setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 97KB
Sample261030-afwepstyev
SHA256 98a04d8dab0e4d17740cc8b7633bc147600a8bc2510eae93d5df1f441f91c3fc
MD5 2d924493193f98594d9b167e6d7af441
SHA1 af97a02485610260427c85a449ec9162ec3c1b34
SHA512 6b0d5a7fe29142760bb20c81de87593717c190f835c4e0fc479f14adc833e48e89e32560e98d4dba532e73d2d29f490e708321492d4ddd56cf91b89ddcdfcd8f
SSDEEP 1536:KLpPGLVIUhCNRY6ygBM6C/rOZgEOjfjRt6gZWLCRoFPbJ38tl+GnAvK8nNYP:KFPGLVDhFD3ELCRoFDJstl3Avrnm
TLSH
T190A37C1276D2C0B1F8514A3544A9CF925F3B7C036BB9D2DBBB900A4F6E613D0DA7235A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
setup.exe

File Explorer

setup.exe

.exe 97KB

setup.exe

IMPHASH 76dae34c9ed587730b35ade2045f505f
SHA256 98a04d8dab0e4d17740cc8b7633bc147600a8bc2510eae93d5df1f441f91c3fc
MD5 2d924493193f98594d9b167e6d7af441
SHA1 af97a02485610260427c85a449ec9162ec3c1b34
SHA512 6b0d5a7fe29142760bb20c81de87593717c190f835c4e0fc479f14adc833e48e89e32560e98d4dba532e73d2d29f490e708321492d4ddd56cf91b89ddcdfcd8f
SSDEEP 1536:KLpPGLVIUhCNRY6ygBM6C/rOZgEOjfjRt6gZWLCRoFPbJ38tl+GnAvK8nNYP:KFPGLVDhFD3ELCRoFDJstl3Avrnm
TLSH
T190A37C1276D2C0B1F8514A3544A9CF925F3B7C036BB9D2DBBB900A4F6E613D0DA7235A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

36:7f:88:29:eb:16:1c:dd:f5:3e:b6:b6:df:dc:50:0e

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ability Plus Software (UK) Ltd,O=Ability Plus Software (UK) Ltd,L=London,ST=London,C=GB

Chains

Jan 1, 0001

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=Ability Plus Software (UK) Ltd,O=Ability Plus Software (UK) Ltd,L=London,ST=London,C=GB

Serial Number

0d:cf:b8:95:4a:86:0a:7b:ad:8d:2e:4d:06:5b:e6:aa

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Apr 27, 2010 - Apr 27, 2011

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

Major OS version

Entry point

23577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA FreeLibrary CloseHandle GetLastError GetModuleFileNameA GetSystemDirectoryA GetExitCodeProcess CreateProcessA CreateMutexA GlobalFree GlobalAlloc VerifyVersionInfoA VerSetConditionMask GetVersionExA GetCurrentProcess GetEnvironmentVariableA LocalFree FormatMessageA OutputDebugStringA WideCharToMultiByte LockResource LoadResource FindResourceA MultiByteToWideChar GetFullPathNameA GetFileAttributesA LoadLibraryA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind InitializeCriticalSection HeapReAlloc VirtualAlloc HeapSize GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA Sleep LeaveCriticalSection EnterCriticalSection GetConsoleMode CompareStringA GetProcAddress GetConsoleCP SetFilePointer VirtualFree HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError RaiseException ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection

advapi32

FreeSid AllocateAndInitializeSid

user32

CharPrevA ExitWindowsEx MessageBoxA LoadStringA GetSystemMetrics SystemParametersInfoA GetWindowRect DestroyWindow CharNextA MsgWaitForMultipleObjects CreateDialogParamA SetWindowTextA MoveWindow SetFocus ShowWindow SetForegroundWindow LoadIconA LoadCursorA SetCursor GetDlgItem SendMessageA PeekMessageA IsDialogMessageA TranslateMessage DispatchMessageA SetDlgItemTextA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

InitCommonControlsEx

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry InternetCanonicalizeUrlA

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

kernel32

advapi32

user32

version

comctl32

urlmon

wininet

generic