SETUP[.]exe | Triage™

resource
SETUP.exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

SETUP.exe

IMPHASH c32ba42c73a2bc24d2788f7750d87edb
SHA256 4ed7187ee8b2c76c5442da32ba3b044d92a7523e076567db7745fd25ed035cef
MD5 649891928caf43374083573eed2cc885
SHA1 a0745d8c92b40f1ef724f15e613953812ebb9769
SHA512 b8a71063367bd61bfdc7caba7ad4af1382a8387c6ceea15825324baa067cf5516803b92137aa4a19c8f67c89d19e45bbe8e6a1303e83e03e29c17a950a56b539
SSDEEP 24576:aXpnPgbvZe9xvl3q8zLGprT6P9xSsQ6tppg8+pJ0iqtjmXaYPadA2staPy3:IhPwIVlDI8xSsz1qXj4i
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

50:1e:7d:ed:20:71:ce:01:ee:69:eb:63:e4:02:e8:6e:94:d4:0d:d1:61:55:49:b6:01:92:32:2f:f0:5d:75:53

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Chains

Sep 14, 2025

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Serial Number

03:8a:4a:4c:4d:aa:6a:ad:4c:64:bc:63:bf:08:2c:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2024 - Feb 13, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Dummy certificate

Serial Number

01

Issuer

CN=Dummy issuer

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

692KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Albert.pps

SHA256 9b6c40c0533ba684e4ed311d08f17e74aded083fb4c36ad053d1966d39da6490
MD5 5a0172db68ed519df6c818cb05b8296d
SHA1 4367f1b0fccb784d509ddc9963e6bbe14f96f94b
SHA512 8d4a2a0ae9a3a11346c6cb04b6ee41333371ea3a3bbee36ee4799754f7ebcf7b282b75d5904d490bbf57fb7054b23d36226a7c4d4e6f00220920be13605262eb
SSDEEP 3072:aYlDuotG8EwlTBDD0dZm1Do8FtcJnDuaQiCC5zxH9t5:aYFjIdD8FtcnCaQijl5
MD5 SHA1 SHA512 SSDEEP

$TEMP/Amenities.pps

SHA256 8bbc536969178a7855cbb04be80e44a0fae7743086bbf1124ad43b7da2361c6a
MD5 f04f128b7245b3f302921cd4add81dda
SHA1 08ed83ab808f85c74b28ba21783e49b6641be271
SHA512 f156ed42032fad7c601fe3c54a836ca9f9ea033516f16d54c2b7f2459eb65c37aa0d0ce346305a106b464d21baf2872e6f4d878600baf6026600a995f98d6d71
SSDEEP 6144:6thc3LYvhO4zkZvMQ5sVn9fFQvM8Eyr1JEXv:6tu8cTZvMAsB9f6Ez
MD5 SHA1 SHA512 SSDEEP

$TEMP/Appears.pps

SHA256 162005f375016d5ef081bb4c162c152a631021313c9f7200f4a0a865c682137b
MD5 d6143f0b97915b11cce6c5b9283fd6aa
SHA1 f95419eaa7eeedf43daa52331bc9844ce161fe60
SHA512 b4897a75bae7e453090e2cb0adc6a2d3d48dbfcdfeef8ba080122d9b19b3ceb83838135dd0da7ee1c8d90f443489dd7817f05fd26b8952b06c61b3b488bd1d7d
SSDEEP 3072:Fb7UWMYsYnhoKJoTbSzEoepy4BEwAt76R5boEGdV6M:h7UWMQnKXuE/py4BEXt76jkEGrH
MD5 SHA1 SHA512 SSDEEP

$TEMP/Favors.pps

SHA256 0876de27d34c30a972a2c3420ad13c9ba507028cb74e1d712ad0f60c83da33f1
MD5 dd1550dde88d94caf5cc001f59d86247
SHA1 d5f8a73d31b11b7c8368ce3fe285ace8df21337d
SHA512 c290fbd74806238e28e581dc64cfcc27f0282a9f3ea0444c1826699521ab6006c4af0d920b10216701789d8847428457c3b069b1cffe99432f196d64bf86be01
SSDEEP 384:k3F17c9B9sQ8Kkh1k1B4ZEPPvqNKq/IIE55h6eDNOJdl/oB9Jbw2ZrjK03vBqPL0:k3H29sVKkh1k1QEU/md4lcbhZE2/
MD5 SHA1 SHA512 SSDEEP

