O� ���{xکVF�Qېl�*G��<^��xnb=��D#��g�:�����v�/�q#(}��_�y�}7y$V�{�ۦ��y���vp&�$o��;p��zt��(/A5�P 71Vml�� J�$>;�y��%.�� �������W���*�=jrl�g�F� L&��ٗ�n����}����*��!��W����{����T��&� �d�q���\�cΌZ���T^Rʀ`|�D��YD�%�!"c;d�+Ś�@RpW]].��'���^Cd�ʇW�w=>1d�H��G����?ý�Ct�K������<k(��Jj���YM�ʫPz��Ր�B�$���p���+@:���@�~=�]���퇯E�&�L'/�R�$��ojX#��W����R�I�Ni�l�9���i�=�ˀۈ���|�qʎ�"�ȽC[`���<�ןrX:c�L=sx@0XG��w�1��E0G��ز��ۺNE�2N#� �NCl���BCޝ@����G��̽�n��H*�t�1S���Î�������fKz�sܰ�R!TU��Q?������b�i�z�������d&Tv�!�^Wr��CV������[�F��<�XuD���Γ�Q�w��x&�cc�Ix\����5G���+x��1.�>j��o$#0g@w��2W��� h2�k>��Kc�+a���M�H�QM�u��'Z5�@�1�����{��=Y/���c�DN�,7$�R���v��Y�mwŠ�E{oЩU`5/��w�ְ�� �cd�GTX ���a:&��=㸉du�j:IMUW��C`XkB��#���7�D���}�>���Z">[Lo��F0������Āu��̈���9�i��|�~�cg���i՝�.0,��ˢ����x��_]�.��/S�6T���xE��,�`b��Z�-'im3�7g�2�~Қt}�aҔ� ��m����8�Z���^sV�>[�DgK[�{.�]�8� ����AP̷oY��/U�_���;�ݑ`e����o8�q����U���!�zs��y==����Uo�a���X~�]{�h2֮?8$������X �] *�ֹ< �OC�@0���Hf����IK���?>V0ot��DY��1�� ƈڨ���Gp�&h+���M�Fٙ3A���]F�x�=ॢ퇵7��j�o�17�l����'qJJ!����M��"f$�e��?�&�d��Y \?�mk�Won���������ߢYO�������zZ��W�\�����Y�w�N3���/"f��7J��驚Z2��KY\�*nz��9�q��|V��a��_�fՍq� f�V�`;7;^�$$���/��M����� �|��Pe���/r���ϕ��>�y�����e��]J"U�pc��sJoI�U���b���4���yr!�z'�S�J�2���.�{_���6Ƅq ŧ.t.�d �dlc��� �ViN"�P7�Y����w���$���\W��c�{j��gC�/��D�3CQ����m>�^�{���l�2 G3BI �G�ؿt��t������6�I�e���%�����u������|ʙ�/����L�r<ZeN%}7���R�"�]���Ƞy'�Ё!����܁�i�/���&�_��#��٬�`����H>���Z�8���UR����p��*�(������ELK��³xn��v��2͘$�Ύ�H���h0�f�r����0�lS&�P�$a')A�: �A�F� ��װ�7&��)J����O�m���}�@��E�0H��c��������� ���N|Y�o���+A�Wr��Wi���4ǯC,0?���1hz9�+��6Q���3�C��6F�B�j^B�ו_�����DLǂ]�*(e*(�3�X��!\��/�V�5������Kަ�H�� �l~�r�i��`�R���h�t�5����}���V��\z�?�&�5=�,R���5�d�=����^�<ͅ4�\�`4����k@ԭ3��;�v��A>���jtќ�t��s�݂�y!�X�E7�T��`��E��� ,k,��Ԙ-o���Ȭ�,����?p<��� Z�xi��B8x��� �\c�Үk�lu>of�X�"xry�`ky��w\��t�,=oi�O��i���������¼�C���1E]D<`��%��9�u�=��<��Α�.���ˢ�k���;�C:l�십8ʟY��"�k����'��j��#�I�f�����Iz�8(��f�=�-Hn�BG�������բ�F�W�sx�P>Tv;�m���oi��|���4�g��äE�yy.59��3�yq��z��$Kjq ��be���/αv��7�֍���- 30��8k���К�� o����l�U�W �OD�S`�PQSD5��6�[W����f�n�3�ܝ2IK�b{q���e���"�&B }pq=�e�X��Df$Q��)��4��s=�ņ���:�d��/�{�T�g~L6���gk��b�g"�N�rk�<:��T���~�/�}���#H�V5#~�G������Z3&��i}JI��;�uwv-h]����]��R#rB֜�c��7��[̈́9[�h>.���3�V���Rmy���B��̺���6h����ʂ{��U��PiPMg�����R���F�\a�%���,��� WX�� I��GJ(��fM��Z�)\�w0�k+��I�s�M�Dk8C�����n��=,(j$� ���Oo��L즳jAҁ-��������0�A8jD��B�=uds�������-���E+����ʦ���.&t�WU�8�����?�$Ȟ�n;l��������xF7 �"G������MU{���c���Γ?_(�>^���.����E*�=���&D5�ot�)./\Tu�-��K�Ř���f�h� ��/Q���Þ�����.���.�0MB��6�+F�Kw�����A������Ng��"^|��'���*���*D�@����mHW��3�<�.C#��lj�~t����ͣGG��fڪH*�t��A�T����q��w"� n��J����V!�ҳ������I>�kKU*
Static task
static1
Behavioral task
behavioral1
Sample
AppSetup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AppSetup.exe
Resource
win10v2004-20230220-en
General
-
Target
AppSetup.exe
-
Size
13.4MB
-
MD5
05c1042c7dfe7b64efcfbcf76656a71b
-
SHA1
dd0c0755bd5fc9fb2492130ba633a267ad95daa8
-
SHA256
8cddb13beb02bd705fa2497dc29cf5cd336b8de6427716aec08e867694a1a519
-
SHA512
34a552f0b3d307976296fb72f5cf8f420ac883e50f1b78ebd733a43200e3f6db1667e6c3567eec51adc58d49a0a0c8f6e2481f6a6316c6d3308388511318b832
-
SSDEEP
393216:FtnqhPeUX0kLX/wCAYp9bFCJmow2Lv0FR:jqB3X/w0HJgvji
Malware Config
Signatures
Files
-
AppSetup.exe.exe windows x86
69ced1ad11dc0af68759e861c3ff436a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetFontLanguageInfo
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?Kp Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Ai6 Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?4S Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