Static task
static1
Behavioral task
behavioral1
Sample
Setup.zip
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20220812-en
General
-
Target
Setup.zip
-
Size
1.9MB
-
MD5
fe25d77b8a2cf7dafddd4dbef68a7cbe
-
SHA1
24f22d5c34f132fb5f2f6f6a9c354533a3199b40
-
SHA256
74f8b83b2aba3cc58eec8f4a56028ce4a6b7802f756abd2d2159e53b8ea234fe
-
SHA512
f700297e9333a9def5bf6d0a30054d9a2c6e3503aa8e8b9d93e3833f3d79a49cb8fb221009aefbae75dd50b19b590e157218a60a2f4d1430ce6210fea2f9bceb
-
SSDEEP
24576:YQMYov+dUrmK2T+YvSrAMEznlAFKSBzrRX6EhpDknUL:YQDoiUr/iqrAPznlAFKSRrRnhpYne
Malware Config
Signatures
Files
-
Setup.zip.zip
-
About/ActiveXInstallService.admx
-
About/AddRemovePrograms.admx
-
About/AppCompat.admx
-
About/AppXRuntime.admx.xml
-
About/AppxPackageManager.admx
-
About/AttachmentManager.admx
-
About/AuditSettings.admx.xml
-
About/AutoPlay.admx
-
About/Biometrics.admx
-
About/Bits.admx
-
About/CEIPEnable.admx
-
About/COM.admx
-
About/CipherSuiteOrder.admx
-
About/Conf.admx
-
About/ControlPanel.admx
-
About/ControlPanelDisplay.admx
-
About/Cpls.admx
-
About/CredSsp.admx
-
About/CredUI.admx
-
About/CredentialProviders.admx
-
About/CtrlAltDel.admx
-
About/DCOM.admx
-
About/DFS.admx
-
About/DWM.admx
-
About/Desktop.admx
-
About/DeviceCompat.admx
-
About/DeviceInstallation.admx
-
About/DeviceSetup.admx
-
About/DigitalLocker.admx
-
About/DiskDiagnostic.admx
-
About/DiskNVCache.admx
-
About/DiskQuota.admx
-
About/DistributedLinkTracking.admx
-
About/DnsClient.admx
-
About/EAIME.admx
-
About/EarlyLaunchAM.admx
-
About/EdgeUI.admx
-
About/EncryptFilesonMove.admx
-
About/ErrorReporting.admx
-
About/EventForwarding.admx.xml
-
About/EventLog.admx
-
About/EventViewer.admx
-
About/Explorer.admx
-
About/ExternalBoot.admx.xml
-
About/FileHistory.admx
-
About/FileRecovery.admx
-
About/FileRevocation.admx
-
About/FileServerVSSProvider.admx
-
About/FileSys.admx.xml
-
About/Globalization.admx
-
About/GroupPolicy-Server.admx
-
About/GroupPolicy.admx
-
About/GroupPolicyPreferences.admx
-
About/Help.admx
-
About/HelpAndSupport.admx
-
About/ICM.admx
-
About/IIS.admx
-
About/InkWatson.admx
-
About/Kerberos.admx
-
About/LanmanServer.admx
-
About/LeakDiagnostic.admx
-
About/LinkLayerTopologyDiscovery.admx
-
About/LocationProviderAdm.admx
-
About/Logon.admx
-
About/MMC.admx
-
About/MMCSnapIns2.admx
-
About/MMCSnapins.admx
-
About/MSDT.admx
-
About/MSI.admx
-
About/MediaCenter.admx
-
About/MobilePCMobilityCenter.admx
-
About/MobilePCPresentationSettings.admx
-
About/Msi-FileRecovery.admx
-
About/NAPXPQec.admx
-
About/NCSI.admx
-
About/Netlogon.admx
-
About/NetworkConnections.admx
-
About/NetworkIsolation.admx
-
About/NetworkProjection.admx
-
About/OfflineFiles.admx
-
About/P2P-pnrp.admx
-
About/ParentalControls.admx
-
About/PeerToPeerCaching.admx
-
About/PenTraining.admx
-
About/PerformanceDiagnostics.admx
-
About/PerformancePerftrack.admx
-
About/Power.admx
-
About/PowerShellExecutionPolicy.admx
-
About/PreviousVersions.admx
-
About/Printing.admx
-
About/Printing2.admx
-
About/Programs.admx
-
About/PswdSync.admx
-
About/QOS.admx
-
About/RPC.admx
