 371c4404cabee3c24899cbf0cf3611139f25082432c5b0fa02f386646134055b
MD5 bfe1ac0072205f4bcafecedb96d726ad
SHA1 b88d4f4baf5d62bca6467901f3aae4f469fa1650
SHA512 15d444288c7d410f7a8504a12d2e40ce4615b379e3f82d8fd315e72cda48301f2d38ee397ea6f7a0fad26a291e25039436e90a6a012f0d07a060fff589242147
SSDEEP 3072:J3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3vaAt+1K:J3IW5Iuh0AOz04p1ds1K
MD5 SHA1 SHA512 SSDEEP

Vary

SHA256 81b7035e7457c281b4f64bd41283fa431fa70dec896933b139142ad0e7d95c30
MD5 281512d6a1e2206eeb2cf484a0ea43e5
SHA1 6e105c750450c1ba69c6873c9f23614eaa18b869
SHA512 dad370d928d30e31158432d800711e59ea4d960a77096f09cde1a929d8416ea685e69efa63730406a980e41ba7171716210c70557d90a103675b702716202795
SSDEEP 3072:9pMgKYbwR5Exe2/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8x6:9fwc7/RTggXuN2KFIyt+8w
MD5 SHA1 SHA512 SSDEEP

Voyuer

SHA256 dcfe7194b14098edac00a33c935731b4a2368c68c96872c7961b48c41dcb1a01
MD5 092b36a35a2007ab1a916e78a99c7d93
SHA1 9351a0119669afdbb6d6e72eecc0988ae7e41c93
SHA512 2ee6237b6f83f48a61718e229b01abe5b66c569bc5bf47628fbdb70b42ba3648fca7ab4f9e9cc62cdc2be546b76df64121a9f7905c3140a06403a4b3a65dc439
SSDEEP 1536:cdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3oh63EYrDWyK:cfam6OzmkrJrRj4h6DWyK
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Holiday.mov

SHA256 f418fbcd3256914e63364db06942e6015ff7a8223c25fbb23042fd492b869e50
MD5 241d7ec9a560a3b19dead73b3991df57
SHA1 ffb22f27ec1b7fde87e2ca5b2dbedc7f87976bc5
SHA512 130c3e41d9a8258bb9c1f7e006acd56c5ae921cd3e35ef5382252500e21e2e6414b3fe52fbb856b9d91930b053ab1fe1f6595bddc77241ed65158a26fae2bb18
SSDEEP 384:14Hp2Rm/b2JZAslKafGgfxZfoWHaqcjaaSpukUDbcCTR2/simGxBM8Hi9h:ugRJJrfGgJZfBsaNGvwlrxBMp
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Ordinary.mov

SHA256 013141d315e374d98f91fc4f5f1864db77f73e1b1ea5f2bfe9d105c7c561e2af
MD5 016c309e9324fd619427c18581ca6ba5
SHA1 2b9461b23e4da6a6462cd7ae5055fc494c3293db
SHA512 cab7995ae8505a4a4a5852d9fc98447c5692d64b00b7275566a54f1383abde7850e2ba5edd3bce462116869573069b8486a2a995677a928241e514a0ec9ce11d
SSDEEP 1536:g2CTvWvxF0A6wb7l62odd4HRaN3tY5MmyA0jFqy7sR2CwDG2TFSejU1ro/q+j16Z:gF7Wv7awN62+d4Hg85tB0jUABDG4FlI/
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Substances.mov

SHA256 02d16df2a80fc147d6ab2ef151b8b09cbb7284c01000bcf4463e7db0cae11a8c
MD5 3cd2b5980abae77b53bcff48c77909dc
SHA1 0646d459f65c5f6722d6e4d62887e01318360a17
SHA512 6493941d56aa8fd79fc27c511b24b043d8a8eaf532dc6977a6d6c0e066e8fc6bbe480baf3beb75949a9917c534165ad1146bc63171f3cf8fb4246b1df6799421
SSDEEP 1536:VyW7IZvneo31xloXj8R5xT2tHKLM2fIXNvKTt6M:Vv7un93floXjET+qLMxNvy6M
MD5 SHA1 SHA512 SSDEEP

RegisteredCosmetic/Uh.mov

SHA256 df9d20c9b0588bf386f1e18ff00a2da50b93297155208f11547988962683e52d
MD5 ad371fc32b551e817a6ee6adcd8c7e5b
SHA1 fded5dbb2b0e805ca6fa6cd30c251ac23d8afdbf
SHA512 6f3533ff13cd19570cea95f909720d851b8e774c15c1eb10d180f260d1021393feabd2fc208362268b207fc52a1d92da9dd4cb54efe6a010e3de125597b0f0c9
SSDEEP 384:df/oSLOWEtFEIiOu0TOgzkJelfegyLT1stC//gXwee8jbGXfKwm:/JEtFElOrT3kJUiT1OC//F8/UCwm
MD5 SHA1 SHA512 SSDEEP

setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

RegisteredCosmetic/Apparent.mov

RegisteredCosmetic/Composer.mov

RegisteredCosmetic/Director.mov

RegisteredCosmetic/Editorial.mov

Assist

Enb

Government

Honest

Jet

Neither

Productions

Suggestion

Terminology

Vary

Voyuer

RegisteredCosmetic/Holiday.mov

RegisteredCosmetic/Ordinary.mov

RegisteredCosmetic/Substances.mov

RegisteredCosmetic/Uh.mov

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

RegisteredCosmetic/Apparent.mov

RegisteredCosmetic/Composer.mov

RegisteredCosmetic/Director.mov

RegisteredCosmetic/Editorial.mov

Assist

Enb

Government

Honest

Jet

Neither

Productions

Suggestion

Terminology

Vary

Voyuer

RegisteredCosmetic/Holiday.mov

RegisteredCosmetic/Ordinary.mov

RegisteredCosmetic/Substances.mov

RegisteredCosmetic/Uh.mov