setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 636KB
Sample261012-ymzmpsee63
SHA256 46a93b75234ae31daf217734b25cb76768cfe684941078c1917ed364d65b12e8
MD5 13265551d30f5cebfd2320ccf50a520f
SHA1 7fbbbde6001d00a16cb42f4abba8bbff85a7acfa
SHA512 51eebe27732e70b8abdc70fea13faa2b9fee5861e047ff84e5e086aba22f4ef3621f0af79d51e37a603d5fe2c4d0e1a7359fbb495cb2686914306a24081175a7
SSDEEP 12288:xcyr9yqVNqN5SEZYLKNDUOYauj7fDxitSRnFmxa7Fw04dGHf2R:xcWoqVNqN5eLKurmxa7W8w
TLSH
T1E6D4064663EC02E4F1F7AA349972855ADB72BC525B35C2CF0254562E0E73AD18D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 636KB

setup.exe

IMPHASH 9aca4b9399bef3d2f436a7ea44ffce67
SHA256 46a93b75234ae31daf217734b25cb76768cfe684941078c1917ed364d65b12e8
MD5 13265551d30f5cebfd2320ccf50a520f
SHA1 7fbbbde6001d00a16cb42f4abba8bbff85a7acfa
SHA512 51eebe27732e70b8abdc70fea13faa2b9fee5861e047ff84e5e086aba22f4ef3621f0af79d51e37a603d5fe2c4d0e1a7359fbb495cb2686914306a24081175a7
SSDEEP 12288:xcyr9yqVNqN5SEZYLKNDUOYauj7fDxitSRnFmxa7Fw04dGHf2R:xcWoqVNqN5eLKurmxa7W8w
TLSH
T1E6D4064663EC02E4F1F7AA349972855ADB72BC525B35C2CF0254562E0E73AD18D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

b6:46:40:4e:0d:9f:5f:c6:54:48:12:93:dd:ae:b4:b4:c7:46:27:c7:bc:62:db:24:a4:76:41:bc:28:73:c6:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 11, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

211184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\Acrobat\Installers\BootStrapExe_Small\Release_x64\Setup.pdb

kernel32

GlobalFlags GetLocaleInfoW GetSystemDefaultUILanguage VirtualProtect GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetErrorMode RaiseException VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime LocalAlloc IsDebuggerPresent GetStartupInfoW GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetCurrentProcessId WritePrivateProfileStringW SetEnvironmentVariableW GetPrivateProfileIntW GetCurrentThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers lstrcmpA SuspendThread SetThreadPriority CreateEventW SetEvent CompareStringW GlobalFindAtomW GlobalAddAtomW OutputDebugStringW RtlUnwindEx RtlPcToFileHeader CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetFileType GetCommandLineA GetCommandLineW HeapQueryInformation GetStdHandle ExitProcess LCMapStringW GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetDriveTypeW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GlobalDeleteAtom LoadLibraryExW GetCurrentThreadId EncodePointer MulDiv GlobalFree GlobalLock GlobalUnlock GlobalAlloc QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetModuleHandleExW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW LocalReAlloc InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer GetUserDefaultUILanguage GetPrivateProfileStringW lstrlenW lstrcmpW GetModuleFileNameW GetVersionExW GetSystemInfo GetCurrentProcess GetTempFileNameW FindNextFileW FindFirstFileW FindClose DeleteFileW ExpandEnvironmentStringsW GetTempPathW CopyFileW GetSystemDirectoryW CreateProcessW GetExitCodeProcess WaitForSingleObject SetLastError GetLastError CloseHandle CreateFileW GetCurrentDirectoryW GetUserDefaultLangID LoadLibraryW FreeLibrary ResumeThread Sleep FormatMessageW LocalFree FindResourceW SizeofResource LockResource LoadResource SetDllDirectoryW GetProcAddress GetModuleHandleW GetSystemWindowsDirectoryW SetCurrentDirectoryW GetStringTypeW WriteConsoleW InitializeSListHead

user32

InvalidateRect DestroyMenu TabbedTextOutW GrayStringW DrawTextExW DrawTextW RealChildWindowFromPoint ClientToScreen LoadCursorW GetSysColorBrush ReleaseDC GetDC GetWindowThreadProcessId SetCursor PostQuitMessage GetSystemMetrics CharUpperW GetCursorPos TranslateMessage GetMessageW GetDesktopWindow GetActiveWindow GetNextDlgTabItem CreateDialogIndirectParamW GetMonitorInfoW WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowRect RemovePropW GetPropW SetPropW GetScrollPos RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW GetWindow SetWindowLongW GetWindowLongW GetWindowTextW SetWindowTextW IsWindowEnabled GetFocus SetFocus GetDlgCtrlID GetDlgItem SetWindowPos ShowWindow IsWindow GetMenuItemCount GetMenuItemID GetSubMenu GetParent OffsetRect SetRectEmpty GetClientRect SendDlgItemMessageA UnregisterClassW EndDialog PostMessageW EnableWindow KillTimer SetTimer SendMessageW MonitorFromWindow

gdi32

SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx ExtTextOutW TextOutW SetMapMode SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteDC GetDeviceCaps CreateBitmap SetBkColor SetTextColor GetObjectW DeleteObject

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle InitiateSystemShutdownW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

SHGetKnownFolderPath ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathRemoveFileSpecW PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW

ole32

CoTaskMemFree CoCreateInstance CoCreateGuid CoInitialize CoUninitialize

oleaut32

SysFreeString VariantInit VariantClear VariantChangeType SysAllocString

Name

.text

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic