setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 799KB
Sample260708-lmt11ady7x
SHA256 3a5f25ce5f79c11d19bbee0ed3300993c1175f77b0520c03d5bd185c309f87e5
MD5 6d815a45e6d19460da44a8184e55d5c6
SHA1 4c6bd08f7a7c7e7352420978c56e888ed94e5f6e
SHA512 82d83fe362f2c3bbe5436b0946b9cbfd0bcf57e2b90a237bd9b6d66114c0d7f5882d6ddc2d8a6865b41c27affc8769a22e313cf19d3a788b9d2462ce402066d4
SSDEEP 12288:vubj5je69oqAmj5oMqKyKAuqOAP0wuXeMb01JQntLOCI1no0Hg:vqhe29AmjkKuuXemI1nxA
TLSH
T1F705522A56D8B969E3F69B307FF252D3BB69BC523834CC0E11D103090975A52FDA076E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 799KB

setup.exe

IMPHASH 4bbd4adfc99174f1d7d82430fab6116e
SHA256 3a5f25ce5f79c11d19bbee0ed3300993c1175f77b0520c03d5bd185c309f87e5
MD5 6d815a45e6d19460da44a8184e55d5c6
SHA1 4c6bd08f7a7c7e7352420978c56e888ed94e5f6e
SHA512 82d83fe362f2c3bbe5436b0946b9cbfd0bcf57e2b90a237bd9b6d66114c0d7f5882d6ddc2d8a6865b41c27affc8769a22e313cf19d3a788b9d2462ce402066d4
SSDEEP 12288:vubj5je69oqAmj5oMqKyKAuqOAP0wuXeMb01JQntLOCI1no0Hg:vqhe29AmjkKuuXemI1nxA
TLSH
T1F705522A56D8B969E3F69B307FF252D3BB69BC523834CC0E11D103090975A52FDA076E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

19:c6:7f:a7:7d:19:02:57:51:89:4f:3c:dd:b6:ee:7e:e9:e6:c2:25:0e:94:11:9b:0e:c0:2f:9e:89:0a:dd:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Turkiye Noterler Birligi,O=Turkiye Noterler Birligi,L=Çankaya,ST=Ankara,C=TR

Chains

Jul 3, 2026

CN=Turkiye Noterler Birligi,O=Turkiye Noterler Birligi,L=Çankaya,ST=Ankara,C=TR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Turkiye Noterler Birligi,O=Turkiye Noterler Birligi,L=Çankaya,ST=Ankara,C=TR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Turkiye Noterler Birligi,O=Turkiye Noterler Birligi,L=Çankaya,ST=Ankara,C=TR

Serial Number

01:84:8e:09:bf:25:94:c7:60:fa:0f:52:94:f0:9b:e0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2023 - Oct 26, 2026

Minor OS version

Major OS version

Entry point

228670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Q:\cmd\0\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

kernel32

GetNativeSystemInfo EndUpdateResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW ReadFile GetCurrentProcessId GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte RaiseException InitializeCriticalSectionAndSpinCount Sleep HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW OpenProcess MulDiv GetTickCount GetExitCodeProcess LoadLibraryW GetTempPathW SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA HeapReAlloc HeapSize WriteConsoleW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW OutputDebugStringW SetEndOfFile SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapFree HeapAlloc FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile GetFileType GetStringTypeW GetACP GetModuleHandleExW ExitProcess MultiByteToWideChar VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW ScreenToClient GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA SetCursor GetFocus

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord150 ord92 ord8 ord78

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

generic