-
About/RacWmiProv.admx
-
About/Radar.admx
-
About/ReAgent.admx
-
About/Reliability.admx
-
About/RemoteAssistance.admx
-
About/RemovableStorage.admx
-
About/Scripts.admx
-
About/Securitycenter.admx
-
About/Sensors.admx
-
About/ServerManager.admx
-
About/Servicing.admx
-
About/SettingSync.admx
-
About/Setup.admx
-
About/SharedFolders.admx
-
About/Sharing.admx
-
About/Shell-CommandPrompt-RegEditTools.admx
-
About/ShellWelcomeCenter.admx
-
About/Sidebar.admx
-
About/SkyDrive.admx.xml
-
About/Smartcard.admx
-
About/Snis.admx
-
About/Snmp.admx
-
About/SoundRec.admx
-
About/StartMenu.admx
-
About/SystemRestore.admx
-
About/TPM.admx
-
About/TabletPCInputPanel.admx
-
About/TabletShell.admx
-
About/TaskScheduler.admx
-
About/Taskbar.admx
-
About/TerminalServer-Server.admx
-
About/TerminalServer.admx
-
About/Thumbnails.admx
-
About/TouchInput.admx
-
About/UserProfiles.admx
-
About/VolumeEncryption.admx
-
About/W32Time.admx
-
About/WCM.admx
-
About/WDI.admx
-
About/WPN.admx
-
About/WinCal.admx.xml
-
About/WinInit.admx
-
About/WinLogon.admx
-
About/Windows.admx
-
About/WindowsAnytimeUpgrade.admx
-
About/WindowsBackup.admx
-
About/WindowsColorSystem.admx
-
About/WindowsConnectNow.admx
-
About/WindowsDefender.admx
-
About/WindowsExplorer.admx
-
About/WindowsFileProtection.admx
-
About/WindowsFirewall.admx
-
About/WindowsMail.admx
-
About/WindowsMediaDRM.admx
-
About/WindowsMediaPlayer.admx
-
About/WindowsMessenger.admx
-
About/WindowsProducts.admx
-
About/WindowsRemoteManagement.admx
-
About/WindowsRemoteShell.admx
-
About/WindowsServer.admx
-
About/WindowsUpdate.admx
-
About/Winsrv.admx
-
About/WordWheel.admx
-
About/WorkFolders-Client.admx
-
About/WorkplaceJoin.admx.xml
-
About/en-US/ActiveXInstallService.adml.xml
-
About/en-US/AddRemovePrograms.adml.xml
-
About/en-US/AppCompat.adml.xml
-
About/en-US/AppXRuntime.adml.xml
-
About/en-US/AppxPackageManager.adml.xml
-
About/en-US/AttachmentManager.adml.xml
-
About/en-US/AuditSettings.adml.xml
-
About/en-US/AutoPlay.adml.xml
-
About/en-US/Biometrics.adml.xml
-
About/en-US/Bits.adml.xml
-
About/en-US/CEIPEnable.adml.xml
-
About/en-US/COM.adml.xml
-
About/en-US/CipherSuiteOrder.adml.xml
-
About/en-US/Conf.adml.xml
-
About/en-US/ControlPanel.adml.xml
-
About/en-US/ControlPanelDisplay.adml.xml
-
About/en-US/Cpls.adml.xml
-
About/en-US/CredSsp.adml.xml
-
About/en-US/CredUI.adml.xml
-
About/en-US/CredentialProviders.adml.xml
-
About/en-US/CtrlAltDel.adml.xml
-
About/en-US/DCOM.adml.xml
-
About/en-US/DFS.adml.xml
-
About/en-US/DWM.adml.xml
-
About/en-US/Desktop.adml.xml
-
About/en-US/DeviceCompat.adml.xml
-
About/en-US/DeviceInstallation.adml.xml
-
About/en-US/DeviceSetup.adml.xml
-
About/en-US/DigitalLocker.adml.xml
-
About/en-US/DiskDiagnostic.adml.xml
-
About/en-US/DiskNVCache.adml.xml
-
About/en-US/DiskQuota.adml.xml
-
About/en-US/DistributedLinkTracking.adml.xml
-
About/en-US/DnsClient.adml.xml
-
About/en-US/EAIME.adml.xml
-
About/en-US/EarlyLaunchAM.adml
-
About/en-US/EdgeUI.adml.xml
-
About/en-US/EncryptFilesonMove.adml.xml
-
About/en-US/ErrorReporting.adml.xml
