Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 1.8MB
Sample260927-eelw4ayblf
SHA256 594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811
MD5 d3cea61538aa5030e90a1d38cca762b4
SHA1 dd39fafbdba994169991cea092c6428e1d3b1539
SHA512 9672ce4ba4bef67039cbd5274a7e3e6010261d961b5eb2c45df254397b567923d72c40130ec7524cb15fcc6d32b5a50908f870329568c6830fe10916144f9af3
SSDEEP 49152:pJ1O7EpfelenkVglN5suzIEUP7ZmQNRBDXG+Chg9GPcPIvGqgu/2JZfy:pSVqkVglN5ye+m9cPW
TLSH
T1A4857D71279BC43AC57E80B02529FDBF943D5D269F5598C3A3D87D1E29384C21B32B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Setup.exe

File Explorer

Setup.exe

.exe 1.8MB

Setup.exe

IMPHASH 2d7ed674bd47447a9d38c498341321b2
SHA256 594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811
MD5 d3cea61538aa5030e90a1d38cca762b4
SHA1 dd39fafbdba994169991cea092c6428e1d3b1539
SHA512 9672ce4ba4bef67039cbd5274a7e3e6010261d961b5eb2c45df254397b567923d72c40130ec7524cb15fcc6d32b5a50908f870329568c6830fe10916144f9af3
SSDEEP 49152:pJ1O7EpfelenkVglN5suzIEUP7ZmQNRBDXG+Chg9GPcPIvGqgu/2JZfy:pSVqkVglN5ye+m9cPW
TLSH
T1A4857D71279BC43AC57E80B02529FDBF943D5D269F5598C3A3D87D1E29384C21B32B2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b7:4d:54:04:2c:40:c6:45:cc:5e:1f:9d:8b:77:73:5c:0c:2a:a9:72:85:c6:0b:c1:f3:2b:68:f4:dc:3e:98:de

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=201721910237,CN=FxSound\, LLC,O=FxSound\, LLC,L=Mill Valley,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 18, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:1b:08:f5:55:8e:9d:bb:c7:ea:90:53:10:f1:48:98

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2026 - Aug 3, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

876608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\Updater.pdb

kernel32

GetFileSize GetFileAttributesW CreateDirectoryW SetFileAttributesW GetFileTime WriteFile SetFilePointer SetFileTime LoadLibraryW GetProcAddress DeleteCriticalSection GetTempFileNameW GetModuleHandleW GetWindowsDirectoryW GetTempPathW EnterCriticalSection InitializeCriticalSection LeaveCriticalSection GetCurrentProcess GetSystemDirectoryW LoadLibraryExW CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW GetProcessId GetCurrentProcessId GetExitCodeProcess WaitForSingleObject TerminateProcess ReadProcessMemory FreeLibrary GetCurrentThreadId LocalFree GetTickCount LocalAlloc GetUserDefaultUILanguage FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW GetLocaleInfoW CreateProcessW MultiByteToWideChar FormatMessageW GetFullPathNameW SetLastError GetEnvironmentVariableW GetModuleFileNameW InitializeCriticalSectionEx lstrcmpiW VerifyVersionInfoW VerSetConditionMask lstrlenW CompareStringW Sleep GetExitCodeThread TerminateThread CreateThread Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW GetLocalTime FlushFileBuffers GetStringTypeW ResetEvent CreateEventW SetEvent GlobalFree MulDiv QueryPerformanceFrequency QueryPerformanceCounter GetSystemDefaultLangID GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW UnmapViewOfFile ReleaseMutex CreateFileMappingW MapViewOfFile CreateMutexW OpenFileMappingW OpenEventW lstrcpynW DecodePointer GetACP QueryFullProcessImageNameW FindNextFileW RemoveDirectoryW FindFirstFileW GetSystemTime FindClose WideCharToMultiByte ReadFile FindResourceExW FindResourceW LoadResource LockResource SetEndOfFile WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileSizeEx SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetFileType GetStdHandle GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx LCMapStringEx GetLocaleInfoEx VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CloseHandle CreateFileW CopyFileW MoveFileW DeleteFileW CompareFileTime SystemTimeToFileTime FileTimeToSystemTime GetLastError RaiseException CopyFileExW

user32

GetForegroundWindow AllowSetForegroundWindow GetWindowThreadProcessId AttachThreadInput GetDC SendMessageW GetParent LoadStringW SetWindowTextW PeekMessageW DialogBoxParamW GetActiveWindow DrawEdge GetWindowDC SetPropW RemovePropW SetCursorPos GetMessagePos ModifyMenuW LoadMenuW GetPropW MoveWindow GetIconInfo TranslateMessage DispatchMessageW LoadImageW MonitorFromPoint SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW UnregisterClassW SetWindowPos RedrawWindow IsWindowEnabled GetSysColor DrawTextW GetFocus DrawFocusRect GetClientRect GetClassNameW LoadCursorW SystemParametersInfoW CreateWindowExW GetWindowTextLengthW GetWindowTextW SetRectEmpty IsWindow ReleaseDC OffsetRect CharNextW InvalidateRect UpdateWindow GetCursorPos ScreenToClient PtInRect GetCapture ReleaseCapture SetFocus SetCapture SetCursor BeginPaint EndPaint DestroyWindow TrackMouseEvent FillRect GetDlgCtrlID GetSystemMenu DrawMenuBar RegisterWindowMessageW SetMenuDefaultItem GetMenuItemID GetSubMenu TrackPopupMenu PostQuitMessage DestroyMenu LockWindowUpdate CreateDialogParamW GetMessageW CreateIconFromResourceEx LookupIconIdFromDirectoryEx GetClassInfoExW MessageBoxW SetForegroundWindow EnumWindows ShowWindow GetSystemMetrics EnableMenuItem GetWindow IsWindowVisible RegisterClassExW PostMessageW KillTimer SetTimer GetDesktopWindow PostThreadMessageW EndDialog MonitorFromWindow GetMonitorInfoW GetWindowRect MapWindowPoints EnableWindow GetDlgItem BringWindowToTop

gdi32

GetObjectW PatBlt CreateBitmap SetTextColor CreatePatternBrush GetStockObject DeleteObject CreateFontIndirectW SelectObject DeleteDC GetDeviceCaps SetBkMode

shell32

SHGetSpecialFolderLocation Shell_NotifyIconW ShellExecuteW SHBrowseForFolderW ShellExecuteExW SHGetFolderPathW SHGetPathFromIDListW SHGetMalloc

ole32

CoCreateGuid CoInitializeEx CoTaskMemAlloc CoTaskMemRealloc CoResumeClassObjects CLSIDFromString CoCreateFreeThreadedMarshaler CoAddRefServerProcess CoRegisterClassObject CoRevokeClassObject CoCreateInstance CoUninitialize CoTaskMemFree CoReleaseServerProcess

oleaut32

SysFreeString RevokeActiveObject DispGetIDsOfNames SysStringLen LoadTypeLi VarUI4FromStr GetErrorInfo SetErrorInfo DispInvoke SysAllocString

gdiplus

GdiplusStartup GdiplusShutdown GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromHICON GdipBitmapSetPixel GdipGetImagePixelFormat GdipCloneBitmapAreaI GdipGetImageHeight GdipGetImageWidth GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdipAlloc GdipFree

shlwapi

PathFileExistsW PathIsUNCW PathAppendW

comctl32

CreatePropertySheetPageW InitCommonControlsEx PropertySheetW DestroyPropertySheetPage

uxtheme

EnableThemeDialogTexture IsAppThemed

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

ole32

oleaut32

gdiplus

shlwapi

comctl32

uxtheme

generic