Setup[.]exe | Triage™

resource
Setup.exe
unpack001/$PLUGINSDIR/nsExec.dll

Setup.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 54138039e021c6c40952b557bf9e6268367126d6c5e6855e44cc946d55a3b65d
MD5 391be6906d336f599a8abcfeb8cee549
SHA1 51c30ce4b0a01250e2ca92dfcd9f3f782d4e812a
SHA512 1340cc0ee460595ae84b496cb7ef0c13265e24046c822fbec6587c75441b55476d6baf2b832d11fe1314193e8be2fa37a5d5812f2dd22ee290b2ac3fdf8f6032
SSDEEP 24576:YVDRfVI5XGq46ASN1GwNQIBoD8f/ajQylkN8DrXPqncbUab:YhINGq4ZwGcoD8gtY8DrXy5ab
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Aquarium.gif

SHA256 83604a0fd0dc8ce53e3b80a21ff13d25e92795e774f6afe0ed8622496ee9fe7d
MD5 142db06b2d4d100bb59ff871eb5388d5
SHA1 2ef25d91237caca01882c2e55feb748efde344c0
SHA512 e046aea173fbe17c2905f89715746630a21e7fe5c772ffba24d85833c0fdfce0a358c7572f7ff20a075d2f2342a44d7150d0ded39ea360e2c35d9e5d160dae57
SSDEEP 6144:R3CkkGUZrPj+3krgSkCDphb8X5w9gcGA1FTANgvqooJFegL2hQFG3y:FCsUBfFQX5wyXKFnxoJZbk3y
MD5 SHA1 SHA512 SSDEEP

$TEMP/Butts.gif

SHA256 d4596086338e0eceb262c4d483d615becd9619138891c59e9351f394d695dd8c
MD5 06c3937e4f7873ac9007a7a3bc9a4538
SHA1 18ceefcd8acfad11cbcfe5425f5cdae7b88dc3c9
SHA512 81349297c3d332ada0ae4778116f020ec1dacd064dbd05a81e1afd1e85bdd886d4df8e154896d14de1aba1ac06d24c51a3812ef6f2a2de578c79e9d227dda412
SSDEEP 768:Z2znxCE+Nq9KEpDBn347SCO4ELRSOBut2sI4W:ozn3+0PpRCpO4X7t2QW
MD5 SHA1 SHA512 SSDEEP

$TEMP/Dennis.gif

SHA256 46ab0ebfa850e42c792b673956ac5ed5536ef92a26c95eb4bbdc0dd8f9198f48
MD5 88cd64b32ad0c5f605e9910758ff2f54
SHA1 85fd64649e5a34601adb36aec02c005afb091865
SHA512 47cf221ffdf43e6c84c8735b009ce66c11a11ce5583eb30aa5ff685a9d8c76979c44e085a62c17a6b10888dc1eff09017f811e8a760f5aa8e3862a1f30cd8f08
SSDEEP 384:l7s74bPAsBJmWLTwNiu+vnJyJywbzAm3bZh+o6rlcf4M:jJmWm+srzLGyl
MD5 SHA1 SHA512 SSDEEP

$TEMP/Mars.gif

SHA256 6087a254155d4e075a50462ef9959e6f0d786d904feafda35e49aa27972f6f54
MD5 3dd611e6a445645e4132a482cf0c27ca
SHA1 761fec85e5e6a38004fc8ce21f46fcc2bcd038c1
SHA512 3d610351cbcb4856627777ba8cfe6d03969402898b16c5f361b1d9ebd24a844126e5dfec58cfedefe55fab69e2c2e3c4bc3edba73cd83d2ae24e3d53e3721462
SSDEEP 12288:rOsoRSQr6Yx1lWcFYVZDFBG7UD3MWZojY:fKSq6Y/zEFBtD8rjY
MD5 SHA1 SHA512 SSDEEP

Crash

SHA256 0a1baa1182cb7b312a7189f781f3e575d656485a3c6777b74076445960d376cc
MD5 01de375fe28909c883b4dc003210a3db
SHA1 9ad1ca13e61709e338839c77e71a5d1d5e015180
SHA512 343b22e42f481738dc176159f65068986f27db54f7ce6f5560037812db6d578a1917fe09112ae7ddc08951db635151dee9f223b7bb396423db8bc54411ee6751
SSDEEP 1536:c63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:c6DWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Gap