-
About/en-US/EventForwarding.adml.xml
-
About/en-US/EventLog.adml.xml
-
About/en-US/EventViewer.adml.xml
-
About/en-US/Explorer.adml.xml
-
About/en-US/ExternalBoot.adml.xml
-
About/en-US/FileHistory.adml.xml
-
About/en-US/FileRecovery.adml.xml
-
About/en-US/FileRevocation.adml.xml
-
About/en-US/FileServerVSSProvider.adml.xml
-
About/en-US/FileSys.adml.xml
-
About/en-US/FolderRedirection.adml.xml
-
About/en-US/FramePanes.adml.xml
-
About/en-US/GameExplorer.adml.xml
-
About/en-US/Globalization.adml.xml
-
About/en-US/GroupPolicy-Server.adml.xml
-
About/en-US/GroupPolicy.adml.xml
-
About/en-US/GroupPolicyPreferences.adml.xml
-
About/en-US/Help.adml.xml
-
About/en-US/HelpAndSupport.adml.xml
-
About/en-US/ICM.adml.xml
-
About/en-US/IIS.adml.xml
-
About/en-US/InetRes.adml.xml
-
About/en-US/InkWatson.adml.xml
-
About/en-US/KDC.adml.xml
-
About/en-US/Kerberos.adml.xml
-
About/en-US/LanmanServer.adml.xml
-
About/en-US/LeakDiagnostic.adml.xml
-
About/en-US/LinkLayerTopologyDiscovery.adml.xml
-
About/en-US/LocationProviderAdm.adml.xml
-
About/en-US/Logon.adml.xml
-
About/en-US/MMC.adml.xml
-
About/en-US/MMCSnapIns2.adml.xml
-
About/en-US/MMCSnapins.adml.xml
-
About/en-US/MSDT.adml.xml
-
About/en-US/MSI.adml.xml
-
About/en-US/MediaCenter.adml.xml
-
About/en-US/MobilePCMobilityCenter.adml.xml
-
About/en-US/MobilePCPresentationSettings.adml.xml
-
About/en-US/Msi-FileRecovery.adml.xml
-
About/en-US/NAPXPQec.adml.xml
-
About/en-US/NCSI.adml.xml
-
About/en-US/Netlogon.adml.xml
-
About/en-US/NetworkConnections.adml.xml
-
About/en-US/NetworkIsolation.adml
-
About/en-US/NetworkProjection.adml.xml
-
About/en-US/OfflineFiles.adml.xml
-
About/en-US/P2P-pnrp.adml.xml
-
About/en-US/ParentalControls.adml.xml
-
About/en-US/PeerToPeerCaching.adml.xml
-
About/en-US/PenTraining.adml.xml
-
About/en-US/PerformanceDiagnostics.adml.xml
-
About/en-US/PerformancePerftrack.adml.xml
-
About/en-US/Power.adml.xml
-
About/en-US/PowerShellExecutionPolicy.adml.xml
-
About/en-US/PreviousVersions.adml.xml
-
About/en-US/Printing.adml.xml
-
About/en-US/Printing2.adml.xml
-
About/en-US/Programs.adml.xml
-
About/en-US/PswdSync.adml.xml
-
About/en-US/QOS.adml.xml
-
About/en-US/RPC.adml.xml
-
About/en-US/RacWmiProv.adml.xml
-
About/en-US/Radar.adml.xml
-
About/en-US/ReAgent.adml.xml
-
About/en-US/Reliability.adml.xml
-
About/en-US/RemoteAssistance.adml.xml
-
About/en-US/RemovableStorage.adml.xml
-
About/en-US/Scripts.adml.xml
-
About/en-US/Securitycenter.adml.xml
-
About/en-US/Sensors.adml.xml
-
About/en-US/ServerManager.adml.xml
-
About/en-US/Servicing.adml.xml
-
About/en-US/SettingSync.adml.xml
-
About/en-US/Setup.adml.xml
-
About/en-US/SharedFolders.adml.xml
-
About/en-US/Sharing.adml.xml
-
About/en-US/Shell-CommandPrompt-RegEditTools.adml.xml
-
About/en-US/ShellWelcomeCenter.adml.xml
-
About/en-US/Sidebar.adml.xml
-
About/en-US/SkyDrive.adml.xml
-
About/en-US/Smartcard.adml.xml
-
About/en-US/Snis.adml.xml
-
About/en-US/Snmp.adml.xml
-
About/en-US/SoundRec.adml.xml
-
About/en-US/StartMenu.adml.xml
-
About/en-US/SystemRestore.adml.xml
-
