�)��V]��q�'�۲Vl�nb�S� Ϧ�Px�>�B��E?;�A����ƥ��wu4�L���(P�������~ �%--��P�V�r}`Bt����(��μ��>��^ڭ�AW����N*YR4�Ș�v��S�w�i�L��*eimc��s'Uqm�߁� ]c��^ڊ�Pxib�4�j�l��>���':�B�� =g4D�o�^��6�Dr#�]�bRjΦ,���S%��t"���������p����,�wV͒�J��#�mk�&u���7�,�?���H���߭���8|�yY�& �v�ȾA�`� %P��T�Uܯ,\&�������z�?T���`������.�"C��n�p�k ��-��Б-)`ȁ�Ϥ&���C�K7� �� ��xؤ,k�Uy���:Bl�M�h�vͤԃHH�a��V4�/��(������)'��s�I��^����s� O4�pq 7�^ډ�>>����i�G�+���\���ҭ����;�=�s�1��zQ����Ef��g(�¢7&JX�Aނ�Nػ֖;�Q�H��Lap���L[w;�٧�h�2����L���Ƅ/a]�8WS�^2U���8�o��V::A�XZ���L��#C-�j�a����r+�{�ul%ܑ?���Y�k�j�`��_)!b_���n>>��M#|�'Ь7[���B�d�zf'�b����������_��67���� ��>�zjq���=G��'��3+�� � �e��׀@p�~�-��{'�d��.'������H��`�R�����R���^��м����g�G-,b�C��.K�LZ�8��c�����AO���2�f�W6��P�?N2x̰>!f���m_��H�u���u��m��4�VH� y���Iѥ���k�G�K�a�/�u!��h�|�#����{��߳��ΘK��I;�eZs�|�Q{�t�q2~���Iή*k���7�� r�\u$ٯ�����C��/��?�� ��G��? 4�I�����7>y��@2~��E�&"�~Rh�q �1D�u�ʓ�q���w������Ζu]g_襧���QGG� }�lbI����a�DU�I ��,)��Ջ[�X�K���!�mx;�Pb��8��.1��zy�����nT#~�Iۤ���w� ��h�8�'j�N@q����ەO��� &�U?�K��m�`]���6�X91V��j�L�30�}UVW���g��� (��ɌҐ<Z8�o7����s3���P[�A�@=|��ꏭ�����H�*}��{F�����.�>P�m!x47�kU�{�����^��Dta�n���c'���z\>[��O�xB��� mZ� ={������4�"�ę�� �� ��D��������q#Q��/��{�㖆�ͷ*���7VI}��W�X�&B�q���_��l̹�^|Q���i� � �g~�gt��c?U�(CT�(ll��wf� �1�? ����𡆡�����+my�8�0��6��g���¤��ӵ*��Iж�!oDW��đϟoh}ν�t]~^М�c�P^�lY������gf�De7xK՜���9�8h�O�̟�Y �R."O�_|����/�h�](n?_�EÔ�P^��O2h&�ʱ��^<�6p;H4�)20���������ά��6�A������f��5�(�[�䏿q��iu�Q�g!����(Qѷ|�Q.B}�*"f^�E�>o(�K�3�\���/L�[�^�����'��A��C�y��j(��q��<o%�����粹�P��� )i�����F� /�����c�c3�a�fj�{(�w^��Ը�Rݬ��)lC釁�>��*� v�=��z/�zdΚ�b�&^�QNC�GaG25���5L'�>M*VI"��m0zU'�%_Yk�w_6��`4,6E���߷�2��N���]�@bo�*"���Mً'i��O�m ۂ�>��̈ "�����[1��B�#��p+�î�_HD>֖���^���!�K��#<Mgˆ\�1�6��F�A�\|�����˧up�$��ڴ�]0:��;ѼR'aT����2u�h��Ǐ��)M2���r�gi�Ok�6���@���49�|��3HhL�+��1�h�{�غ(J~5�iy.� )2���FVq��%�~�p9xkB�5 ��T�s��<r{5���9x+�����h�{<(�L<�:�9kCC/(��*��mM�����5�o��ey��Ө��GB��)`v��Ni�Lj ��G���\S�/��[�������{��b˨���:#���y��e�B��g��|��f劝e8���W�v���)�a��*�7� �GF�:�wAk�/�z6W�ԁ��M�]�v��q��qń��8ᰙs�F�.\A��Ӹ�A�� ���RT}�z��z��EG��]s�e�������z]��N�ʅ$�6��01/^C�b�jJ��eF(��C��ަ���O��~����s�F:�n��z�K>`B�ˈ�`����{��PY��Sȸ�;����g1��t�G��/RpZs���S���U��&���I=�3�0��̷��I%b���=cb��˒!��\q���<�|�"�!�t� j�j�6p��0dUڇ��<$���%r��o����U�^ͦ��j���l��+������E�n��i'���X��4�7۔d|�aA�A_�Lէ�|��&�W�!e��$�Ǫ5 ���� �ߎL\��G�1]م|U֖�(��"��Aj �����"ҨG�W�qƼ����|�e?�n�Ǽ��,"��9E�S���?��.��f�r��1�Z�4p�C��[k�2 �e�$�q;�������IH}�,ϒ�)u`H ��J_��o�PC�0][�� h�i��\ѳ�4�\��yT��y�dS�j��w5�z��� �O�lG��P�Wbd���bW���1��)�����^�4SxL�i~�v[�9B�Ө|oa3��ܒsh/�)�#�1P�6�y\�r�vDY'�r-�T�IShfc0LP����L��^I0�����I~�2х�7��/��97���c�Eg#�����-��3�
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20221111-en
General
-
Target
setup.exe
-
Size
7.1MB
-
MD5
3fb1244ebcd61b895c741bb4cd4da7e2
-
SHA1
b758dfc9ad9ff3c80fe6f62f068ff4408fddd788
-
SHA256
9a380ad3f2980cb91e04de3c91a405de0075bbe26b4c68f9e427b6abf1da26ef
-
SHA512
aae15bcbf08d92c9452faf2181d72dd319240ac45ca0d9635b08b8eda7b0198a501ab3c7f92306cc1f66402e28dca3545b62345328c8d35db242b724beae0d59
-
SSDEEP
98304:DyTGbdTI5PVeb0iw1eU+BwcXAmjkBWSjWCuJdrQEg5EyrNGv/5NbV4bIgior45:JpAV8getjkBWwWCuJdrXg5HBGv7ii
Malware Config
Signatures
Files
-
setup.exe.exe windows x86
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bhjei0 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bhjei1 Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bhjei2 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 514KB - Virtual size: 514KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