Set-up[.]exe | Triage™

Resubmissions

05/09/2026, 22:55

260905-2wjjmagc883

05/09/2026, 22:52

260905-2ts1aatgpf3

05/09/2026, 22:46

260905-2p79eaar6w3

Sharing

Copy URL Twitter E-mail

General

Target
Set-up.exe
Size 5.1MB
Sample260905-2p79eaar6w
SHA256 0f080768009ceb81abee92896f731b768bcba77c257b080cc9c04f7ca7606f3e
MD5 e2b8bda7a64ad6bd83dc4d16536ccc2a
SHA1 ab8cb97969ca23985bfc7fd57e55fdd7c008889e
SHA512 65fec13b65c471decd9b218d303e8ba7696fc723a3d9a67abfe1e57a9b64e0c4690b511067c53186a32df005971b6bc5daaaf9881a0178aa12297318621189c4
SSDEEP 49152:qHZ7jCd/taDcVUtslFkw9+3/PgNno2ole0jzsNoIV7TouwCseBxhL67Sy5BpNTV2:MZ7jCdFJKtsl+m+3H9eAzsNZN
TLSH
T1B446D582A2E94465F1F32B756A3B09710A77BD511E38C48FA28CAD1D0BF36C1E531B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Set-up.exe

.exe 5.1MB

Set-up.exe

IMPHASH af8dfc05c446d8b739dd1bf6ef680c38
SHA256 0f080768009ceb81abee92896f731b768bcba77c257b080cc9c04f7ca7606f3e
MD5 e2b8bda7a64ad6bd83dc4d16536ccc2a
SHA1 ab8cb97969ca23985bfc7fd57e55fdd7c008889e
SHA512 65fec13b65c471decd9b218d303e8ba7696fc723a3d9a67abfe1e57a9b64e0c4690b511067c53186a32df005971b6bc5daaaf9881a0178aa12297318621189c4
SSDEEP 49152:qHZ7jCd/taDcVUtslFkw9+3/PgNno2ole0jzsNoIV7TouwCseBxhL67Sy5BpNTV2:MZ7jCdFJKtsl+m+3H9eAzsNZN
TLSH
T1B446D582A2E94465F1F32B756A3B09710A77BD511E38C48FA28CAD1D0BF36C1E531B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

d2:d2:88:8e:ff:b1:90:31:34:9d:df:51:8a:69:a6:07:47:5b:d3:ac:26:ec:1b:5f:3c:a9:05:5a:10:7d:03:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 4, 2018

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2017 - Sep 4, 2019

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1523220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\ACC\main\source\dev\target\win32\Release\HDCore\Set-up.pdb

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdW

shell32

SHGetPathFromIDListW SHGetMalloc ord680 SHBrowseForFolderW SHGetSpecialFolderLocation ShellExecuteExW ord51 ShellExecuteW SHGetKnownFolderPath SHCreateDirectoryExW CommandLineToArgvW SHGetFolderPathW SHGetFolderLocation SHGetSpecialFolderPathW

shlwapi

PathStripToRootW PathFindFileNameW PathIsDirectoryW PathIsUNCW PathStripPathW PathRemoveBackslashW PathRenameExtensionW PathFileExistsW PathRemoveFileSpecW PathAppendW PathFileExistsA PathIsFileSpecW PathRemoveExtensionW PathIsNetworkPathW PathAddExtensionW PathIsRelativeW UrlIsW