$TEMP/Mumbai.pps

SHA256 1d4582c93d98eb00d8e11288c67a39ca1fd8960859625d44b8dbdb0c4483244b
MD5 123cc8fa7731ad177d5601534e64185e
SHA1 1e99944eb95f3bb0242aa5e7063fe0e1a031c06a
SHA512 b8278b386145415ddb265ea8041b2b4f285c43d5f3e5112fde1468931a8c5966798fae72962b4f4cee3ab74debf2ac2929225645b7a204352c307c17b6ca2885
SSDEEP 1536:0RnhVFWKDH3Tq+5SiZkbgLxvS2hGqOpd9qQsxBntSHo5KAMTp1eTFjeHULjMNa:BKDH3Tq+UiZkb0xZGqOpd98PtYoQF1eV
MD5 SHA1 SHA512 SSDEEP

$TEMP/Qualifications.pps

SHA256 5b4ee1dd35c2996413175af619dea1700b27213a4c100b71160aae4c910073cd
MD5 c94d9b78a3968e0f854d913a25fc4cd5
SHA1 51d256a0633475a99991638726575c8f1eaa020c
SHA512 fb3d4adf68ef387fabd8dcfbdbbe2b2f6f00130da537208e957105c1b2cf0056182dfee19826b47dc480c106d44cf81f3ecbda8f13e841c8ab6b7e63f98722e6
SSDEEP 3072:DE6x3iP9nwmAeq58KFoqdbCuuaDSAfEhzgRE3WHJq+zFfW9IoJYWi30Ue:DE6DmeFoqVChaDGzgG3+zNNoJYGV
MD5 SHA1 SHA512 SSDEEP

$TEMP/Signed.pps

SHA256 0541e562a6f4a840a8274728ac3b01e3488d135a7b381fee522753626e90eaa4
MD5 017476d7bcabc277327e044de366b183
SHA1 58f9b7ed637c54b64a95be569e95eebb6c9bf3a8
SHA512 70ad4c921133133f98a426d0f03ecfcbce5e5fe616b1d3ead3590fa4503c96ab95bfa57592e86c6c19da0f711f85504153eb3069298956e4d7cbda4d29d37251
SSDEEP 6144:2Ngw+sWDQS6e10lIwRVi+w3xvo7q37rQHDXv3a7:2qgWDQPDlPUvGQ70zfO
MD5 SHA1 SHA512 SSDEEP

$TEMP/Spelling.pps

SHA256 2884d6f0d3ed239da3cf3c957ba7bb9b4b9fd95b4f3a2d3931ec9b1a02f3f3ac
MD5 65baf4a42712e363bde83bdec4d5fed5
SHA1 94f2673cda284c46568a94ace99b15fafedfc0f1
SHA512 df47ca11074e95d948d28543052dd74cbcf583769b5ff5644e9d3611a42a3ee591e577376cced41fb74c15734eb6968ab75a29bd4b0900277fa79527c439dec5
SSDEEP 12288:/HxP7WmECj56bEkWC7F0x/Fm6SCC9HBekv9ZwIG6cwhZut/gCViO1S:/HxCmDj0bLW2SxN6nvUE6gJO1S
MD5 SHA1 SHA512 SSDEEP

Automobiles

SHA256 c0389a38c675115f6a5530354a3692569ceb94440ce3fdb4ed9d6eb0f34c517a
MD5 239a476f152b437e5ad75f4eec39419e
SHA1 3b489d3e55fef65ebae7df59e6786c23fb61f7eb
SHA512 1738c933d64006aeb46851dd487169f946bb252b727aa0406c0166705e44aae7c4adea016c08115c0ffa8bd4ba27f43094092d7a805de40f31cf04369e902929
SSDEEP 1536:C4upDK9q4Dw3c61RG31IzxsmSh50sYpwy8c1BY/6Qaa2W+j:xVAc6jG31IzxsPR1yciPWs
MD5 SHA1 SHA512 SSDEEP

Bangbus

SHA256 746552f75b6ba9688e31304c32fbc73d53e03952ee05931e152312f8969a006f
MD5 70ec99016a28951a4f67811e108b697c
SHA1 ff696b0c0d76384f509d4c057f6bcd971618c5df
SHA512 c68c4abca1923807573f81812d032af90f4ee62ac0c680793abb85f90ed1258e3d1b485d902d0e60fd1b883834c15d35956eafb294d23a1297a8f0e9514fb45d
MD5 SHA1 SHA512

