setup[.]exe | Triage™

Resubmissions

01/09/2026, 23:28

260901-3gahvacp91

01/09/2026, 23:28

260901-3f73qacp9x

01/09/2026, 23:26

260901-3ezd7afc643

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 10.9MB
Sample260901-3ezd7afc64
SHA256 164e304e1f10eb59e6024f7073a2582d292497f341aaa232411a2a6e023ffa3e
MD5 3e3429ded6f44649021a863c2f36eeab
SHA1 830276b346da00269f3c682afc6e1b7ed73ad670
SHA512 a3d92fcdb7e67b83a7be50cd0fe99ecb70c16b32931ac5920402b98f2e84ec81b12524e4652d78e8fae31a3f5e4a5852c19ee8288e000ac8860ac34472217125
SSDEEP 98304:Jy+WsufZrRi3sm4in5UlBfy1GplyfjFqiDj8XifxbVlvh9R4MARhvjDsQSasS3Ne:Jy5Ti3sm4in5UlBfZKj4XGvh9RAhvIv
TLSH
T17CB65962A9A3406CF4726A3BC355467371A9B43AD798AEC6D5040D4017DF0B0DBEEBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

File Explorer

setup.exe

.exe 10.9MB

setup.exe

IMPHASH 7d777e798b54949e2858a1165d1ab9f3
SHA256 164e304e1f10eb59e6024f7073a2582d292497f341aaa232411a2a6e023ffa3e
MD5 3e3429ded6f44649021a863c2f36eeab
SHA1 830276b346da00269f3c682afc6e1b7ed73ad670
SHA512 a3d92fcdb7e67b83a7be50cd0fe99ecb70c16b32931ac5920402b98f2e84ec81b12524e4652d78e8fae31a3f5e4a5852c19ee8288e000ac8860ac34472217125
SSDEEP 98304:Jy+WsufZrRi3sm4in5UlBfy1GplyfjFqiDj8XifxbVlvh9R4MARhvjDsQSasS3Ne:Jy5Ti3sm4in5UlBfZKj4XGvh9RAhvIv
TLSH
T17CB65962A9A3406CF4726A3BC355467371A9B43AD798AEC6D5040D4017DF0B0DBEEBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11434902

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dcompiler_47

D3DCompile

ws2_32

WSACreateEvent WSACloseEvent send getsockopt ntohl WSAEnumNetworkEvents WSAResetEvent ioctlsocket htonl freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt recv htons getsockname getpeername connect closesocket bind accept WSACleanup WSAStartup ntohs WSAGetLastError WSAWaitForMultipleEvents WSAEventSelect

crypt32

PFXImportCertStore CertFreeCTLContext CertFreeCRLContext CryptDecodeObjectEx CryptStringToBinaryA CertEnumCertificatesInStore CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CertAddCertificateContextToStore CertGetNameStringA CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertFindExtension

bcrypt

BCryptGenRandom

advapi32

CryptHashData CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptDestroyHash

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceA

kernel32

HeapAlloc VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID HeapFree ReadConsoleW GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapReAlloc DeleteFileW SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP EnumSystemLocalesW GetConsoleMode SetFilePointerEx LoadLibraryExA GetProcAddress MultiByteToWideChar GlobalAlloc GlobalFree GetCommandLineA WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter GetVolumeInformationA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitializeConditionVariable Sleep GetLastError SetLastError CreateFileA GetFullPathNameW MoveFileExA GetEnvironmentVariableA VerifyVersionInfoW FormatMessageA GetFileSizeEx ReadFile CloseHandle LocalFree WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx CreateThread UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW CreateFileW IsProcessorFeaturePresent TerminateProcess ExitProcess GetCurrentProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwindEx GetProcessHeap HeapSize WriteConsoleW GlobalLock RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId InitOnceComplete InitOnceBeginInitialize GetSystemTimePreciseAsFileTime GetCurrentThreadId GetExitCodeThread GetLocaleInfoEx GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx RtlPcToFileHeader RaiseException EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW

user32

GetKeyState SetClipboardData GetClipboardData EmptyClipboard GetMessageExtraInfo LoadCursorA GetDC MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard

gdi32

GetDeviceCaps

ole32

CoCreateInstance

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

292KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.covirt0

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_WRITE

Name

.l2

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.0Dev

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

d3dcompiler_47

ws2_32

crypt32

bcrypt

advapi32

iphlpapi

secur32

kernel32

user32

gdi32

ole32

imm32

generic