setup[.]exe | Triage™

resource
setup.exe
unpack001/$PLUGINSDIR/nsExec.dll

setup.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 16637168f9d85bb5abe9dbcd2586ee859fd2981e7ea173c031e0cf3bf0ee4da8
MD5 a4a52244c3f8b83b049ad426cf41b1ef
SHA1 7c205b888de4da3cbda69fd6ed99c5973de98e41
SHA512 3b0148bdd68ea7d8386d5b1a011a47413e2323027ea71f43bd12672f25f975056ebe06a6235b385fcf85067ff5b11f0dbcb85d1f324f50faafb27750aa8edfcd
SSDEEP 24576:VbB07bbr9qsQ7N7LaRmWs0/SoCzeWikqPuHTt++pv0bQ1PzGYSYHXKK19FiO:E7bsv7V63sAyzSjPm++pcb0PzGR471B
TLSH
T16A282BB91615B64EC2DE49B4B3B1498C26172FBF60204FD7E606E056B3EF4087F6A931
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
TLSH
T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Cab.png

SHA256 ab24ed0b8b5b386fa2df64f97f6d7122c085097aaf1e28c2aee1cf3b4f0d2b9b
MD5 bb422058e733342662d85572ef7aee17
SHA1 f92958fef8442193d9f8a98b26b95f13ef82d8c1
SHA512 2c1bea214bad38bd580ef025308e8c17980453f04624431550b02fa29d2701f74ab164ed3c3863c546f4bfc5eea705e5bb6afa494f6867496006c94e2813eef7
SSDEEP 6144:2/PCFuGrCopU73WiDFiXBAG/jofMcPiLqK:2/grCnWiDhG/k1Ps
TLSH
T1C6442225EDC5BB51D370234D208B8BDA04636F6395AAAF5BE307877E473D8281EEE411
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Porsche.png

SHA256 7af66dcfc0d038a6fbb1516fa4a0378d6c99bf694f5fb610e78a9e9a0a2a9c9e
MD5 5f6c0ed4251e34b66366ecd37fcb4488
SHA1 71d1bdb81eb533b1258d8c7a1b6268418f47ef2d
SHA512 cb78a64c0c97b54fc4c232c06f96b82e524bc14b67bd1b0b8699f41dad1a0520cd7f78dd6863cc2474831d94c2aa8daf22b0b291968b6d86714fe2fc25e75de6
SSDEEP 6144:jGtoT5sAdJpSgY6dViIOWK4lHi2dJHzZf:qtoT5tpYciTgzJN
TLSH
T150242306AE64DA8B001CEE7EE551B0B0EBB843BB7E3CBA22D765B4023555413DFD0967
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Rebate.png

SHA256 1f7fbe3e9c082200a41676dc512501f51115ac0848f3b1a4f9e64bb98fe38da3
MD5 a88d798563dc65614d10a0bdef2797c2
SHA1 a7acfcb6e9e43fc3b04491508502abfc60737b19
SHA512 e80d6df5b1074ea88492078ac79bd6bdf9340eabac1edb950a0c27565ccfe3f36080b5e7f6a14feeb76f2930ef84d98eb1d7cc74d984b8468f9b92f704c1afbf
SSDEEP 384:x0f9mU9W5egpGK7FgbOncprEFQTdUPrQkg:ef9LEogpGKBgqncpgFQTwMR
TLSH
T175623BF4D2DA2103A78BF6A37B9649CEF872C30D1C16509C9EFE2A89D549CA41335937
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Recorded.png

SHA256 5a4f153424af06f2f9a6cef7f870c101675aae1e149cef20990302b705bf01d2
MD5 35d90c004c0703c9df9bc9b747d5f517
SHA1 ff2d57d26b01173076e6964310116cc607633b4a
SHA512 b6e5f8d832e995a22bc8106b205ba2c039ed31c249495a47cb01cd8b0517476d6fd547b47b2719c5865e9aa975ff374b61be5653eef9884da5185cad7c824666
SSDEEP 3072:SxaMNDe+HCoklH9fj/3KuLB+zPGMZOQNqkME96eFt:yagrHlsHljSS4zPGVQ0K3
TLSH
T1B3D312FA347B06654A99C3A287F374854D2BD8E1ABED760627AB01639B893C857017F0
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Routine.png

SHA256 dd2fb4c019966dc69c4088e412b841cd06fd2d2bfba765fef4da822be2dc0d3c
MD5 6e6d0251fb155ecf036ff79f3beae9df
SHA1 0d1aac8697937f95bff58ad36dcf4318ab9a5fb3
SHA512 b2b7598ab90783569f64ecddeae974c4c8d52c9109a0ab7a36e7a09a63945c63221be2cb3d8c89a07c8616f6119b522c3538557f93e5314a7b41cc7588cafa17
SSDEEP 1536:QRc7HKk2Gi43GTmIK/hgoBE0My1t+nIRJ8VJxAUcBTET4ceHtbzsJALXRW+V4ePp:QgHcGibmLhs0M4RMAUCC4ftPhLTuS
TLSH
T1B4A31267658E94833B159361BE8D112A5806005F4FDBB279ECD4880ABE1B74D2BF2CED
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Surgeons.png

