setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 104KB
Sample260721-lrv4vsdz21
SHA256 e25cadc80ea5163e0f1c6fd703479469d9f23b47ade244fac5f22bcdb01b39bd
MD5 5b2065fa6f2ec63fe28be26fdb7b0480
SHA1 e6d5fde72e7dd1d6581ff6dc05c4d00c795cd760
SHA512 51dcbf8583104754902a9387da0c2efd05b04842ffb043f3d1035940f6c612e8e20259932e0ebf16e1857c6764596017fe7db3736cab62d3d3f62804535a8417
SSDEEP 1536:M1SzFn4NZDFS88W5JbOh9n9BkQ43/AM/rdJlR2zB0orjaJLtgb:M1qn4NVFS/YK/9uBAKdJlR2m+aJLtgb
TLSH
T1AFB33912B7E68076F6F31731AD7963A18ABFBD302938C51F5344324D1EB2A91CA60727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
setup.exe

File Explorer

setup.exe

.exe 104KB

setup.exe

IMPHASH 5523dda9a438aa3992e03f3746f19bf6
SHA256 e25cadc80ea5163e0f1c6fd703479469d9f23b47ade244fac5f22bcdb01b39bd
MD5 5b2065fa6f2ec63fe28be26fdb7b0480
SHA1 e6d5fde72e7dd1d6581ff6dc05c4d00c795cd760
SHA512 51dcbf8583104754902a9387da0c2efd05b04842ffb043f3d1035940f6c612e8e20259932e0ebf16e1857c6764596017fe7db3736cab62d3d3f62804535a8417
SSDEEP 1536:M1SzFn4NZDFS88W5JbOh9n9BkQ43/AM/rdJlR2zB0orjaJLtgb:M1qn4NVFS/YK/9uBAKdJlR2m+aJLtgb
TLSH
T1AFB33912B7E68076F6F31731AD7963A18ABFBD302938C51F5344324D1EB2A91CA60727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e1:9e:3e:ac:50:1a:00:2b:e6:09:94:98:ca:08:54:71

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=InstallShield Software Corporation,OU=Research and Development,O=InstallShield Software Corporation,L=Schaumburg,ST=Illinois,C=US

Chains

Jan 1, 0001

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Serial Number

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Timespan

May 12, 1997 - Jan 7, 2004

Subject

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=InstallShield Software Corporation,OU=Research and Development,O=InstallShield Software Corporation,L=Schaumburg,ST=Illinois,C=US

Serial Number

08:d1:35

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 12, 2002 - Feb 12, 2003

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Serial Number

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 28, 2001 - Jan 6, 2004

Minor OS version

Major OS version

Entry point

45516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerInstallFileA GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetLastError SetLastError lstrcmpiA lstrlenA CompareStringW GetVersionExA DeleteFileA CompareStringA GetWindowsDirectoryA GetTempPathA GetFileAttributesA GetTempFileNameA GlobalUnlock GlobalLock GlobalAlloc GlobalFree GetTickCount LockResource LoadResource FindResourceA lstrcpyA SetErrorMode FreeLibrary RemoveDirectoryA LeaveCriticalSection EnterCriticalSection CreateThread CreateMutexA WaitForSingleObject ReleaseMutex InitializeCriticalSection DeleteCriticalSection SetEvent OpenEventA GetModuleHandleA GetCurrentThreadId HeapAlloc GetSystemInfo HeapCreate lstrcpynA lstrcatA GetPrivateProfileIntA lstrlenW FindFirstFileA SetFilePointer GetProcAddress LoadLibraryA GetShortPathNameA GetSystemDefaultLangID MoveFileA FindResourceExA GetFileSize HeapDestroy UnmapViewOfFile MapViewOfFile CreateFileMappingA SizeofResource GetStartupInfoA ExitProcess GetCommandLineA DebugBreak HeapReAlloc HeapFree VirtualQuery VirtualProtect SearchPathA ResetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA MultiByteToWideChar GetCurrentThread GetVersion IsBadReadPtr ReadFile Sleep WriteFile CloseHandle CreateEventA QueryPerformanceFrequency InterlockedDecrement InterlockedIncrement CreateFileA GetModuleFileNameA CreateDirectoryA WideCharToMultiByte WritePrivateProfileStringA GetPrivateProfileStringA FindClose CreateProcessA GetCurrentProcess

user32

MsgWaitForMultipleObjects LoadStringA CharNextA PeekMessageA PostThreadMessageA CharUpperA SetTimer SetWindowRgn DialogBoxIndirectParamA SetActiveWindow CharLowerBuffA CreateDialogIndirectParamA GetDlgItem SendMessageA SetDlgItemTextA LoadIconA GetWindowRect SystemParametersInfoA SetWindowPos CharLowerA GetWindowTextA GetDesktopWindow ScreenToClient MoveWindow KillTimer DestroyWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC SetWindowTextA ShowWindow EndDialog wsprintfA

gdi32

CreateFontIndirectA LPtoDP GetTextExtentPoint32A DeleteObject GetObjectA

advapi32

RegCreateKeyExA OpenThreadToken OpenProcessToken GetTokenInformation RegCloseKey RegOpenKeyExA RegSetValueExA AllocateAndInitializeSid RegQueryValueExA RegDeleteKeyA RegEnumKeyExA RegOpenKeyA RegQueryValueA FreeSid EqualSid

ole32

CoTaskMemFree StringFromGUID2 GetRunningObjectTable CoCreateInstance CoCreateGuid CoReleaseMarshalData CoInitialize CoGetInterfaceAndReleaseStream CoUninitialize CoRevokeClassObject CoRegisterClassObject StringFromCLSID CoTaskMemAlloc CoMarshalInterThreadInterfaceInStream

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantCopy VariantClear LoadRegTypeLi LoadTypeLi RegisterTypeLi SysAllocString

lz32

LZClose LZCopy LZOpenFileA

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

version

kernel32

user32

gdi32

advapi32

ole32

oleaut32

lz32

generic