The setup exe File Malware Analysis

Technical Analysis

File Name	setup.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.215.174
Database Version	2025-04-26 16:00:20 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	73b737337daf8096e9140ff38229fa41
SHA1	499d64e040f1b1aa5f45115d3c04bee7520a4c7d
SHA256	b9196933174086c41ce6e8d61131e55e3b50ed6b73f2f5d7b1fd456ba015f8ab
SHA512	f8423b03e5fc04a648564e3bc89106ae1b1dc48edfb7032e7e629580e7a3f99e91ddf952e9ea3ec757e5ed5910fcdf290a1872b095726418245487d401f7d3b1
ImpHash	688f19b448660a5d7ed68eba2bda8b2f

PE Analysis

Basic Information

▼

Icon	Hash: 28fd4b28ee26df641ce665653b1b314f Fuzzy: e66a836dbca05852a3ac53a78fd4b221 dHash: f0968ee8aae8e8b2
Image Base	`0x00400000`
Entry Point	`0x004048d1`
Compilation Time	2024-10-09 16:54:45
Checksum	0x0003d895 (Actual: 0x0003d895)
OS Version	6.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`D:\NNRus.git\CPPDownloader.SCB\Setup\Release\JDWrapper.pdb`
Digital Signature	Chain verification from CN=Poke Break, L=Paynesville, C=US (serial:8244338013359473444125470824395871871, sha1:bd8a6f785805e4dbd36b3d3cbf755d96e129a387) failed: Unable to build a validation path for the certificate "Common Name: Poke Break, Locality: Paynesville, Country: US" - no issuer matching "Common Name: Horseback Post, Locality: Biwabik, Country: US" was found
Imports	4 libraries KERNEL32, WININET, USER32, ADVAPI32
Exports	0 functions
Resources	25 Resources
Sections	7 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	88,382 bytes	88,576 bytes	6.63 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B27A46CF8B7FFBEDB951CB695A915904`
`.rdata`	`0x00017000`	30,588 bytes	30,720 bytes	5.25 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C9EC6A39DB36EA64133FA5B993700003`
`.data`	`0x0001f000`	5,776 bytes	2,560 bytes	2.35 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`43F0B29324758562BFAE2A66A66176B9`
`.gfids`	`0x00021000`	292 bytes	512 bytes	2.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`FF0471B4FEB27823ED77F9D7D7332150`
`.tls`	`0x00022000`	9 bytes	512 bytes	0.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1F354D76203061BFDD5A53DAE48D5435`
`.rsrc`	`0x00023000`	94,704 bytes	94,720 bytes	4.03 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6625F677F20F49549AC87BBEF90A0751`
`.reloc`	`0x0003b000`	4,908 bytes	5,120 bytes	6.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`95381F4BF4B1BFF2EE99DA3D205C3C37`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 25 (93,269 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	18	92,154 bytes	98.8%
RT_MENU	1	74 bytes	0.1%
RT_DIALOG	1	312 bytes	0.3%
RT_STRING	1	68 bytes	0.1%
RT_ACCELERATOR	1	16 bytes	0%
RT_GROUP_ICON	2	264 bytes	0.3%
RT_MANIFEST	1	381 bytes	0.4%

Certificate Chain Analysis

▼

Certificate Information

Verification Status

A certificate chain could not be built to a trusted root authority.

Certificate Chain Summary

Thought Integral #1 Primary

Validity Period: 2023-08-12 21:00:00 → 2026-08-12 21:00:00

Signature Algorithm: sha256RSA

Serial Number: 7A 6F 16 A7 0A EB 68 A9 4E AD 8D 4D 2E 6D 5D BE

Poke Break #2 Chain

Validity Period: 2024-04-04 21:00:00 → 2025-04-04 21:00:00

Signature Algorithm: sha256RSA

Serial Number: 06 33 CD 3F 2B B0 E6 87 4A BE 76 E0 83 DA 96 7F

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Chain verification from CN=Poke Break, L=Paynesville, C=US (serial:8244338013359473444125470824395871871, sha1:bd8a6f785805e4dbd36b3d3cbf755d96e129a387) failed: Unable to build a validation path for the certificate "Common Name: Poke Break, Locality: Paynesville, Country: US" - no issuer matching "Common Name: Horseback Post, Locality: Biwabik, Country: US" was found

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The setup.exe File Analysis