SHA256 f89c3f730d96e73cdb9248421b2958477ee0b2366d5e6180c4789d269dcc7ffb
MD5 99b4ac069f3935112ff41635541f157a
SHA1 c6bc2bcb5aec82a65fd747a2f2bad85da94fe8b5
SHA512 4686768552eb7d5362e283ff3a3793754ce4b50168b49bc65e901b9b5b664779179cb6e6981703d9aa04aceb357e389b129e05b36712554f8cb12cf7b844e958
SSDEEP 1536:KJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3o:Oam6OzmkrJrRj4
MD5 SHA1 SHA512 SSDEEP

Gps

SHA256 6b669e5b94e31c2d9488bfb7f2be13a205c40bd407d0b6fc7d1e04e65a90de54
MD5 90e8342b08acaf85812df9a3fe203374
SHA1 c19b2c694a28853782fe2b04e5d481ffd659565c
SHA512 b87371796b6aef38ea9e7cb748e5770fe8e891bbf0b985b967384ec406d1de4d1e9c29a8cc736240be400f893be412f4d0f92bcffef2ce444e7831d60f4eed2e
SSDEEP 1536:J8JsdVCsESNvmtpAi6JvAeInT3VCLIsLS4:JFXD5ypAXoegz8S4
MD5 SHA1 SHA512 SSDEEP

Human

SHA256 6b1b1865875c7d568e9613961be8f08f4f5b4dba78707117b3a9b448fbf29c15
MD5 13623e515c9abd6ec5a0fe964f318208
SHA1 e26ef4d75f82e440974998646ed441506530887a
SHA512 1465c706d1fbc356caa329f024d4b12b15ac7e91c7908980427fbeb143512c31d9450b672a8586c8ee3a82b1aeeac562222e4b71054350511cc9b95d32a7e9f2
SSDEEP 3072:UjOrOJGGMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtTRVB4Y3I09Jwf:UQOAGlXuww8x1WUyB4Y3IWO
MD5 SHA1 SHA512 SSDEEP

Indexed

SHA256 a0d1c441bacfb8098539d8e6e6993886d32957e179aab3e1488676b877e17977
MD5 4f6479004fb7d3823ea56f4474e5c70d
SHA1 c570fa2956271f96bba7d90c99fafcb41ebcc252
SHA512 d1859bf15d6f21854eb9f859e05037a761e5c197725faeeab4aff49a8d3cef82669bdd4b6e2ae234e7c59851ba7512472fac83ba61d1bb912d6bd688f6511661
SSDEEP 1536:1t0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xP:MeVzOqD1IGuTpMgKYbwR5ExP
MD5 SHA1 SHA512 SSDEEP

Korea

SHA256 aca1cda044d4c4bf1b4079ed5118579800a6744a70f7f150ca72d38e35910a70
MD5 ca7285e487d141180bb640f46db84d0c
SHA1 61ea617a8f5ef4804bc84bc0b4f225aa3a209338
SHA512 94e2004b36183ecdfb79f441c948a9ae3264c977f1a781b92773ffd34cba86f5293fc02dc6abaf0a360d1e1872c909240a212421091133e5b1e7c461f36fd7aa
MD5 SHA1 SHA512

Looks

SHA256 bc4af999515b76729cbdeaa435e23bf3888f9bb48d6c0de599172817a8888a63
MD5 4a7c7a605213d4de390c2da4d8f22c72
SHA1 1a08abedfbfb97f1f355c4439df7ee4ffb1af2c0
SHA512 e99e7f28eebb7c23ac0de4e96bffee5299ca4b7d8717c26cb456eafba425f6eb571c264412ef8f0240ee2dd75502827553017162afade663dc691ded075a112c
SSDEEP 1536:HYR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNOKcw:HYR+HUDXOXT/CfXib+tSijpcVm
MD5 SHA1 SHA512 SSDEEP