kernel32

LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary FindFirstFileW FindNextFileW TerminateProcess RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose WaitForSingleObject OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Sleep GetLastError Process32NextW DeleteFileW Process32FirstW CreateProcessW CopyFileW GetExitCodeProcess ReadFile SetLastError lstrlenW LocalAlloc GetFileAttributesW FormatMessageW GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW LocalFree MoveFileExW GetFileSize lstrcpyW lstrcmpiW lstrcmpW GetDriveTypeW InitializeCriticalSectionEx DecodePointer DeleteCriticalSection HeapSize HeapReAlloc HeapDestroy EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GlobalAlloc GlobalLock GlobalUnlock MulDiv GetSystemDirectoryW SetDllDirectoryW GetStdHandle AttachConsole FreeConsole GetConsoleWindow CreateMutexW ReleaseMutex InitializeCriticalSectionAndSpinCount AreFileApisANSI HeapCreate GetFullPathNameW WriteFile InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW CreateFileA LoadLibraryA GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA GetCurrentProcessId SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers CreateSymbolicLinkW GetUserDefaultUILanguage CreateEventW SetEvent ResetEvent TryEnterCriticalSection CreateDirectoryW GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW RaiseException ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW InterlockedDecrement QueryPerformanceFrequency CreateThread SetFilePointerEx TerminateThread ResumeThread GlobalFree SizeofResource LockResource LoadResource FindResourceW VerSetConditionMask VerifyVersionInfoW GetUserDefaultLCID LCMapStringW WaitForMultipleObjects DuplicateHandle ProcessIdToSessionId FindResourceExW GetThreadTimes QueryFullProcessImageNameW GetUserDefaultLangID SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime GetTimeZoneInformation UnregisterWaitEx QueryDepthSList InterlockedFlushSList LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW CompareStringW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThread WaitForSingleObjectEx GetStringTypeW EncodePointer LoadLibraryExA VirtualQuery VirtualProtect GetNativeSystemInfo CloseHandle GetVersionExW CreateFileW SetStdHandle GetModuleHandleExW ExitProcess GetACP IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleCP FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA DeviceIoControl GetCurrentProcess WideCharToMultiByte MultiByteToWideChar GetProcessHeap HeapAlloc HeapFree GetFileType RtlUnwind WriteConsoleW OpenMutexW LockFileEx

user32

GetWindowTextLengthW GetWindowThreadProcessId GetWindowLongW wsprintfW GetMessageW DefWindowProcW CallWindowProcW PostThreadMessageW LoadImageW SystemParametersInfoW EnableMenuItem LoadIconW GetSystemMetrics GetSystemMenu PostMessageW GetWindow GetFocus EnumWindows GetShellWindow AllowSetForegroundWindow GetClassLongW AppendMenuW DestroyWindow FillRect CreateWindowExW ScreenToClient SetWindowTextW RegisterClassExW GetActiveWindow ShowWindow IsWindow InvalidateRgn DispatchMessageW RedrawWindow ClientToScreen DestroyAcceleratorTable IsChild AttachThreadInput GetSysColor GetForegroundWindow MoveWindow SetFocus CharNextW BringWindowToTop TranslateAcceleratorW TranslateMessage LoadCursorW GetClassNameW SetCapture SetWindowLongW GetClientRect GetDlgItem PostQuitMessage GetClassInfoExW GetParent RegisterWindowMessageW ReleaseCapture SetForegroundWindow InvalidateRect IsIconic BeginPaint EndPaint GetWindowTextW GetWindowRect GetDC SetWindowPos MessageBoxW SendMessageW GetDesktopWindow ReleaseDC UnregisterClassW GetAsyncKeyState SetClassLongW CreateAcceleratorTableW

gdi32

CreateCompatibleDC GetStockObject DeleteDC SelectObject DeleteObject CreateSolidBrush GetDeviceCaps CreateCompatibleBitmap BitBlt GetObjectW

advapi32

EqualSid RegOpenKeyExW LookupAccountSidW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext SetSecurityDescriptorDacl SystemFunction036 RegQueryValueExW GetUserNameW DuplicateTokenEx ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf RegCreateKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CreateWellKnownSid GetTokenInformation GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW RegFlushKey RegSetValueExW InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid

ole32

CoAddRefServerProcess CoReleaseServerProcess CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitialize OleLockRunning CLSIDFromString OleInitialize CreateStreamOnHGlobal CLSIDFromProgID CoTaskMemAlloc OleUninitialize CoGetClassObject CoCreateInstance StringFromGUID2 CoTaskMemFree CoCreateGuid OleRun

oleaut32

VariantClear SysAllocStringLen SysStringLen SysAllocString OleCreateFontIndirect LoadTypeLi VariantInit LoadRegTypeLi SysAllocStringByteLen VariantChangeType VariantCopy SysStringByteLen DispCallFunc SysFreeString GetErrorInfo

bcrypt

BCryptFinishHash BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGetProperty

secur32

GetUserNameExW

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust

comctl32

InitCommonControlsEx

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

435KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=200, id=243, version=40116,

count=32, id=242, version=40116,

count=4, id=261, version=23013,

count=1, id=199, version=41118,

count=25, id=259, version=23907,

count=39, id=260, version=23907,

count=136, id=261, version=23907,

count=9, id=206, version=65501,

count=1, id=208, version=65501,

count=24, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=30, id=203, version=65501,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=528, id=1, productName=Unmarked objects,

count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=8, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=199, id=265, version=23918,

count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,