SETUP.zip
- SHA256 e27696135b673b817709e2cf6309ad0ca23e81080795510116a8c23325399680
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11ltsc2024-20260709-en
Detects file using ACProtect software.
| resource | yara_rule |
|---|---|
| static1/unpack001/directx/bin/fmodex.dll | acprotect |
File was altered after it was signed.
| resource |
|---|
| unpack001/python37.dll |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/python37.dll |
| resource | yara_rule |
|---|---|
| static1/unpack001/directx/bin/fmodex.dll | upx |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/XAudio2_1.dll |
| unpack001/directx/bin/byond.exe |
| unpack001/directx/bin/byondcore.dll |
| unpack001/directx/bin/byondext.dll |
| unpack001/directx/bin/byondwin.dll |
| unpack001/directx/bin/dd.exe |
| unpack001/directx/bin/dm.exe |
| unpack001/directx/bin/dreamdaemon.exe |
| unpack001/directx/bin/dreamdeploy.exe |
| unpack001/directx/bin/dreammaker.exe |
| unpack001/directx/bin/dreamseeker.exe |
| unpack001/directx/bin/fmodex.dll |
| unpack004/out.upx |
| unpack007/dxupdate.dll |
| unpack008/dxupdate.dll |
| unpack001/fonts/FontSizer/FontSizer.exe |
| unpack001/fonts/FontSizer/UnInstCleanup.exe |
| unpack001/fonts/FontSizer/unins000.exe |
| unpack001/gmp-clearkey/0.1/clearkey.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/directx/DSETUP.dll |
| unpack001/directx/DXSETUP.exe |
| unpack002/D3DCompiler_43.dll |
| unpack003/d3dx9_43.dll |
| unpack001/directx/directx/DSETUP.dll |
| unpack001/directx/directx/DXSETUP.exe |
| unpack005/D3DCompiler_43.dll |
| unpack006/d3dx9_43.dll |
| unpack001/directx/directx/dsetup32.dll |
| unpack001/directx/dsetup32.dll |
Mar 10, 2020
CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=24123,
count=1, id=259, version=24123,
count=18, id=261, version=24123,
count=13, id=260, version=24123,
count=3, id=257, version=24234,
count=2, id=257, version=26715,
count=46, id=1, productName=Unmarked objects,
count=1, id=264, version=24234,
count=1, id=255, version=24234,
count=1, id=258, version=24234,
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=125, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=64, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=116, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=127, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=15, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=106, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=151, id=1, productName=Unmarked objects,
count=104, id=170, productName=VS2010 build 30319, version=30319,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
May 22, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=14, id=158, version=21202,
count=166, id=1, productName=Unmarked objects,
count=7, id=156, version=21202,
count=40, id=171, version=21202,
count=63, id=170, version=21202,
count=1, id=155, version=21202,
count=92, id=175, version=21202,
count=1, id=126, version=50727,
count=1, id=154, version=21202,
count=1, id=157, version=21202,
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
May 22, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=224, id=1, productName=Unmarked objects,
count=9, id=156, version=21202,
count=15, id=158, version=21202,
count=80, id=170, version=21202,
count=1, id=155, version=21202,
count=244, id=171, version=21202,
count=1, id=126, version=50727,
count=1, id=154, version=21202,
count=1, id=157, version=21202,
Oct 10, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=253, version=28518,
count=13, id=260, version=30034,
count=7, id=259, version=30034,
count=33, id=261, version=30034,
count=4, id=257, version=30034,
count=18, id=257, version=29395,
count=5, id=257, version=30154,
count=1194, id=1, productName=Unmarked objects,
count=32, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=253, version=28518,
count=10, id=260, version=30034,
count=15, id=259, version=30034,
count=4, id=257, version=30034,
count=28, id=261, version=30034,
count=14, id=257, version=29395,
count=3, id=257, version=30154,
count=424, id=1, productName=Unmarked objects,
count=170, id=261, version=30154,
count=1, id=260, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=3, id=253, version=28518,
count=12, id=261, version=30034,
count=10, id=260, version=30034,
count=7, id=259, version=30034,
count=5, id=257, version=29395,
count=82, id=1, productName=Unmarked objects,
count=107, id=260, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, version=21202,
count=4, id=253, version=28518,
count=12, id=260, version=29395,
count=11, id=260, version=30034,
count=7, id=259, version=30034,
count=6, id=257, version=30034,
count=28, id=261, version=30034,
count=28, id=257, version=29395,
count=2, id=257, version=30154,
count=3, productName=Unmarked objects (old),
count=1716, id=1, productName=Unmarked objects,
count=131, id=261, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=4, id=253, version=28518,
count=27, id=261, version=30034,
count=12, id=260, version=30034,
count=2, id=259, version=30034,
count=6, id=257, version=29395,
count=3, id=257, version=30154,