About/en-US/TPM.adml.xml
-
About/en-US/TabletPCInputPanel.adml.xml
-
About/en-US/TabletShell.adml.xml
-
About/en-US/TaskScheduler.adml.xml
-
About/en-US/Taskbar.adml.xml
-
About/en-US/TerminalServer-Server.adml.xml
-
About/en-US/TerminalServer.adml.xml
-
About/en-US/Thumbnails.adml.xml
-
About/en-US/TouchInput.adml.xml
-
About/en-US/UserProfiles.adml.xml
-
About/en-US/VolumeEncryption.adml.xml
-
About/en-US/W32Time.adml.xml
-
About/en-US/WCM.adml.xml
-
About/en-US/WDI.adml.xml
-
About/en-US/WPN.adml.xml
-
About/en-US/WinCal.adml.xml
-
About/en-US/WinInit.adml.xml
-
About/en-US/WinLogon.adml.xml
-
About/en-US/Windows.adml.xml
-
About/en-US/WindowsAnytimeUpgrade.adml.xml
-
About/en-US/WindowsBackup.adml.xml
-
About/en-US/WindowsColorSystem.adml.xml
-
About/en-US/WindowsConnectNow.adml.xml
-
About/en-US/WindowsDefender.adml
-
About/en-US/WindowsExplorer.adml.xml
-
About/en-US/WindowsFileProtection.adml.xml
-
About/en-US/WindowsFirewall.adml.xml
-
About/en-US/WindowsMail.adml.xml
-
About/en-US/WindowsMediaDRM.adml.xml
-
About/en-US/WindowsMediaPlayer.adml.xml
-
About/en-US/WindowsMessenger.adml.xml
-
About/en-US/WindowsProducts.adml.xml
-
About/en-US/WindowsRemoteManagement.adml.xml
-
About/en-US/WindowsRemoteShell.adml.xml
-
About/en-US/WindowsServer.adml.xml
-
About/en-US/WindowsUpdate.adml.xml
-
About/en-US/Winsrv.adml.xml
-
About/en-US/WordWheel.adml.xml
-
About/en-US/WorkFolders-Client.adml.xml
-
About/en-US/WorkplaceJoin.adml.xml
-
About/en-US/fthsvc.adml.xml
-
About/en-US/hotspotauth.adml.xml
-
About/en-US/iSCSI.adml.xml
-
About/en-US/msched.adml.xml
-
About/en-US/nca.adml
-
About/en-US/pca.adml.xml
-
About/en-US/sdiageng.adml.xml
-
About/en-US/srm-fci.adml.xml
-
About/en-US/tcpip.adml.xml
-
About/en-US/wlansvc.adml.xml
-
About/en-US/wwansvc.adml.xml
-
About/hotspotauth.admx
-
About/iSCSI.admx
-
About/inetres.admx.xml
-
About/kdc.admx
-
About/msched.admx.xml
-
About/nca.admx
-
About/pca.admx
-
About/sdiageng.admx
-
About/srm-fci.admx
-
About/tcpip.admx.xml
-
About/wlansvc.admx.xml
-
About/wwansvc.admx.xml
-
Setup.exe.exe windows x86
393a67e714293f1e54fc33b6ca9fcd46
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptCreateHash
CryptDecrypt
CryptAcquireContextW
CryptDeriveKey
kernel32
VirtualProtect
Sleep
CloseHandle
GetTickCount
RtlFillMemory
msvbvm60
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaStrErrVarCopy
_adj_fprem1
__vbaVarCmpNe
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord594
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVarNull
_CIsin
__vbaErase
__vbaVarZero
ord632
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaVarTstEq
ord638
DllFunctionCall
__vbaVarOr
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord713
ord606
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord644
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
ord616
__vbaVarCopy
_CIatan
__vbaCastObj
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
ord653
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
Sections
.text Size: 400KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