Planet

SHA256 b0ea1c83820a8442dbf2d6f1dee71098e770f18aed070f3c31c767f8e4e93c9f
MD5 da662df239e5cb72245cfada772c5382
SHA1 8a3a5624f40106b860db5c96275497673445dbda
SHA512 11fc25538a225933926a7855fe61d56565b5985e99b4372a2fe119a2e53b3e91a12c9185c0aec6cea785983154126b078dc091c53ffe196aa0c10de15466a9a3
SSDEEP 1536:vCIj4BZKaTb1nXu4uuVGHj1vtKsevk+goJqvtmgMbFuz08QuklMBNIWr:aIj4BPb1XuE/gc0Ag0Fuz08XvBN3r
MD5 SHA1 SHA512 SSDEEP

Premiere

SHA256 ef96ed2a9c296f41d43d022d1eccfadc10c93b801f1653bf70c7be43139eb27b
MD5 5765d3fe9f5d24622bc9578d9c71ea5f
SHA1 ef6fb66d66978bd9037830e156986c3ecb4837d3
SHA512 bf105060067451510d43e1aef845ce8aa9640e3a12c7ae17780ca0ecdca48aad1f441c44cbe059c1e9d4ce7766be2388107dca33c207aa85a2b396a0f8af8f56
SSDEEP 3072:m2/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3I:R/RTggXuN2KFIyt+8ZUlhxb4
MD5 SHA1 SHA512 SSDEEP

Studios

SHA256 dd3058342fc254d9765066987fbe2703a414c36808ce580bb91f03f9c5642d41
MD5 922b0e72e72996ac0efe6147a69b36b0
SHA1 2ca12b0a7b12df50b3a5709653bed92885439a6d
SHA512 9effd6c58056698ddd69689c5992ae38c8b26dbf9b3ba3e060ee201ac5b2848285e5dced75387f2de5d505f791a41910bfbe717aa6ae5e18f5819d7dff0e7acb
SSDEEP 384:zupi09PrOa3HwwuBceiWjc/mwftIQXoSpu888888888888888888888888888882:zupxhSaAwu+2c/mex/s
MD5 SHA1 SHA512 SSDEEP

Timer

SHA256 9bc25a55f8bf66947e6dc7be41667b072a753048af22671e03406dce716b3557
MD5 3a1e81f992a067913c48faaf6625b29c
SHA1 71448d6db8a86bd02e048d9124b61741257154bf
SHA512 1b3a056253b9be53806e4f52a396cbcc11f6eb9ad4496c8f36d589756620f4c5f22f2ffc670edf86be3ede776c87afcbf61a904d520e40fb5894714266ba291b
SSDEEP 1536:RHDS661CZxbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZ5:xD8jjJ8lghHzJi2ubSW4wC2U
MD5 SHA1 SHA512 SSDEEP

$TEMP/Tables.gif

SHA256 7a819eafe2c6b6be29a0e985859e1bd106980a854a2f5026e1dc203b8758fcb9
MD5 95b5cbdeb958f692c092478a5f12a078
SHA1 4b3c2d465074304a8961c70785fd81189a1fd2d1
SHA512 0da9b70106eed38d5a2005a2acdf387348bd4f9d69a5ab5e653724eaeadab131309618621f304c91acbc15eea34758c5ae1a91543e33d155890943016419059a
SSDEEP 3072:BLE4ZZYvocOAYzcG/EGN49Xn4ncE1CytGNI/2ktyL23nG0ugcATknzof:iUYvAiPj4ncKXGNI/2YcmGLOTkzof
MD5 SHA1 SHA512 SSDEEP

Setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Aquarium.gif

$TEMP/Butts.gif

$TEMP/Dennis.gif

$TEMP/Mars.gif

Crash

Gap

Gps

Human

Indexed

Korea

Looks

Planet

Premiere

Studios

Timer

$TEMP/Tables.gif

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Aquarium.gif

$TEMP/Butts.gif

$TEMP/Dennis.gif

$TEMP/Mars.gif

Crash

Gap

Gps

Human

Indexed

Korea

Looks

Planet

Premiere

Studios

Timer

$TEMP/Tables.gif