SHA256 19f513ab375e7d374ac1bff5a51fd417f23ffabf2508da6531b008c49bcad81a
MD5 2194c7ca2274b7150db2064f096520a6
SHA1 0a7bb4baa914a3a485bc6984b942431ff3f907cc
SHA512 72eca6f7495bdbafb5f926d491ae69221f5229c553cc8245ab3be54aaf158c2684c040115cb82f7c3ad9887168698fcd8eac197308b96c1a5172023b26b5d866
SSDEEP 12288:xoZGa6Q99RFCDjbnbrAetkqTeh7l3jTTtcQm8rRmaSFnJL:y33RwHbbrKqm7N72aRmaUh
TLSH
T1D8B423AE8CD5B6E56E837D7D88B962CC5D9096715CB4080A2F7B188ED10FE830A1D377
MD5 SHA1 SHA512 SSDEEP TLSH

Captured

SHA256 93bbe9cd906fedf288d4a0f69b96c397e76df055607f274b42453a2ee28b4e12
MD5 41391584847bfb0a172ef243351db63d
SHA1 3170637257245708c6e7197fd026f8fee7de5b38
SHA512 38a8d56545973fe7b82cf4b3737dd393b1ec8d9f2ad72af6307041bdf219469d3b5cb0cd674726e54acac4df9325d3010c80932b1b4a3a1d08196c0f9bc1c3fc
SSDEEP 1536:mdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsESNvmtpAi6JvAeInT3VCz:eXib+tSijpcVMFXD5ypAXoegzC
TLSH
T120B39E13A943006BCB6312705D0FBA36B7FEDE2B0138E59647C90869F7E2495A51F2B3
MD5 SHA1 SHA512 SSDEEP TLSH

Cm

SHA256 0150b6bdbb90600639e49e8075f328b9e0212089b7201e51a97060608b60b10f
MD5 8fcecf61078fd0cd3231e4b9d8bdbfca
SHA1 1499faf5fb1e17718869c05a7a3a60f10198da0f
SHA512 a0c4b9bb35fd1574dfffefd010563b335ac059970c272dd4bef82f99483cb80b1a8e3bbd893c8428f93e82e9a9a232693d0c352d228c4dc1b9537f24d8a410e4
SSDEEP 1536:fMBNIWPuwaAwu+1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:EBN3vaAt+1Pfam6OzmkrJrRj
TLSH
T194E3820473B4C52AFFC7E67B5792C2064BFA7A9E8543412F20646BBAB8703B1077D961
MD5 SHA1 SHA512 SSDEEP TLSH

Cross

SHA256 7a25838b73012a6d4db5b3f54722e09edc590f93254b62c915e5936fa2881ea9
MD5 be4194dc14f2af6deaee908e3bd777f4
SHA1 7b35ebefcc3cdea9801cd547f72b2416d4da45a1
SHA512 688aef8d9eda8468bff6915ba2b1e774b2ff9969359af24171db99e7c39240f9dfbde30a64e045dc2b92e114a9deac089f2d94a11684e7e31b63c15d1952e057
SSDEEP 3072:LnasL9jC0O2iSW4QlXUxPrCtTRVB4Y3I09JwCIj4BPb1XuE/gc0Ag0Fuz08X8:vx1WUyB4Y3IW5Iuh0AOz048
TLSH
T1B7E36C1376E320E7CD7373F08F99EA69E776B91941318A3F03EC186AAF815029E55172
MD5 SHA1 SHA512 SSDEEP TLSH

Orchestra

SHA256 5683e251157d00d11325e85c9c2f7e6ef1b54b6b9d87731ec652985b938dc16c
MD5 4659443a0740a8a32996574ff6b4fbd9
SHA1 bf808cac4d86ad622921a0799e86cf0852fd87ee
SHA512 30cedf385d88bae110a79b02fee300d507ebe574bf089443fe5c7837eab9147203d447eee58d9d8d20af7aeb41dde163b028f2ece860bb3db525b7adced5c32b
TLSH
T1E0417623FF7D45A4F4B60139F88E4715D16A0476C32352C70FC9263766C5439A7494C9
MD5 SHA1 SHA512 TLSH

Product

SHA256 f30695c3d6ac71d0cbaf7501efeabc9850260703c96463e72831537a3acb7d8a
MD5 b2bde3aeceb2b098e012a5c7dd0e90ac
SHA1 694198bdf50e7f9310f0306c0b25054b26c20194
SHA512 26270e5cd9b60e84b17a596f78f2ba42d75f59eab015e6c54e3cfa3b0afa1a54104bb1d65ba48d19c527c208392b2005cc7bd49ece43b49818738b703adb5bff
SSDEEP 1536:ih63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:ih6DWy4ZNor+D62rqd2iXbvSS7iQ
TLSH
T195B38F535AA50557E4A77A38746FF73F0A68BD9F9B34B23A031C3FCA98206509894733
MD5 SHA1 SHA512 SSDEEP TLSH

