Va%Ӗl��0�{�~�}�����_"�O���B7�v����:>e�>sdMܐNI3����u[b`&���k�jB�����P�v�ϟ��.��u4y����x��?���e��/�f�H�t�Ae8,Pfԋ`=�&`���p��s��O3���m�{�p �bE�_ǡ�܂�I��_c�ɳ�nڔ�n�3T2q�p����m�MAG���X(��e������#t��{R���������OWt�Wn���3+��$:���� arSHM��+��o�m�jҪ��o�Q({};a�h�@�<���}�۰p��-~5�������d9ۥB�^����WGp�Qf5̲�ᕍ�I ���Ń���c��p��Z+�����%a��& *y��8(5嘈]�p'y�8�⡭��>��_���)�s��<�~-ܿ���ȜbrkR�r���c3�o�����3f�S3�O��:�Ҏ'�E�iB۹v��Ǿ+���|NM�B���/�3���� 0��������Q��$`�@�+H=M�'0qG�TƱ� q��Q9���q�����c���I��/�)F;;���Zx�U�~�蒙���s*������kA�VjxqJ4�X�F3�7A�C:y�} ��|[�t-~���P�c�=C���v5� z�j#�`���Fs^�6{�܊�a�4fHv� j?����{]��j�E�flv']�t��W��� �_�U�0�y�#���l�C���]d�W�摵��`I��Jm# ���0�(EΎ��&Y����Ş�y_�s<QW���:�1�(4�ۜj`sW{c��> �}���ɋ{{�Q�i��>iE����BӤ0^���P���S����z�����h!���M���3Wsbb��N2���-�&c��>��M6I�yxN%x%cqUz�.��:(�l� 3�9xg�u5�#Js*s ��I��_�Ο;��'m�Y��우G�3J�?�m�m�����Y������*��$��^�|���7~%�L������[�a�YC9P\OH�wM�Rhk�Gu�Æ{V���X�?usq����86p�J�� s�h�L�џ�����Ǟ,ýK��oM����5(4:��æ;-��s�*��+�̢�$�{B���B���c�W�8��j6�^��9CX��臲�����ќ���$a���մ����έ�8p�T�NN �|]�I���[JA�C����Ga�����+�����$w�o/�P���W�!����M�ĦL4��#h�����Ĥ���/l��Qo<�/�"B���Jm�5n��`�{h(�m�"<���^W�.U��,�t�|v_�<혪�A�ڡv�Č�pzU���K�6C9٪6���H�!���S�DC��q�q����ؒ�f�Kw�ːcB'+7uE�<!���"��u.�d���$���!q�3�EԙXO�ɲ�� �t����E�%}�}�����sU>�v�l�k`< ���������U���������@O#�'��Ҟ ^eKon����1������I!��fh���a���II¹<��u;����f����e���1�5����mP��`���k�I��Є�F��j�z��S�$v�&�$h��w��5]�@���n��?�"�=��|/>;#������⛎�dF���PC��T�sk�ܶ]�4+N���b������*R��E����Dz'�b�vCB� ��7��t6�F�Ƿm��m�������П.�X Y<k�FQ��1������M�sNԒ��<<+j�H�.W��fJ�V��ޘ��� �k�T7LfZ�D�,:�ے�4+,�l|��$?۽� ��s�Wᵣ��9�9w����EH<�e�;Utܺ�} ?;����? |LE3Wo�S�e�N�mFpu�8/�ƽ���f-0L;?-pe��y�&2�c����*�����w�jvG��� �}7]]�h��J0������g?��z�\��P!���i��'�ش'Mu&[Y�����$�BƠ%P��*��D�<���)E颜�4�c�W��+M(2i�[��P�7�[*J�BC�5�e$�O������Ѣ~B�>ɏ��������s�fn0N��3|�p �����I�s1��{��S+M��G9�w���UG'��d�fS��B��M���+���&Ouf�w�H&���:�����vB֢��N��n�Q�k�u<h>a�v�~�,�8ED#L��q�1)y2�V�О%�u�6o�o���'`�HĽ�1z�LƦG̿��b�_���p�m3M�u�ܠQqm�Q�1j���9��"���I?���{��ݛ���J�YC����q���Tό�M�g�%~�C=�z�2-h��g��^�J7�§�ԏi\��+G"�Dv]G&��Z��g���ˡES<�}�<�{�FJȦ2��P䋅��a�n�r���I+���w��C`ė�+�T�ۢ�9�<�6b�{����5���}�w�.8��4Xe]%`PM"V*��)��+��y 6 B� �]S5 1Kw�S�P�N�����2�@X��`��ۨQ�� �Y���OW^�2]dR�k��y��*x�w��DP�8����/��u\Tp�FL��2f��&i�ߢs&��[@�T����H����/����`8r�nD�%�B!�SRI<��%Bk�W��ji�s`"�����@?~�Ix�e��@�&��G9�����`��+D\~wud��8�;�Z��uL���/�!�nUũ$��!R��I�v�g]�����ø ����՜"-v�f�͗�Ω��>u�K�V|����y�S��Axn��7��:�O����<Hԝ�t����y��q�'J$W�ioQ#/SP_oY���읿|H�{���J�I/�P�ko�z��������@�m�t:��~K���e��ڻ����\0�]�r���?����lB�!=�- ���\��p`A�Pw�\���8�2x���S��� ��E�-ǰ�A�^���� ���_�Y0�[��5K~;�d��������c���lF�kd������\K�:JW���]{�-�u��R��Vإ��pU��̲��$Y
Static task
static1
Behavioral task
behavioral1
Sample
Set-up.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Set-up.exe
Resource
win10v2004-20220812-en
General
-
Target
blah.zip
-
Size
7.0MB
-
MD5
9d81f21d2cbd5189a9e89baece497a79
-
SHA1
c0507464bd121743bb90ba3658435ef33a311c81
-
SHA256
98f3d0d09c5cf0251e7e94e85985990487547058fec2b95a6c612ec636d31661
-
SHA512
baa10befa374734c87ec31a6d63c96229de658c653121097c03f8da5e6f03acfb472ff111f4db05f7dea1fb3a0e757fb0aa6f450e4de0eb478a212a23c6c8c11
-
SSDEEP
196608:LAw7WHt8svZDcVFZ21U0yCoUROl3wudHdfTzdL7Km+:Ll7YZZIVD217yXwmgc7zBKm+
Malware Config
Signatures
Files
-
blah.zip.zip
-
Set-up.exe.exe windows x86
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.q>, Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.x|h Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fTK Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 448KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