setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 543KB
Sample261110-enqlmscg55
SHA256 11b3a760fc0dc63b76e32f0436b04fb59bcb3e33dba64fa172b48b0eb09e76b9
MD5 57c862882899199d2d76912a1bf685aa
SHA1 eee1509477f98bb3e9e536998d7eb0c294fdd76d
SHA512 047397aae853f11a184e03da95cf04759b005499fdb02029cca18956b75cbc942944c3519050859c9c1088e8259f17e7edc64d7a9074da8f6aba9209581d4898
SSDEEP 12288:HMOm++g05n4/0zIF/F9ywG6pveMb01JQntLOCQeC:HMOm++4mUcwjvemQe
TLSH
T1DAC4F61366DCBCB5E17216B0AB7B97E18B7EFC205A30C58F23C0055D5A7C5C2BA21B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 543KB

setup.exe

IMPHASH 73d77a8f6e914c6a62ba001fc9473930
SHA256 11b3a760fc0dc63b76e32f0436b04fb59bcb3e33dba64fa172b48b0eb09e76b9
MD5 57c862882899199d2d76912a1bf685aa
SHA1 eee1509477f98bb3e9e536998d7eb0c294fdd76d
SHA512 047397aae853f11a184e03da95cf04759b005499fdb02029cca18956b75cbc942944c3519050859c9c1088e8259f17e7edc64d7a9074da8f6aba9209581d4898
SSDEEP 12288:HMOm++g05n4/0zIF/F9ywG6pveMb01JQntLOCQeC:HMOm++4mUcwjvemQe
TLSH
T1DAC4F61366DCBCB5E17216B0AB7B97E18B7EFC205A30C58F23C0055D5A7C5C2BA21B96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

71:65:3e:89:a6:ba:7f:51:9e:8f:69:08:13:04:fb:3b:35:40:13:9d:ca:3f:1d:e1:c8:8e:2b:13:82:2c:55:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=University of Washington,O=University of Washington,L=Seattle,ST=Washington,C=US

Chains

Nov 6, 2026

CN=University of Washington,O=University of Washington,L=Seattle,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

217728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dbs\el\ddvsm\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

kernel32

OpenProcess GetNativeSystemInfo EndUpdateResourceW VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW Sleep GetTempPathW GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GetModuleHandleA GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte InitializeCriticalSectionAndSpinCount HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW VerSetConditionMask DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW GetCurrentProcessId MulDiv GetTickCount GetExitCodeProcess LoadLibraryW ReadFile SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA LCMapStringEx WriteConsoleW HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW OutputDebugStringW SetEndOfFile SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile TlsFree TlsSetValue TlsGetValue TlsAlloc HeapFree HeapAlloc GetFileType UnhandledExceptionFilter IsDebuggerPresent RaiseException VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetStdHandle ExitProcess TerminateProcess GetModuleHandleExW

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

SHGetMalloc ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW SetCursor GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects GetFocus SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA ScreenToClient

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord92 ord150 ord78 ord8

shlwapi

UrlUnescapeW

Name

.text

Size

375KB

Virtual Size

375KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

shlwapi

generic