)U�禎Q���57���ӎ��i��B}O� |�h2�%�yz���^+�#���F��ˢ�2���h��!E�dtW�ޅ����T�p�ċX��s���\��~�'�1֬�E%Nc&j��&��W��K �)-�8۠5ˎ���˷�噤���ؕ�Mm�&H"_lG `���p��c�rZS�������� �G�K*��+#{9a����M���n<��W�g��h�3aF[����\X&`����ۏߏ0��)'vg.�%��(�4��1�e��X�7���7�+ZH(w�ˁ �l�&��cJ$ؑA6T���L���I�$/KK/Y��DL�~���s���g�W-���V����6���E2�ʩ������y٣~��(�1936'J���p���S�F5pG[.7A��T.�I[�@%1R���lh� H?N3�:���Q������\˭�=�0������U���g��\�O�����g�`#OX y��Qy�V�����+��/y|Q�N��3��5�X���u�E�@R�P�Sr<����G=�.����.e&Q�\�2�y�@2�|Nb���ޛ�w�����3+A�<Pm\��/��w=�RF���B����a#���@��{�t���fw�C�wM��҉���~�W)���1̲bL����*k"�NzCR���5�wvQt n�:��CDv�璛���;��z7g�E��4b�]N"v�i���mu�]-�®[Ÿ�9�P�c�YG���H=�|��5@����H��1>�##�RGur������VP\�O��x�;6���S�,��:d��`uT��Y�rwf6��)t���y�K�M��c��?�;H�k��{{�H&uu�J�Q��Z�i��j�ҼO�^ޒx�$�Cn`�c�Z�����S������e�|������lx˱]$�f\{%�<}G!���+Q�ڵ��ʓr�.l)D�74b�� 2�����]�z� �S���x��]p���-���.͐�]!nI�R�t��.O������wH^� ��ӯ���\ ���g�^�(�y���{$&�� }U-4�i�� l���X&4�� k��阃Zh<]�g�ۢ� E���:û��ݾ�E�",�r��>��T��A��\L!� D��F��h �Ȧy��:��X������a�t�������������R,8l��>��w ��Pk彛���Rl���3�S'&�(�rn���RҸ6�h��g̎���1�����]������$�*u�y(aH�EE��q��� ��Sej��� �.(�齴��'��4 �$: ��h��[6�u�:�do��������Z&�au�W����V�'ɽ��Y�0�?67@qY��$��5Y)�϶«�ǖ�o���ն��+��F�h���le����\9EN�4.�62������@���x�� �t��(����[�3T=�J���sDT_x�"��LH&������(� ��=�բ�NAW�g���1>�"�kg�VP��Ƭ����������c:^&Ս�Or�7�pc�"2�c0���=�l���ݎ�B��*7'ع����ǣ��94�L(�,����Zّ_XݞeS��p�B�ˬ���5�k�Y�)V�v^� ����-�@�����T��tAWY�<DPQ��J��o�H�'��3?��+��ڇǦ��O����Ƭ\�"�z_����ޡdӉM��h���j�97���U��U�n���G���Y��m�D����rړ�{�k�g�ީ�������t�ú���R��4��]тp솛J`��\&��i�m>.�M���(�=�Z��kQ��T�_����Q*�O�N�+���}���=e�x�%��L�8�&�WL�!��#�j���oc��r�gC_^�����TT�����Ë�o2S[��5��p�S;�ٻ$s��(��kB�����8��y6�`6��E/��[�e�C�7ˋ��#)[a3��R���6��h��|�mr���刺 ���û���W�1K-��ex�h�P�z�����;㞍JJv��w;b*��_?i�u��LF�� ��� ����J�{�C�룰��Ꮾ0Uݰ'�[M���hE����d-��'��4����#?����|X~:���f�8ͪ8m ;�*p������k��u�X�(nN�`��9q:ux�Nv8?3=!<����G� +.^ƯBo�E���Z>�~mz�}�l���IFY9��O0��XEj/����D���8Y71��\m����i4�@�~Y��C��p[D$�p����w��7�=X�rie2#���0�?�Y�Ü������O���� o�k���ƻ�m_�\�ƥ<�Y�Nb�������U(�-�'ʔ�|� ?$tv�8� �`��nl�4%m�^b�#�A|�_�0��$��_ �K@�:q�j�n��n����yD1� u���fj<���|��Rf)�&�Z���:H#{+f�۬'�������?���Z0��A�.~�.�@A��w��#���p ߧ��L��K֤��tf��M5�q�C%�y�8�M��JF�Za=�H;P�f���n�Y �*t/�z��3*T�+���%t������������5̈́q}$O%@u�`�#�}��ϴ����"� Uo��<E��٣������I���ԍ�ba@Cr4�h�x��N�7m���ďv��wL�ϬI�*fO����h�$��7��:����g�ׂv�oG&���']o�M�)?�x_��f�0Ne����t��K�˖��*������e�����)z q���R�����Fo�0_�#����۩���=h����䌨��v�ʃ��~9��5Q���P�圫���R<�ynI���W l�� GhFB��ۅ:�b� P$&tZ�B2 ȩ5� տ]��v?�=��tu��e��UU��#�k�i���`i�AL�4:�0�f+�-��z�Yk#��)%v�� [���d�U��UR��>��͛����]!Y�y��%��@����(���X�0`\Q����8�1#�?�f�aē~���p���*l�{��"c�k �m��mw�
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
General
-
Target
Setup.exe
-
Size
7.0MB
-
MD5
78a28400e6a08d0d8191b364edd48f4c
-
SHA1
6f6ca86e3ec57862d83a8fb319894989de738262
-
SHA256
0fb2dfc0b927e6f7184eb66d22fa31d742b175da87bf324269f183e69222156a
-
SHA512
f818a5e91c63ef24f438ade179f2af5c44952daf785a12fe38d32bc1bdc8f1d4f37ee0a95f039c301abb0445846ba73e4681e1ce598eb4216571ff2ee376f683
-
SSDEEP
98304:wnNlbCNhjlRfp82kuW1MfSacJx1LO7RkXLqjgiAw72cDjORw1vAiNDtTKI:OOPlRfptAAVcvs2GgK7zO0trTZ
Malware Config
Signatures
Files
-
Setup.exe.exe windows x86
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Qbz Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.FB% Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.,[a Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 473KB - Virtual size: 538KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