Cpu

SHA256 1ae5473396a3e026c4c78298260662b029622d2ca9c0f10e00f4686de161a37c
MD5 8bd3a17db6a2709490d802808884cecf
SHA1 d62e3b4831264dc0a5bcd10dd7e94875416b4adb
SHA512 51f9786ed77388d04d1c9f7efdc263d058d073f456493067746e7a8c666fe76a9533e4f40b71c99e37391501db0c07de2685cf52ab07a96de4e8d30b1aef8c36
SSDEEP 384:5fkfiCbwHmAjesFUpNVU3/tel9lS6AzLsstExg/u2WuFRQNv17+vSVWVFTwWdGBK:5f0Tye4Ur2+9Bkk2TalOSVWV9+k
MD5 SHA1 SHA512 SSDEEP

Crossing

SHA256 d2085749b93f2615a7351ffd91797907b8b4b748760dc93a23d9cfe0bf8f0287
MD5 686fec67f10b76799d380bf46f298422
SHA1 f827720ce4811a010217200e6d077098e9d664b2
SHA512 a4871776d0925e3d3ccc7aaf12cb6f861b76bf4536533bb82dda58a241e2f644197e3447bb3ba144f7ab1b3d85a7967a862e9b800994b82741292b431eba8868
SSDEEP 768:Lvz3TSnUfhT5E/G7DQjgp44yoOkv2OvZZi8vKQw5oYqqCzBCwgJ06NwTJTqJ1w05:zzIU15AG73prFCtNwFqGqUqh
MD5 SHA1 SHA512 SSDEEP

Fiction

SHA256 a3aafaa07f7f3a9b6d2686f8dd3c1d328e7444ed6f3fa24c79c3a7a51011699a
MD5 71f705258db2023b330cbacef53d0f3d
SHA1 482571326dda616481008956cbc7cfb6dd174822
SHA512 e503fa5bcc1b1e1646d54573a1e8c475f3cd329cefb5851f35f641d7df01839634968cb60315fbe975f819e8060d8064cac901aa19148799d444291c63b9f1f8
SSDEEP 1536:npp14wJCybMj+rJSYB8G2tTSM+KzxwWGntxujL4k55TpMMS:pb4wo36sVtT6H04k5h6v
MD5 SHA1 SHA512 SSDEEP

Honda

SHA256 b53895a61b45ad2c0f51ddfb622d91b5cc16a7bafb891bd4f4d4e1599b4cd0ec
MD5 5b8981dd7cb8831f97f7f3e2f8243863
SHA1 bdaaee3f25f8474ce6975ce8b6a2d03ff8021d03
SHA512 77f03b8a54df44ce2f12c110a563782832ef8bc1ea0776a07181a1dd2caecd95fc96d698ed2167874c78fc086c5dbbc4b2b324193353ce586f83bd69e7c75a15
SSDEEP 3072:voVRgNkSXF/U8QCgh+qLzxc9TvNU7DYrVV:voVqkSXFsczqkC7aVV
MD5 SHA1 SHA512 SSDEEP

Individually

SHA256 2d57987b4a649ec01275f8dd29e9a46103db4e8ab2e5c3cbbc054258f64446a0
MD5 097cb0f8c2283b3f63520db54832764c
SHA1 e75cd7a3e4e2e5f98c8a9191310d411c1eb6b837
SHA512 78ec3600546bd06cb5a9609d9a76c9c2a634fa79f8c8cedd7802861aff20ccd2b1837c82ca8036b34e7f32463e67927b3229d869c75d245d5d734fdc1a75f844
SSDEEP 1536:GchO+534IY1GsTrkerRIb+cgbrnoZwknr63EYrDWyu0uJ:jhOYSQurhrRIb+c2oZxr6DWy4J
MD5 SHA1 SHA512 SSDEEP

