setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 484KB
Sample260722-w4rx3ssaph
SHA256 dff3317950ddb7fa38c16208724d0d220c4af698d49b227da8dd006942184e17
MD5 bef2d19528be0171469dfdf30a94d8b6
SHA1 6489facbfc5cdab03bfbe7fe20604483cd13a180
SHA512 dd503d13e35c2d03d6bab08837f0f83e43d71c036f2286770d55c30b8d3452ab51361c65fbba634afa1445c41b3f4bd0ec6936b4126318e28c6bff712786a489
SSDEEP 6144:RDYWR5J+Wnp8JZt1u3s+++yPmhbyonmqZ2TLdwMpvXVQF4WaoGq6os6uAQ77U:RDtPJKQ7v5yamCmwjf6oNPQ77U
TLSH
T164B4071267E85035F1B35B70AFB556B14BBABC616D75CE2E23C0090D09B7A81FD20BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 484KB

setup.exe

IMPHASH faa0bc220f53587aedab9242f4908d7f
SHA256 dff3317950ddb7fa38c16208724d0d220c4af698d49b227da8dd006942184e17
MD5 bef2d19528be0171469dfdf30a94d8b6
SHA1 6489facbfc5cdab03bfbe7fe20604483cd13a180
SHA512 dd503d13e35c2d03d6bab08837f0f83e43d71c036f2286770d55c30b8d3452ab51361c65fbba634afa1445c41b3f4bd0ec6936b4126318e28c6bff712786a489
SSDEEP 6144:RDYWR5J+Wnp8JZt1u3s+++yPmhbyonmqZ2TLdwMpvXVQF4WaoGq6os6uAQ77U:RDtPJKQ7v5yamCmwjf6oNPQ77U
TLSH
T164B4071267E85035F1B35B70AFB556B14BBABC616D75CE2E23C0090D09B7A81FD20BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c5:36:53:46:cd:e2:1c:a4:fa:82:b4:03:e7:5a:8f:4a:95:79:68:81:b1:35:43:e0:a5:89:81:96:16:a9:73:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HonuaTek LLC,O=HonuaTek LLC,POSTALCODE=80228,STREET=957 South Cole Drive,L=Lakewood,ST=Colorado,C=US

Chains

Jun 13, 2021

CN=HonuaTek LLC,O=HonuaTek LLC,POSTALCODE=80228,STREET=957 South Cole Drive,L=Lakewood,ST=Colorado,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=HonuaTek LLC,O=HonuaTek LLC,POSTALCODE=80228,STREET=957 South Cole Drive,L=Lakewood,ST=Colorado,C=US

Serial Number

7e:91:47:b1:0c:d6:2d:da:5c:80:0c:83:05:0d:92:5e

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2018 - Aug 14, 2021

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Minor OS version

Major OS version

Entry point

195240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.pdb

kernel32

GetCurrentProcessId OpenProcess GetNativeSystemInfo EndUpdateResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW ReadFile Sleep GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte GetVersion GetModuleHandleW HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW MulDiv GetTickCount SetEndOfFile GetExitCodeProcess LoadLibraryW SwitchToThread InterlockedCompareExchange GetTempPathW InterlockedExchange FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetEnvironmentVariableA ReadConsoleW WriteConsoleW SetStdHandle HeapReAlloc LCMapStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW OutputDebugStringW LoadLibraryExW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW HeapSize GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent HeapAlloc TlsFree TlsSetValue TlsGetValue FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime QueryPerformanceCounter RaiseException LoadLibraryExA GetCommandLineW RtlUnwind InterlockedDecrement GetCPInfo HeapFree SetLastError InterlockedIncrement GetCurrentThreadId ExitProcess GetModuleHandleExW MultiByteToWideChar GetStdHandle GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW ScreenToClient SetCursor GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA GetWindowRect GetFocus

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord8 ord78 ord150 ord92

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

generic