setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 552KB
Sample261003-zyb68ayway
SHA256 5229816d13a3b851f292b0fa4169531b5e512b2b1d584ecdd9f2990354883827
MD5 32144f5ad90483c01f057e7852c3c970
SHA1 ee6c50e8a2df0ed18b5c45b2be64bba218d4175e
SHA512 e2879ed48b1fc058aa27e4ee203962cf1f5e6b08a34e888fa99a6f008dd216e71d94f528c10ddded740e1aa90e897a59a5e93f1c5428e5ecc770cba08f774a5c
SSDEEP 12288:sc/fX9rhmsdW5jivju3w1SC4LqwRlheMb01JQntLOC+/QW+:h/P9wsdWt4Cw4xLPem+If
TLSH
T1FBC4F61366D8BCA8E1B216706F7797E1977EFC201B30C49F22C0151D997D9C2BA31BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
setup.exe

File Explorer

setup.exe

.exe 552KB

setup.exe

IMPHASH d90c5f63eb809bc37f835a735e1e9181
SHA256 5229816d13a3b851f292b0fa4169531b5e512b2b1d584ecdd9f2990354883827
MD5 32144f5ad90483c01f057e7852c3c970
SHA1 ee6c50e8a2df0ed18b5c45b2be64bba218d4175e
SHA512 e2879ed48b1fc058aa27e4ee203962cf1f5e6b08a34e888fa99a6f008dd216e71d94f528c10ddded740e1aa90e897a59a5e93f1c5428e5ecc770cba08f774a5c
SSDEEP 12288:sc/fX9rhmsdW5jivju3w1SC4LqwRlheMb01JQntLOC+/QW+:h/P9wsdWt4Cw4xLPem+If
TLSH
T1FBC4F61366D8BCA8E1B216706F7797E1977EFC201B30C49F22C0151D997D9C2BA31BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

63:b0:d9:a3:08:60:71:3d:b9:65:c5:bc:fb:18:9b:ad:47:88:a8:0d:27:63:e5:e1:4d:ec:77:29:9e:16:c6:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ELTERN-PC\\Michele

Chains

Oct 2, 2026

CN=ELTERN-PC\\Michele

Minor OS version

Major OS version

Entry point

225168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dbs\el\ddvsm\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

kernel32

OpenProcess GetNativeSystemInfo EndUpdateResourceW VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW Sleep GetTempPathW GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GetModuleHandleA GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte InitializeCriticalSectionAndSpinCount HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW VerSetConditionMask DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW GetCurrentProcessId MulDiv GetTickCount GetExitCodeProcess LoadLibraryW ReadFile SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA LCMapStringEx InitializeCriticalSectionEx WriteConsoleW HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP SetEndOfFile IsValidCodePage FindFirstFileExW OutputDebugStringW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile HeapFree HeapAlloc GetFileType GetModuleHandleExW ExitProcess GetStdHandle LoadLibraryExW TlsFree TlsSetValue RaiseException VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind SetLastError TlsAlloc TlsGetValue

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

SHGetMalloc ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW SetCursor GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects GetFocus SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA ScreenToClient

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord92 ord150 ord78 ord8

shlwapi

UrlUnescapeW

Name

.text

Size

373KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

shlwapi

generic