setup[.]exe | Triage™

General

Target
setup.exe
Size 452KB
Sample261110-2c8peabh45
SHA256 801a39ac7c0b21be756120516a3b672a8229e01e8695802f3b6cc916753108fa
MD5 e09041d43ba1eb0eb178f8dd088757a9
SHA1 21a9cb0c48c400914cdc1a8fd781d1f13cffd6d7
SHA512 efd2261c9f88d4f9373a3e45346f04c06e21e4616feb2b1c79f91d1b88e61a3a21d1b50ab3eda16395b3edf3156c5c32353cbaaafb2a71c14653fc1de6e79d82
SSDEEP 6144:RMIPv2svwyS4SvFSsfOK5Zu3Gf5wDromURyc9q5egzIlVmXAV3z5knYxqTrgOe:6IGZSsfOK5Z6GIk6Ile0knY4Tr7e
TLSH
T190A48C46F79045FAE177D238CA524A56E9B27C0A4721E74F13EC42A61F23360AD7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 452KB

setup.exe

IMPHASH e5433b71c20f7f47bc43a41e368a1812
SHA256 801a39ac7c0b21be756120516a3b672a8229e01e8695802f3b6cc916753108fa
MD5 e09041d43ba1eb0eb178f8dd088757a9
SHA1 21a9cb0c48c400914cdc1a8fd781d1f13cffd6d7
SHA512 efd2261c9f88d4f9373a3e45346f04c06e21e4616feb2b1c79f91d1b88e61a3a21d1b50ab3eda16395b3edf3156c5c32353cbaaafb2a71c14653fc1de6e79d82
SSDEEP 6144:RMIPv2svwyS4SvFSsfOK5Zu3Gf5wDromURyc9q5egzIlVmXAV3z5knYxqTrgOe:6IGZSsfOK5Z6GIk6Ile0knY4Tr7e
TLSH
T190A48C46F79045FAE177D238CA524A56E9B27C0A4721E74F13EC42A61F23360AD7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

fd:6c:95:bc:01:81:68:60:0c:37:4d:b9:f5:23:c1:3d:cd:65:6c:38:a0:27:5b:50:30:4c:a9:ff:82:25:bd:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=The MathWorks\, Inc.,O=The MathWorks\, Inc.,L=Natick,ST=Massachusetts,C=US

Chains

Jul 11, 2018

CN=The MathWorks\, Inc.,O=The MathWorks\, Inc.,L=Natick,ST=Massachusetts,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=The MathWorks\, Inc.,O=The MathWorks\, Inc.,L=Natick,ST=Massachusetts,C=US

Serial Number

3f:fb:aa:cd:a0:b5:62:04:8d:ab:c2:59:ab:ea:62:a5

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2016 - Jul 8, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

7016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB paths

B:\matlab\install\bin\win64\setup_setup\setup.pdb

kernel32

GetCommandLineW FindClose FindFirstFileW GetModuleFileNameW GetModuleHandleW LocalFree lstrlenW CreateFileW RaiseException FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize SetConsoleCtrlHandler GetProcessHeap LCMapStringW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessA CreateProcessW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetCurrentThread GetFileAttributesExW GetFileType OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW WriteConsoleW

user32

CharLowerBuffW FindWindowW RegisterClassExW DefWindowProcW LoadStringW CreateWindowExW MessageBoxW

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

user32

shell32

generic