setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 8.0MB
Sample260626-w1mtyset3n
SHA256 8a79adfa41d7d052a2654262f3b64a4b9b02213950304f7488622ab68a8d3ba8
MD5 ac36a4ad30fa86587ab0f6a2ba521571
SHA1 9cb5f548e0854659cacb7c8b05d8660c990d04f9
SHA512 a48e1df1e6467270badc1fa176a65a7733c1fffb0ee4a9b7e2395d5f2eec51fe3bde36d469850803bc7fae984faaeb5565ee67b2a2d738db2eec9e275af2bf61
SSDEEP 98304:eC3msmu5AZgVFMozQRvr8UR3fdv8xE9eoeF527AH0Zs0heR4uf5L2z0sW:eC3m9urqrrFfd9leF527DZs0o4uZ2IR
TLSH
T1A5868E3847CB76ADD7D5E3782ADACE387F078CF893C23981E3A78416511F6686284539
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
setup.exe

File Explorer

setup.exe

.exe 8.0MB

setup.exe

IMPHASH 2dd1f2ca3497e7bf3a3f47dd48596ca8
SHA256 8a79adfa41d7d052a2654262f3b64a4b9b02213950304f7488622ab68a8d3ba8
MD5 ac36a4ad30fa86587ab0f6a2ba521571
SHA1 9cb5f548e0854659cacb7c8b05d8660c990d04f9
SHA512 a48e1df1e6467270badc1fa176a65a7733c1fffb0ee4a9b7e2395d5f2eec51fe3bde36d469850803bc7fae984faaeb5565ee67b2a2d738db2eec9e275af2bf61
SSDEEP 98304:eC3msmu5AZgVFMozQRvr8UR3fdv8xE9eoeF527AH0Zs0heR4uf5L2z0sW:eC3m9urqrrFfd9leF527DZs0o4uZ2IR
TLSH
T1A5868E3847CB76ADD7D5E3782ADACE387F078CF893C23981E3A78416511F6686284539
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ce:29:88:c3:5b:b4:42:6c:9a:05:cc:a4:6e:ca:8f:76:57:a3:10:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Security Division,O=SafeNet\, Inc.,L=Baltimore,ST=Maryland,C=US

Chains

Jan 9, 2013

CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Security Division,O=SafeNet\, Inc.,L=Baltimore,ST=Maryland,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Security Division,O=SafeNet\, Inc.,L=Baltimore,ST=Maryland,C=US

Serial Number

60:97:87:c3:5b:1e:a5:1c:0f:e3:65:6a:8d:dc:49:75

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 25, 2011 - Mar 15, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

121132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

shell32

SHBrowseForFolderA SHGetMalloc SHGetPathFromIDListA

comctl32

ord17

kernel32

GetLastError WideCharToMultiByte DeleteFileA lstrlenW InterlockedIncrement InterlockedDecrement QueryPerformanceFrequency CreateEventA Sleep lstrcatA CompareStringA CompareStringW GetVersionExA SetFilePointer SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime FreeLibrary GetProcAddress LoadLibraryA LockResource LoadResource SizeofResource FindResourceA CreateProcessA GetSystemDefaultLCID GlobalHandle VerLanguageNameA SetCurrentDirectoryA WaitForSingleObject GetSystemInfo MulDiv GetModuleFileNameA IsValidCodePage GetVersion FlushFileBuffers SetEndOfFile LocalFree FormatMessageA GetDiskFreeSpaceA GetDriveTypeA CreateDirectoryA RemoveDirectoryA GetExitCodeProcess GetCurrentProcess GetCurrentThread GetLocaleInfoA UnhandledExceptionFilter lstrlenA GetACP GetCPInfo SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc VirtualFree SetLastError HeapDestroy GetEnvironmentVariableA LCMapStringW LCMapStringA DeleteCriticalSection InitializeCriticalSection TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId HeapSize HeapReAlloc LeaveCriticalSection EnterCriticalSection GetCommandLineA GetStartupInfoA GetModuleHandleA TerminateProcess ExitProcess RaiseException RtlUnwind SystemTimeToFileTime QueryPerformanceCounter ResetEvent SetEvent GetShortPathNameA SearchPathA FindFirstFileA VirtualProtect VirtualQuery GetStdHandle FindClose GetFileType GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CreateFileA GetFileSize GlobalAlloc CloseHandle GlobalLock ReadFile GlobalUnlock GlobalFree CopyFileA MultiByteToWideChar FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings CreateThread GetExitCodeThread GetTickCount lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GetTempPathA SetErrorMode GetWindowsDirectoryA GetTempFileNameA GetFileAttributesA GetProcessHeap HeapAlloc HeapFree WriteFile lstrcpynA lstrcpyA CreateFileMappingA MapViewOfFile HeapCreate UnmapViewOfFile GetEnvironmentStringsW SetHandleCount GetOEMCP

user32

GetParent GetWindowTextLengthA GetWindowTextA MoveWindow GetWindowPlacement DrawIcon DestroyIcon GetDlgCtrlID SetWindowTextA FillRect GetSysColor GetSysColorBrush IsDialogMessageA EnableWindow GetDlgItemTextA GetWindow SetCursor UpdateWindow GetClassInfoA wvsprintfA LoadStringA SendMessageA GetSystemMetrics SetRect FindWindowA IntersectRect SubtractRect CharPrevA DestroyWindow CreateDialogParamA CharNextA MessageBoxA WaitForInputIdle GetWindowLongA BeginPaint EndPaint SetWindowLongA GetClientRect ClientToScreen SetWindowPos GetWindowDC EndDialog GetDlgItem ShowWindow DialogBoxParamA GetDesktopWindow wsprintfA MsgWaitForMultipleObjects PeekMessageA DefWindowProcA PostMessageA KillTimer PostQuitMessage SetTimer LoadIconA LoadCursorA RegisterClassA CreateWindowExA GetMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC ExitWindowsEx SendDlgItemMessageA IsWindow CharLowerBuffA GetWindowRect

gdi32

GetTextExtentPoint32A SetBkMode SetTextColor GetObjectA CreateFontIndirectA CreateSolidBrush CreateCompatibleDC SelectObject CreateFontA DeleteDC DeleteObject GetStockObject GetSystemPaletteEntries CreatePalette GetDeviceCaps SelectPalette RealizePalette CreateDIBitmap BitBlt TranslateCharsetInfo

advapi32

RegQueryValueA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegCreateKeyExA RegEnumValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenThreadToken RegDeleteValueA

ole32

StringFromCLSID CoTaskMemFree CoCreateGuid CoCreateInstance GetRunningObjectTable StgIsStorageFile StgOpenStorage CoUninitialize CoInitialize CreateItemMoniker

oleaut32

VariantChangeType SysAllocString SysAllocStringLen SysStringLen SysReAllocStringLen SysFreeString VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

version

shell32

comctl32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

generic