Knives

SHA256 eb57e1b3e6e397a4cac8b99d61cfa5aed474abaecd22e4f28998e117cbbbc7a2
MD5 a2ca4996f792e8f9746c05923831e868
SHA1 a10bc9894af989c815f4428ddc97c938d22b3cf8
SHA512 c786df66a4778e47d6201105fce9c846edde451b0699a26906a7566b5cccca6efcf9488db29f18a0eb248fdfe0359b85455cbd038b1434178c52d1369a56bf57
SSDEEP 1536:1Qu5aAwurPtRB6j6rs84dvTcAXjKd1bS1wwQ/:1HaAtrPzw6uId1bz
MD5 SHA1 SHA512 SSDEEP

News

SHA256 d39e400da964dd0ebd2e407e6da5789c6a13cd0df120f868a6eee90cd1ee0560
MD5 afbc5c1dfae44a9bcfb355f2ae3deda5
SHA1 9f1438ce18fc06e142e5679296a491450f9cbef2
SHA512 b29fa75904436e371a4a1cf149b752b0ac8d8f4eb65d0552d119f3aca70e906a6e7cdf0191f87d497ef6b33ac15da233e9ecb33306dd2586494608e438be8d5f
SSDEEP 3072:u/Fy0UhMsqu5OonZkFNrsjeinlsgIhs3kmTmwZDgGbDN:u/FfUhMsqu53mFxsjeilsgIhy4sDVbDN
MD5 SHA1 SHA512 SSDEEP

Pictures

SHA256 2e4cef3a3f1e4bf941af3a053a494cf884882c9063cc8e728db2a92253b316a6
MD5 6c4825b016948f4763c13451fa80d66d
SHA1 bfdc9b557fe6f14b15f27d00fbac4e36b934c380
SHA512 14c9a0dbb3f28429de4f494e7c2d7c1ab3d2a7621a01a413365d10a7eaa2e03f779cd9bf6d8b2c75943f620a0ce1d75305b47c00b7d406978cdf85e38d920100
SSDEEP 3072:kenii0yD1LoanUveooL4x7KBgtEnsjAZNL1iBZ4trwnNX5t:LvRBHPoonCJt
MD5 SHA1 SHA512 SSDEEP

Sales

SHA256 b0be4890f60cf6ee3473a5a4107e64fb8cb892430413f2671b02cd3991b1c314
MD5 ec9949a3dda9947b43e6630e1090ece4
SHA1 627b03730d9d09b9e6fe8719b6d4cb66b1cddb30
SHA512 208a1e8e261cba3bf0c8f4ef7618184f1f82e64588a5541dcce9b5cf58bcb4cec651cc9dcb3a9049c6f3a7b9ae9471980eedf7ef1196bc5a02350d2f387b3b0a
SSDEEP 1536:KOq7owMa4IY1GsCPeFmHz1vNq8S4pG+3DY0kkraxjJ4AHol9dlef8:KrowM3Qm23DjOH4IoVcf8
MD5 SHA1 SHA512 SSDEEP

Skype

SHA256 249aa60ea944277d8a3c8b5098749561a11bce37012aae77e1496f230261762b
MD5 45f9e5df85c1d5f2a6399b9e4960334e
SHA1 c133ff170498fab5ca8cbee93c055f744fd5c80d
SHA512 8b6019582297f5842cc1427210d6f52de8e5dab817cca7828faed10f4ecb55cde43a6d90a8e65171875f83c9402e4a6cd58f6e0648d4b747d14b32a45fc806dd
SSDEEP 3072:2hijUvlgTRMsKz50/0DIPEXbeTjDiNyWEfGxciSvbl:2aUviTRS505EXoiNy8xciSzl
MD5 SHA1 SHA512 SSDEEP

SETUP.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Albert.pps

$TEMP/Amenities.pps

$TEMP/Appears.pps

$TEMP/Favors.pps

$TEMP/Mumbai.pps

$TEMP/Qualifications.pps

$TEMP/Signed.pps

$TEMP/Spelling.pps

Automobiles

Bangbus

Cpu

Crossing

Fiction

Honda

Individually

Knives

News

Pictures

Sales

Skype

Sharing

General

Malware Config

Signatures

File Explorer

SETUP.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Albert.pps

$TEMP/Amenities.pps

$TEMP/Appears.pps

$TEMP/Favors.pps

$TEMP/Mumbai.pps

$TEMP/Qualifications.pps

$TEMP/Signed.pps

$TEMP/Spelling.pps

Automobiles

Bangbus

Cpu

Crossing

Fiction

Honda

Individually

Knives

News

Pictures

Sales

Skype