�{of%�����┍Y��af��������%���l�e��8w�ϯ��[���ФJFUtY���s|��Nn�"_r�DK��z�J�����j��4��q���M��xIRs�n�8���?�K�R.�{�v��������� �_ �da`q1��Jal_��uKe1���uCb��b��F^E9�%��Go�p��f@� �ؔ�H�:��X�cwK͌t�{g�ܴ�����O��B��5Tþ:|�^��2����"�?q�;^�4�{[�퓁�t��=�w��**�YeB���Ӯ�GmÂ��]�U��G�� $�jK�e�۱hfa�'�U�+ �?�j�O���"")'���~��S��>!�W�V�d�<Q ����X�ʧ OxO?Q��3I�qX͚��t��R����w:�����ic�\C��e���R��IE�|C�?zV�M��(:i�M���_M^�Fs��2��C�a-�n���N�_s����aM�jȂ`k�6_��(D�n�^Z�JVZ����O͎�{hS8��6ao� �z��E��v���nԌ}�~� �EW���zT���<����U�ϋR���']��1��϶c�ʭ�m�'��أp�q�s[����Rq��g������h��L� ����%��V\{KI���F��!&����ܰ�6�}�pL$�ml��پ����Rn�� Ĩi�X��r(��� �۠/��ɬ|��]�Cz �y���.G:E�^���lZwQC���5Ӛ���b����EC^�O�(*��:��O�v��8�Q��+�{�)T���K�Ke�w�r��������U�T�@Un����/���T�X z{��q�� �ث��f%]9& �fE���ry���[rO�^��;�����լ��� �}K��>�i6YUW1�cED�7��È� �������TSJq�&���oJ�AD�����=�ko0F�xC���7��ܡ�5^&u}|�J�8�x+�x���nYN��;f�s�;�p�D�L��/��|(�/���4D�ۇP�i��9�c2H�g���$ ��(������du��>��vso�.�f�_����C�;��)�ŃL&��� ��PV������@~���G���;�2SM��"�!���6���S4|�����LJ�ռ3K���-Uգ�6�P)�Nk�3ٮAN1�6�:�����}�ap������q2#8zƥ��,�ȍۣ�"��bA���pp��*�w|_)h���6%�q��F�];A\����M�p�P��@G���y����?��:Fx-�q�p��6�q~ �����K���oEo��.��;�D�iJ�c�$������A7������i(�ޤ+(��9��G��6]����V!yJ�en��?!Q�,L�5�`�%Kjl��������ź����<�q[ƶ�A6��� �ۓ�5����}Ҍ��p��膰�bR圜��S�p,I�u�b=Ȗ_�o��C� �l�)X�G��v$8�kn#E�7�z��*��h5%P���m��0}��[��4_���u�;�R�e�̮���Z�K-���|a���'7z.Z1�6��}��iÿ�D�h &��0����pb�ҟ�ꡒO�߽��t/���m�=�=MP�t���S��R��~�/�XP��M�p�^��<P �{��w�Ӎ����\��^g/�3��0dlkڐ^gb*'Pc$�Z�?�)+��R��SZ��{��i(P�NW���6�����Z�R��%s��H���Z�K7~���f�ZF��^T,p d�f�R�t�́��OЙ:�@��ϊ,��������Q=j���ɋ�'��=��#�T��uB�5�K����3H~O<rDmf��&:��n6�^F�G�-�t�s�T0�-]���H��nZN�ïD���J<�k����>N�[l����ّ(��ƶ`lv*�=��5r��!���'X���ΙN�� #3qx�mw�k&��Jm��E�n�d_�uN�����<�^����I�`��M�u��蜩�d����0]i���P��p���(�*Q�=��α�Vǰ܊��o�Ȗ%-��Ge� +:ܝ��̤QX(���~�Q��u{z�ӦM�? i�q%c��RYc"��)�?�$��3���u�\Zb��&�C�������JA ^L^GW�eܵ�n�,���іy;������)���imp6���ut���[T�D��s�ɿ,?�Z/��[�=|++^��' ��4pir�)w�7DzۗC�~��?����q��6� �K��i��ο��&�k:X���ӟ,�I���t̋o�ּwH��Y�й ��9�[�h�b]=�{�zp��4��V9���抙f]W��#?I�1�T����Q!O&�σ��qe՟,�����;ԥ��o��)VtF�7�ldO�Qi%�`&3Ut�Cx��ϿaLiL0�o������A{n;��$x�s�,��u�pc[.=�:Ȣ�׀�9�Sf���}�M���4ɦ��z8�Cl0G�ߧImMC��qCI��L Z����Đ����n��#���zI_Q㒲���v����.�Q���,dn�*(29`Ѭ8|$�]� [M���� ��G��ַ揺��Q*B�@?ӫ-qev�˘�ƨ�;֟{��7K�Uߛ�s��d��%�P���`κ�O$�ZK�:��2���y�)# �|R����&�pǭ:�cP2(i���;=+�1���G^�l��'N}���=������9A>�;��/pݚģI��>F@�����X�Z�y�!1��X�R:�3L��4�N����0~Ѐ"�&&z+Q �VYʬ'>�{��]<���W0��/T��(�z���'�L��E�&{�`�6Ak��~#���G�А��S?�df���K���� 6���dg8��bp��P2�i�;�������O*P� ^��)�����'"�S�y�X�=���f����u�ΊZ.�Vy���>�b��� =#�.v�;Wb��1�E���w�s�md�T���mK�+\Fo����Q_v�\X��n���5=����)����8-7�� j���Q� ���j=��x+fh�HMA���?#�ی(�5�*}�
Static task
static1
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20220812-en
General
-
Target
Installer.exe
-
Size
726.6MB
-
MD5
4a18eca46e5b202e614e5b0d69f6e9b3
-
SHA1
c8459e1dfa0eaf9bc64500c850ddfa2a1c91fdff
-
SHA256
070e276669c379bc0a2b8cf8bef518cd0a91a2b3dcf0e8ddb62339784581048f
-
SHA512
f032a449a0014737901ed74cd25a65eaddbad6c49bb27146790263de8a2987cd26f99b5e2bff0d6994ebe092188d513a9719177ca0debf570eecd9d169ed6a2f
-
SSDEEP
98304:RjRxgAbYvbDZhuIQRnm9hLeu6Snggd5erLaOB7At9Nd4WqVfqkezdQkjK/PTh:lRnbYvbDZh8RkLeOnGPalbsSAz3Th
Malware Config
Signatures
Files
-
Installer.exe.exe windows x86
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ke1 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.F8V Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.011 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 433KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