count=202, id=1, productName=Unmarked objects,
count=2, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=1, id=253, version=28518,
count=27, id=261, version=30034,
count=12, id=260, version=30034,
count=3, id=259, version=30034,
count=2, id=257, version=29395,
count=3, id=257, version=30154,
count=186, id=1, productName=Unmarked objects,
count=2, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=253, version=28518,
count=14, id=257, version=29395,
count=13, id=260, version=30034,
count=5, id=259, version=30034,
count=32, id=261, version=30034,
count=4, id=257, version=30034,
count=5, id=257, version=30154,
count=671, id=1, productName=Unmarked objects,
count=17, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=29395,
count=268, id=1, productName=Unmarked objects,
count=5, id=257, version=30034,
count=3, id=253, version=28518,
count=32, id=261, version=30034,
count=13, id=260, version=30034,
count=3, id=259, version=30034,
count=1, id=260, version=30154,
count=3, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=253, version=28518,
count=12, id=257, version=29395,
count=13, id=260, version=30034,
count=11, id=259, version=30034,
count=32, id=261, version=30034,
count=4, id=257, version=30034,
count=7, id=257, version=30154,
count=2163, id=1, productName=Unmarked objects,
count=77, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=8, id=253, version=28518,
count=13, id=260, version=30034,
count=7, id=259, version=30034,
count=18, id=257, version=29395,
count=43, id=261, version=30034,
count=5, id=257, version=30154,
count=1909, id=1, productName=Unmarked objects,
count=1, id=260, version=30154,
count=23, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=173, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=55, id=48, version=9044,
count=155, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=8, productName=Unmarked objects (old),
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=173, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=55, id=48, version=9044,
count=155, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=8, productName=Unmarked objects (old),
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=127, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=15, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=106, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=151, id=1, productName=Unmarked objects,
count=104, id=170, productName=VS2010 build 30319, version=30319,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
May 22, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=14, id=158, version=21202,
count=166, id=1, productName=Unmarked objects,
count=7, id=156, version=21202,
count=40, id=171, version=21202,
count=63, id=170, version=21202,
count=1, id=155, version=21202,
count=92, id=175, version=21202,
count=1, id=126, version=50727,
count=1, id=154, version=21202,
count=1, id=157, version=21202,
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
May 22, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=224, id=1, productName=Unmarked objects,
count=9, id=156, version=21202,
count=15, id=158, version=21202,
count=80, id=170, version=21202,
count=1, id=155, version=21202,
count=244, id=171, version=21202,
count=1, id=126, version=50727,
count=1, id=154, version=21202,
count=1, id=157, version=21202,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=18, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=112, id=170, productName=VS2010 build 30319, version=30319,
count=42, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=1, productName=Unmarked objects,
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=109, id=170, productName=VS2010 build 30319, version=30319,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=18, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=112, id=170, productName=VS2010 build 30319, version=30319,
count=42, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=1, productName=Unmarked objects,
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=109, id=170, productName=VS2010 build 30319, version=30319,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Codesign digest Mismatch
File was altered after it was signed.
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Jul 2, 2026
CN=iterate GmbH,O=iterate GmbH,ST=Bern,C=CH
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=24123,
count=15, id=199, version=41118,
count=11, id=259, version=24123,
count=10, id=261, version=24123,
count=11, id=260, version=24123,
count=11, id=257, version=26715,
count=346, id=1, productName=Unmarked objects,
count=192, id=264, version=24234,
count=1, id=256, version=24234,
count=1, id=255, version=24234,
count=1, id=258, version=24234,
Jan 17, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 17, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=30795,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=22, id=260, version=34321,
count=28, id=261, version=34321,
count=19, id=259, version=34321,
count=1, id=256, version=34321,
count=1, id=255, version=34321,
count=1, id=258, version=34321,