f���d2+֤E�pnI =�����5���r��'�јU���[�����F�3wWp��qʒ�Ƨ�N),�5��1�zV��������]([��������Q{J�(z� �x)��}����RP4œ�{���f�S~��⩗ ��0���Ȧ��܋�pn�l�kR�+c��%e�Ѱ1�P8 /E��2�et@��w�\�}�J�v)��|���V�f)��U]K]|$K�+�qʃ��9�gb[H�bg�� n �v�����@E�S,I{�р��>����6��%�����7�E �W���,���s7��(X���1��Z�4[57Z�����F��O���tD�Kl�[G��j,�i����嫩;$��*�PdIz8��,WXƆ���Oo��q�T��l��T_@�{{��_*�U�?������G��=�u�0zslL��u����.�1iSJ�5���T!c�$� Ѯ�B��"{ ��m&�V���jG�W��Dy妗���̭*|�S%kU�_U�3ҖS��u�;���bP8n6�A��=���� �*Բ���K7a�im6��-��6G�4T�|��5.6��-���] S&�3�T���w�01aBlz�{J�R@�w����u���vvg�+_�ͩ��R�|�9�+�K�?Yo��]��������?Y���2�_��A����o�>w@&�x��{�ƈ��}26C�����,]�n6��.'���Tg��{��:��87�q<<��]��(�_.�N5�M���������= �5��{S�F�r��&��}k �m��-���z�f�j��R��w5��"�EW�H(_1�U��l��o�&��d�^����l��{u���ܮ�[��)��Xr��(��e�۱�<<��/�sd�c<��Ã�Z^�I6���n�{�#�}� +���\�|b��h]=�wE�/&��ޚ�P��@�<��$PV������q��� Q����3��8�8�:�h���iR�n(�X��P��Uf�s���=`5ȶ��?y Re*($y�N;,�_�Ǒ0n�1���h�ʚ�=?�&|�������]sVL��RP���W����ŭ��"~�"���N�U�a��U��Ú�E/�yq=�Bp!ɒRR4���Ξ����5�/����؉^e�O��ݵ�����@�%T��|�,2��,�k���@ >\l�����R��;�����]qCO�b��OQ��G��7K�uc=�k��^)�����*P�9����1��u������xlĹ��`l&ѱo������[�|s��� l1����a#V��$O��#9]80W����ӂ!��&�L��s�YzH�ƴ����/O�#M�,ʑ�w��;��l�+4�h>B(H�w���Mb^�M�6�d;�+Awj��/�1U ��z���Ȁ��FK88��ȅ�`B��_���������K���nqA�/4�s����v��P�ig���`��q^�]`�������O��]�[��(�}�O��nZ�g���dx�s�tԉۊl�c,Lk��s�W 3�#L��D�L��7I� O�(�W��s;�<��̎G��&�8V��8��)�;#RlZ�KE� TA���,;w0��y�br���g/��Pb'h%{��F1γ� :�M�xs�N�_E�;P��ͧ�q1��� ���N���!ow�����ШL��⳽BHE>��{�"+�]��~a����;�]�r���.���?�WKtԢ���6��*��i�r�u#��(���֘䊁~B��z|���8�?���{�z)b��%��K��h?O|ѓ�C����w���=ؔ9q ץR�:�o�K���l���m3n�ٞ�����i�J+=���t�3H�H�V#�p��fWG���)�b7w��p�`}ArOTp���7,����t�Y-[��谖v�A��~W�@��a���'y���m`�R�vXY���ɖYf�@P@<���P����*3�H��~�,0���uHtEeq���h�[��)̷��o��`ve�2��[:�F3�k��c����&'E�t��sP�=~f��=Trp��0��GzR3Z>�~��b�Ҩ���[+̑\��Le]�K����XVmR�Zy7:����PR]aԷg\ ݖ.!�btO�Ȳڼ�G�e�ܕ>� ��Jx�c���.b$���%k;�V1p|��4!(��cl�K�8���L]+^����o�R��0�8 ��A5��7��f��sQ�K��L������ ����X��.s�"T�?�7�c���NZ�W�p��|������%z�Wa�.�R��xu嘋 i�a��F��7����rI-����"�O�y���@Z��=q0q�jq��Q���uÙ�GM�XK C��Ö_�y��B��(:Z�[�����������k��Q��S���jU����p��"��P�Ë��5a��w�~�@���yA��jT{]>8���(7�-+�������g6倇)��vV�q��q�=0}i��4m�#E��f���̈́��t��LMa�Z����������,�m���I��5�����ڠ�w]Z����s|��("���%G��qa�v�M|��Iӵ�}�����v�~�0U��Lo��kq�3}�e�e��~�PVLh�Mb����.qr��N���L��>�w��h��l0_j����y�2���+��ҬH�+����3+9" �� �]-j%k����b��,Y!��~^jux� *��E*%"ہ,Np���_w��V��*~�����S�Ki[z�Y��6v�; �4�q�%��y�z}ϊ��R]u�1��Ng�Me�T��("���S����}�Hu<T �F3�O����VtvA����:%{�#��l-�͒霡,���7�:2cQ��M[��&�����;G.��Kk��S�E�e�@� �����wD����g���+%!�5�l�����i5��M�,���}b��p��Ww��a8��0Ĩ�:$��F��[>��~F��y!4#��}%�#��M�e���6����R2z5)�8��PBc�RM�&�Q`<����6�\�˃{�����y� �S�ĺe��ϐl�������F
Static task
static1
Behavioral task
behavioral1
Sample
Setup 2.exe
Resource
win10v2004-20220812-en
General
-
Target
PA$$w0rds_1234__SetuperFree5--G7.rar
-
Size
6.1MB
-
MD5
5a904d6c9710c2cabfc8f23c288578de
-
SHA1
9666219cab7e99767b23058a4dcd1c81b8bb45ac
-
SHA256
586f0c058e263138e6f147a0d13e9cef92b8e099da004b096cb8629a0b8bceac
-
SHA512
cd8951190f6c51229c70321af2c8085afe2558d2068b922cf35a86f232c03f8937d0f8b9cd20413067cc43f8c99a5a50fbfe6693f0d9deaf5f9d39196d725033
-
SSDEEP
196608:hoPf1PN8TYTOfJ4ALyPzAv9Nsn0KiQYNA:hQtPN886fJGsDs9j
Malware Config
Signatures
Files
-
PA$$w0rds_1234__SetuperFree5--G7.rar.rar
Password: 1234
-
PA$SW0RDs is =..= 1234.txt
-
Setup 2.exe.exe windows x86
Password: 1234
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.5T} Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jXb Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.J1s Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