SetupPoker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SetupPoker.exe
Size 982KB
Sample260825-pg4j2asakc
SHA256 73801e22e75b398e9c2bdee96d7b5b1c29761dcbd1350b795a9e9f341c874167
MD5 c8a2c488c9881fc81366ba23265c19a7
SHA1 2319ac8db7ea0b09503adca5d34d67408ef48143
SHA512 856632ad2028437175489901e0bb30cafce22fd19a26cdf1af3a56cc32d2c79ed338ead283e89b6dcc33432df86eab138bd24efdd91ed7b788037bc34c4f9872
SSDEEP 12288:i1hKBS3HvxcduLSrzELRTg/mvdp1LF5vX4h40/JmkoiZDtSwE2gReIj9Bgu:kGS3vxcEDTnlpRF2FJmtyJSw/EbpBgu
TLSH
T11C256B607282E03BE6B201715A6C9AFA103BFF640F65A1DB57C57B6E1A705C24E31F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

SetupPoker.exe

.exe 982KB

SetupPoker.exe

IMPHASH bf5b3ca4d2d020ee1c8de73a5768247d
SHA256 73801e22e75b398e9c2bdee96d7b5b1c29761dcbd1350b795a9e9f341c874167
MD5 c8a2c488c9881fc81366ba23265c19a7
SHA1 2319ac8db7ea0b09503adca5d34d67408ef48143
SHA512 856632ad2028437175489901e0bb30cafce22fd19a26cdf1af3a56cc32d2c79ed338ead283e89b6dcc33432df86eab138bd24efdd91ed7b788037bc34c4f9872
SSDEEP 12288:i1hKBS3HvxcduLSrzELRTg/mvdp1LF5vX4h40/JmkoiZDtSwE2gReIj9Bgu:kGS3vxcEDTnlpRF2FJmtyJSw/EbpBgu
TLSH
T11C256B607282E03BE6B201715A6C9AFA103BFF640F65A1DB57C57B6E1A705C24E31F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

1f:13:4d:6c:86:33:39:a9:89:8c:ca:9a:92:66:24:2c:20:fd:d2:66:5d:da:dc:3f:e6:9d:7d:ab:2e:95:de:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Playtech Software Limited,O=Playtech Software Limited,L=London,C=GB

Chains

Jul 29, 2025

CN=Playtech Software Limited,O=Playtech Software Limited,L=London,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Playtech Software Limited,O=Playtech Software Limited,L=London,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Playtech Software Limited,O=Playtech Software Limited,L=London,C=GB

Serial Number

05:72:23:a3:b0:57:b0:93:09:b8:51:e2:71:ba:b9:d0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2023 - Dec 9, 2025

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

390165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repo\web-installer-new\WebInstaller\Release\WebInstaller.pdb

gdiplus

GdipAlloc GdipSetSmoothingMode GdipCreateSolidFill GdipFree GdipCreateFromHDC GdipFillRectangleI GdipDeleteGraphics GdipSetPenMode GdipDeletePen GdipCreatePen1 GdiplusStartup GdiplusShutdown GdipDeleteBrush GdipGetImageHeight GdipCloneImage GdipCreateBitmapFromStream GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageWidth GdipCreateBitmapFromFile GdipReleaseDC

wininet

InternetCrackUrlW HttpSendRequestW InternetCloseHandle HttpQueryInfoW InternetSetOptionW InternetReadFile InternetOpenW InternetQueryOptionW HttpOpenRequestW InternetConnectW InternetGetConnectedState

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

QueryPerformanceFrequency GetModuleHandleExW FreeLibraryAndExitThread ExitThread DeleteCriticalSection HeapFree InitializeCriticalSectionAndSpinCount HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc DecodePointer HeapDestroy GetProcessHeap GetVersionExW ReadFile GetStdHandle WriteFile EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW SetFileTime CreateFileW SetFileAttributesW DeleteFileW CloseHandle FindFirstFileW FindNextFileW FindClose SetFilePointer SetEndOfFile GetFileSize GetSystemInfo GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent GetTimeZoneInformation FlushFileBuffers GlobalHandle SetLastError InterlockedDecrement GetModuleFileNameW GetCurrentThreadId Sleep LockResource GlobalAlloc GlobalFree FindResourceExW LoadResource FindResourceW GlobalLock FreeLibrary InterlockedIncrement lstrcmpiW GlobalUnlock lstrcmpW MulDiv LoadLibraryExW GetSystemDefaultLCID GetProcessId LocalAlloc LocalFree GetExitCodeProcess CreateThread OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId GetFileAttributesW UnmapViewOfFile FlushViewOfFile CreateFileMappingW MapViewOfFile CopyFileW lstrlenA GetCurrentProcess TerminateProcess GetEnvironmentVariableW GetLongPathNameW GetVersion WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache LoadLibraryExA GetConsoleCP GetConsoleMode SetFilePointerEx GetLocalTime ExitProcess GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ResetEvent GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwind FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW SizeofResource

user32

EnableWindow SetLayeredWindowAttributes SetMenuDefaultItem SetMenuItemInfoW CheckMenuRadioItem GetMenuItemInfoW ShowWindow IsWindow InvalidateRgn DispatchMessageW SetTimer RedrawWindow IsDialogMessageW ClientToScreen DestroyAcceleratorTable PeekMessageW IsChild SetDlgItemTextW GetSysColor MoveWindow UnhookWindowsHookEx CreateAcceleratorTableW SetFocus EndDialog GetWindowLongW LoadCursorW GetClassNameW SetCapture SetWindowsHookExW SetWindowLongW GetClientRect GetDlgItem KillTimer PostQuitMessage SendDlgItemMessageW SetWindowContextHelpId MapDialogRect GetWindowRect RegisterClassW ValidateRect LoadIconW UpdateLayeredWindow UpdateWindow GetWindowThreadProcessId GetWindowTextLengthW GetMessageW DefWindowProcW CallWindowProcW GetWindow GetFocus DestroyWindow GetDC SetWindowPos MessageBoxW FillRect CreateWindowExW ScreenToClient SendMessageW PostMessageW SwitchToThisWindow CharNextW EnumWindows GetDesktopWindow CreateDialogIndirectParamW SystemParametersInfoW GetClassInfoExW GetParent RegisterWindowMessageW ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW UnregisterClassW CharUpperW CallNextHookEx SetWindowTextW TranslateMessage RegisterClassExW

advapi32

RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey RegQueryValueExW GetTokenInformation RegSetValueW LookupAccountSidW

ole32

CoGetClassObject OleUninitialize CoTaskMemAlloc CoCreateGuid StringFromGUID2 CoCreateInstance CLSIDFromProgID CoTaskMemFree CreateStreamOnHGlobal OleInitialize CoTaskMemRealloc CLSIDFromString OleLockRunning

shell32

ShellExecuteExW SHGetDesktopFolder SHGetPathFromIDListW SHBrowseForFolderW SHFileOperationW SHCreateDirectoryExW ShellExecuteW

oleaut32

DispCallFunc LoadRegTypeLi VariantInit LoadTypeLi OleCreateFontIndirect SysStringLen SysAllocStringLen VarUI4FromStr VariantCopy VariantClear SysFreeString SysAllocString

shlwapi

UrlEscapeW PathIsDirectoryEmptyW ord176

gdi32

CreateSolidBrush GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateDIBSection DeleteObject

crypt32

CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore

psapi

GetModuleFileNameExW

Name

.text

Size

556KB

Virtual Size

555KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SetupPoker.exe

gdiplus

wininet

version

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

crypt32

psapi

generic