setup (11)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup (11).exe
Size 488KB
Sample260717-hkshlsg14s
SHA256 fb73737872bb6344bba05b48f1cba7e23d7029c625369da4aa7b9f203eff24d6
MD5 48603e4e5696b0e5ce15b4bb02c25ff8
SHA1 e5b706e1ed5a8fe90a9786b94987160cac0b10f4
SHA512 682c29713c4fbe96cb34bd65499cc69027441dfe5b0140ed81b4bc18f7bf180a393a74e99e7a23a0476de2fb75f75c78ebfca4dcc486b983c64c7bf4f609021f
SSDEEP 6144:p0cIwPP3sY6mSXyGV8a1FH7j/77ZJg6BAX2S+dyKXFS7NRLoTm0WKgA:pLsT67KgA
TLSH
T14AB4F922F619C4C7E1AC44B29E1AD23414A06E7DC5E2911FB5FB7E1BB1F2362145FA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
setup (11).exe

File Explorer

setup (11).exe

.exe 488KB

setup (11).exe

IMPHASH 7ab9ea6a0fcd4aa21dd7e65b657534b1
SHA256 fb73737872bb6344bba05b48f1cba7e23d7029c625369da4aa7b9f203eff24d6
MD5 48603e4e5696b0e5ce15b4bb02c25ff8
SHA1 e5b706e1ed5a8fe90a9786b94987160cac0b10f4
SHA512 682c29713c4fbe96cb34bd65499cc69027441dfe5b0140ed81b4bc18f7bf180a393a74e99e7a23a0476de2fb75f75c78ebfca4dcc486b983c64c7bf4f609021f
SSDEEP 6144:p0cIwPP3sY6mSXyGV8a1FH7j/77ZJg6BAX2S+dyKXFS7NRLoTm0WKgA:pLsT67KgA
TLSH
T14AB4F922F619C4C7E1AC44B29E1AD23414A06E7DC5E2911FB5FB7E1BB1F2362145FA0E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

45:d5:8d:ba:a9:26:69:57:f0:b0:9b:ce:27:98:09:52:8b:ed:41:6a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Chains

Dec 14, 2011

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Serial Number

23:4d:a0:4b:d2:42:85:3c:4a:cb:9a:e8:61:c2:19:bb

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 27, 2009 - Sep 20, 2012

Minor OS version

Major OS version

Entry point

28994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

U:\develop\global\Release\bin\common\x86\Setup.pdb

gdiplus

GdiplusStartup GdiplusShutdown

kernel32

EnterCriticalSection GetLastError InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement lstrlenW GetModuleHandleW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW lstrcmpiW GetStringTypeW LeaveCriticalSection WideCharToMultiByte RaiseException DeleteCriticalSection GetCurrentThreadId GetModuleFileNameW SetCurrentDirectoryW LoadLibraryW GetProcAddress IsValidCodePage GetOEMCP GetACP GetCPInfo GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle LCMapStringW RtlUnwind HeapFree EncodePointer DecodePointer HeapAlloc GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate Sleep HeapSize ExitProcess IsProcessorFeaturePresent HeapReAlloc WriteFile GetSystemTimeAsFileTime

user32

CharNextW DestroyWindow DefWindowProcW MessageBoxW

advapi32

RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegDeleteKeyW RegCloseKey

ole32

CoInitialize CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW PathAppendW PathRemoveFileSpecW StrCpyW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

setup (11).exe

PE Signature issue

gdiplus

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

generic