setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 5.9MB
Sample260713-cvscpsds91
SHA256 c53a13e3d5a68beea4f69465913df2f0961644138c8c71c7992f96c3b80f5262
MD5 ca8472ad033f11747deb6806e402d85b
SHA1 a09a521d5460c16f1e3f9d9bbaccf652ba17dda9
SHA512 af962c986f18d0b7cda83a9828a770f1a1f47e788333f7e4dd2d11f28672b8f7530c3de65aba5f3c2b6843ef0334675b9496a79cc670d224e0cf430dd7b23619
SSDEEP 98304:u6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwS:uiknHPxjE085BJhuh8rC91idYMVR9
TLSH
T1A856AE8163B02138E9AB5DB0EC3C69720A283C5F97F2C6FFA5D85C7515709C17A39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
setup.exe

File Explorer

setup.exe

.exe 5.9MB

setup.exe

IMPHASH 0aae993ff7ad09ee6b4255d5409ee820
SHA256 c53a13e3d5a68beea4f69465913df2f0961644138c8c71c7992f96c3b80f5262
MD5 ca8472ad033f11747deb6806e402d85b
SHA1 a09a521d5460c16f1e3f9d9bbaccf652ba17dda9
SHA512 af962c986f18d0b7cda83a9828a770f1a1f47e788333f7e4dd2d11f28672b8f7530c3de65aba5f3c2b6843ef0334675b9496a79cc670d224e0cf430dd7b23619
SSDEEP 98304:u6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwS:uiknHPxjE085BJhuh8rC91idYMVR9
TLSH
T1A856AE8163B02138E9AB5DB0EC3C69720A283C5F97F2C6FFA5D85C7515709C17A39B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a5:c5:29:fe:7a:69:47:1c:d9:13:90:04:77:ca:0b:d3:55:4a:68:ae:83:d0:2b:fc:c2:35:e6:34:d9:27:de:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=20161724417,CN=WORK PRODUCT\, INC.,OU=Management,O=WORK PRODUCT\, INC.,L=Golden,ST=Colorado,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#1308436f6c6f7261646f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 1, 0001

Subject

Serial Number

2c:a8:0a:a7:4a:5e:c2:9e:23:71:3a:23:d5:c2:9a:68

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2024 - Oct 31, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2024 - Feb 16, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

2978464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.exe.pdb

advapi32

AdjustTokenPrivileges BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ChangeServiceConfig2W ChangeServiceConfigW CheckTokenMembership CloseServiceHandle ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW CreateServiceW CreateWellKnownSid DeleteService DuplicateTokenEx GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle GetUserNameA GetUserNameW ImpersonateNamedPipeClient IsValidAcl IsValidSecurityDescriptor IsValidSid LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueA RegEnumValueW RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegisterTraceGuidsW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo StartServiceW TraceEvent UnregisterTraceGuids

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

shell32

CommandLineToArgvW ord190 ord155 ord680 SHChangeNotify SHCreateAssociationRegistration ord165 SHFileOperationW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

user32

AllowSetForegroundWindow CallNextHookEx CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetMessageW GetMonitorInfoW GetWindowLongW LoadIconW MessageBoxW MonitorFromWindow MoveWindow PostMessageW RegisterClassW SendMessageW SetForegroundWindow SetWindowLongW SetWindowsHookExW TranslateMessage UnhookWindowsHookEx UnregisterClassW wsprintfW

wininet

HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetConnectW InternetOpenW InternetQueryOptionW InternetReadFile InternetSetOptionW

ws2_32

ntohl

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPriorityClass GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadLocale GetThreadPreferredUILanguages GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapSetInformation InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenFileMappingA OpenMutexW OpenProcess OutputDebugStringA PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime QueueUserAPC RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessShutdownParameters SetStdHandle SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WerRegisterRuntimeExceptionModule WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

propsys

InitPropVariantFromCLSID

shlwapi

ord437 PathMatchSpecW UrlCanonicalizeW

ntdll

NtDeleteKey

winmm

timeGetTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

urlmon

CreateURLMonikerEx

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

malloc_h

Size

512B

Virtual Size

187B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

342KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

advapi32

dbghelp

oleaut32

shell32

user32

wininet

ws2_32

kernel32

ole32

winhttp

propsys

shlwapi

ntdll

winmm

userenv

version

urlmon

generic