setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 104KB
Sample261030-cl3gbavy8k
SHA256 27502f3ac5d1b6c5f8a3cf419eb012453fdd98e23f570c0d14cbb86a4cde8ed4
MD5 d7bbc5e2619440187d8ea2df049d372d
SHA1 b33dd70b1d7fcbc560a9944bf658c2fba82ab53b
SHA512 f835393db4a204adb123e4f869b35264b0aaabdad2b4bd3c4448880b8e168b7912517a20c1e48a7347c6f705185398a926a7f1db1e72211006693f7df873fe4d
SSDEEP 1536:VLpPGLVIUhCNRY6ygBM6C/rOZgEOjfjRt6gZWLCRoFPbJ38tl+HnAvPckOEz+:VFPGLVDhFD3ELCRoFDJstlkAvPckO4+
TLSH
T192A38D027692C472F8414A7984A9CF925F7A7C036BB9D2CBB7900A4F5F613D1DB71326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
setup.exe

File Explorer

setup.exe

.exe 104KB

setup.exe

IMPHASH 76dae34c9ed587730b35ade2045f505f
SHA256 27502f3ac5d1b6c5f8a3cf419eb012453fdd98e23f570c0d14cbb86a4cde8ed4
MD5 d7bbc5e2619440187d8ea2df049d372d
SHA1 b33dd70b1d7fcbc560a9944bf658c2fba82ab53b
SHA512 f835393db4a204adb123e4f869b35264b0aaabdad2b4bd3c4448880b8e168b7912517a20c1e48a7347c6f705185398a926a7f1db1e72211006693f7df873fe4d
SSDEEP 1536:VLpPGLVIUhCNRY6ygBM6C/rOZgEOjfjRt6gZWLCRoFPbJ38tl+HnAvPckOEz+:VFPGLVDhFD3ELCRoFDJstlkAvPckO4+
TLSH
T192A38D027692C472F8414A7984A9CF925F7A7C036BB9D2CBB7900A4F5F613D1DB71326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

70:c4:b6:b3:87:3f:81:39:be:26:df:da:3f:25:8f:74:d5:41:e7:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=ABILITY SOFTWARE INTERNATIONAL LIMITED,O=ABILITY SOFTWARE INTERNATIONAL LIMITED,L=Reigate,ST=Surrey,C=GB

Chains

Dec 1, 2021

CN=ABILITY SOFTWARE INTERNATIONAL LIMITED,O=ABILITY SOFTWARE INTERNATIONAL LIMITED,L=Reigate,ST=Surrey,C=GB

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ABILITY SOFTWARE INTERNATIONAL LIMITED,O=ABILITY SOFTWARE INTERNATIONAL LIMITED,L=Reigate,ST=Surrey,C=GB

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ABILITY SOFTWARE INTERNATIONAL LIMITED,O=ABILITY SOFTWARE INTERNATIONAL LIMITED,L=Reigate,ST=Surrey,C=GB

Serial Number

68:46:75:7a:ec:75:c1:39:59:cf:53:08

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2021 - Oct 21, 2022

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 27, 2021 - Jun 28, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

23577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA FreeLibrary CloseHandle GetLastError GetModuleFileNameA GetSystemDirectoryA GetExitCodeProcess CreateProcessA CreateMutexA GlobalFree GlobalAlloc VerifyVersionInfoA VerSetConditionMask GetVersionExA GetCurrentProcess GetEnvironmentVariableA LocalFree FormatMessageA OutputDebugStringA WideCharToMultiByte LockResource LoadResource FindResourceA MultiByteToWideChar GetFullPathNameA GetFileAttributesA LoadLibraryA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind InitializeCriticalSection HeapReAlloc VirtualAlloc HeapSize GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA Sleep LeaveCriticalSection EnterCriticalSection GetConsoleMode CompareStringA GetProcAddress GetConsoleCP SetFilePointer VirtualFree HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError RaiseException ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection

advapi32

FreeSid AllocateAndInitializeSid

user32

CharPrevA ExitWindowsEx MessageBoxA LoadStringA GetSystemMetrics SystemParametersInfoA GetWindowRect DestroyWindow CharNextA MsgWaitForMultipleObjects CreateDialogParamA SetWindowTextA MoveWindow SetFocus ShowWindow SetForegroundWindow LoadIconA LoadCursorA SetCursor GetDlgItem SendMessageA PeekMessageA IsDialogMessageA TranslateMessage DispatchMessageA SetDlgItemTextA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

InitCommonControlsEx

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry InternetCanonicalizeUrlA

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

advapi32

user32

version

comctl32

urlmon

wininet

generic