Prompt

SHA256 8e1790435e4e3e190c99be5bf58237c7e686c37ff70b3ce5a6c66b41a4ec5acb
MD5 3b9e5a30697b19a5ee2c61e2305eeb6a
SHA1 57d2fca86633417a5a252e3af6f374fcbdb01310
SHA512 41e9c5a62191dae351eedaa2a2d6f11e5a7dd05c3a1c5d47058e0553deeab762d3daf921b29e99ae7c265daf17a9942b5ddad62fe38e58759000b179b0d58241
SSDEEP 3072:xxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3MD8jjg:xXuN2KFIyt+8ZUlhxb8As
TLSH
T1EBC39E127CC14031C95724708DBAA7BA9B3DA5601F28BEDF47991DB3CF206C09B6676E
MD5 SHA1 SHA512 SSDEEP TLSH

Publish

SHA256 6822bf2bd1f6d9fe20ce90efa4f77ce292bc20f32d042606ba0ddfa7c75933e2
MD5 11572607a9c18be790a1764cc11939ef
SHA1 25f76dd00b4de7a61b8faad5d76854e66a326f91
SHA512 f7d533837c6dd1d6910a197ef3d58af0592f8995aabcfa147d8016a1ec2264678d7426289da940021f5ca1837860dd83c02621ea99a89255c830d89e895345ed
SSDEEP 1536:KHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsc8MxqVZ:K8lghHzJi2ubSW4wC2mYR+HUDXOXT/Cm
TLSH
T16AD37D23B0C261A5C8D749F12D1BEBE27D78C93501349CC756D97DB9EA604A1AB2F3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Street

SHA256 4b06936b8a536e549a14c2b94527cbc828b9799c061f035a9f3ace25b8622695
MD5 6ff504390f2784c736d1cb86205329b2
SHA1 44df337b7b10382bbc5ef77dcb276db17a588766
SHA512 2fcc15308854ffabcf57ea29078ba4504c6febe54caa0a252e6153cc2e7e419c0fde8418275a984249171d6f97dfad46167759145f2dc24f513de21e708063b1
SSDEEP 1536:T0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xe5cl:geVzOqD1IGuTpMgKYbwR5Exe2/RTX/4g
TLSH
T1EDC3AE4194B0C2A1C6561D305C95FF52ACBC8DBA032A9ADFF7D80D63AE20DEB9D24D53
MD5 SHA1 SHA512 SSDEEP TLSH

Wallpapers

SHA256 7a04fa870f62c9d955bf14b4e1d36647cda95e9980fbb0cdb0ea6cccf8148640
MD5 95bdeee818ef7aa2effefe8fa5dd91a4
SHA1 d39ea3a0aaa223d2bee73827d9b3e9eafd41203b
SHA512 0d873c5bb5c201d0ae364d075bab1386433003a1b8883ec4f87c1b8287fc4276c3e880951cf0970a36fcb72468a649295ae9115a38acf8f09ab5a15e3b4bca0b
SSDEEP 1536:nIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5VqX25G5ClCQEiV2XaRodwTVCJ9XY:hStjOrOJGGMBwvqXQGYlawwBY
TLSH
T1B06329037B4200B2CE6747B18D5DB72BBBEC4A1B4486E71B531F08F0BB92526A55E2D7
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Utils.png

SHA256 37a010d9dc8f7e17948bf87c44a11f7a7e4e4813ba44e47b87ef81e926d3dcc0
MD5 d0489b17ecc76d707f8c0e5864bf6560
SHA1 ff85e350b4553432a8d77e022dd54436f2c48ff8
SHA512 ce929b96a4a6158d2eec07d41feb0023d6c3d0bba4bce0f359bbe59b57a59b4cec7772cab16e2fd899f09ef53561991f3161619dca5e984ab126d5be9739dd80
SSDEEP 6144:J4kOSG4O5zmU963+sZSri91gHehr/Q9ZHAFz+acSTtqrk:WMZozmUk3ZSuIHQIPKz7bJr
TLSH
T17944222EBA3EC2264E0D15A350667640735369A6E2053FF65459B35F3DB281BF30CED1
MD5 SHA1 SHA512 SSDEEP TLSH

setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Cab.png

$TEMP/Porsche.png

$TEMP/Rebate.png

$TEMP/Recorded.png

$TEMP/Routine.png

$TEMP/Surgeons.png

Captured

Cm

Cross

Orchestra

Product

Prompt

Publish

Street

Wallpapers

$TEMP/Utils.png

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Cab.png

$TEMP/Porsche.png

$TEMP/Rebate.png

$TEMP/Recorded.png

$TEMP/Routine.png

$TEMP/Surgeons.png

Captured

Cm

Cross

Orchestra

Product

Prompt

Publish

Street

Wallpapers

$TEMP/Utils.png