n���_:�P��'4�OͽR������(�m��M:&�) �K0\ �!��ZM��f��ʚr�+� ���\B )��K`QU�nE��Jw�s=��]v�Rpo�<�UL^m:���i�f�/��yx�o������/}���|vRJbŎ��Q��h�0c�(ø#oj�Ә�w!s������Q*�{���૽cK�\x�<�F�R�ؐ��Z�;��P�!�gZ�^&r�W��:C{�_�g�!*����|D�N�_,n��&"x��8�L�uګ��0m1 ˔w��dao8�U5��%��V�p��^���x��nY�!*�dݸ)�W�]{ ˔I�? 5��e)C�7�hLG-�V���W��Z"�[����%��K��U�k��l�Hp�@Β �:qk������9%v3�L��,l���_�L����W��E���]'&mv3��N��cp�ܹ�x��鱏QO���|�4�y��ߌ���p���PDrV�p[�K۴ܭ����f����H�EG� �l?9y���:&����g��8��>�����m�Z�|�b��A�6����Է=Ʌ�����P�ָd暬�T��kEr_�f��Q�g�Ez�O �y0����(Aݜ�_U3��m3w���*K ���|�F����r�5n�CA;⡰+o>�~A���[7T}&����@�>�P�RF�KV���_�Q�%t���%�����/���1���Լ�<d�UN_�m���!�̉����j�5� �ָ����ŕ�"��c��R�<^C#9�ј����Y�!�& �O8����X�7��(���yJ�A��y�є-�x�+�?���xv���P'+��@V��E��SpV-���1�H�Z���@�;�]��&@��cw�хo�?{2�F�*�d@��P'�O��� =�s2��<Z^�E�4�2�J��RV�]�ĮR8��d�8�ڼ_�)�u�����IF�����<�E�X� �GV� !7�$��������cN%�^)J�_P_�G���}R�8��/�-JE�><��Z�ځ�0;�n�Npm��4TH�XQ.G���Xz�ڈ����`����P29�'Hg�m�-c���a+tWT���m��x 90\�w⏹yW�}�!�G�tټ'c?߯�dkL1��Ĕ����������BO>���/3O%�e���A/�v}~l4���ܖc��&��Cµ�5Q���5��mԙ��ټ���z��ʇ^����A��e�IP���kl� =�U��Ej8p���ܧ2�V�|�������e'�B'����)1��= Oᓯ�f����WR\_�1�y:�cۄSS��o3Ko�e��tZ}���l�^�.�7���?^̿�����DdQV��v=,�!�����?)���,qԵBWQ�����!�(=�'y0��r����N`� )b��������S-F~�رn��@�z+ �z��O?�$H% �Z|fP������a!��c.����?`�W4 ��'��������6f��l�փ��v�B��ղ��'7G�d�IV��)"�>'��r:[2A�H���~�]��d��1���|��V@����E����%!���&{7aE����Z!D�����*�"8 ��N_k=z�2�� �&Nti�X��A�������p��z���̨�"{X�u�|�p>}�$�Bo?PE�R��}h{~F�l�_~�?5�k�����g�y}�Jm�4�o���N�14p�Y�;��d�D{�H�dA��m=FU")��r ��J�1������F�A�=#������2v-˨��h��w|����BDɒ���}[t촑��d=0�LY�n����f�Q�W��B�AJ%�Q��e�"Q��B�È��2�x��'?��}�X��5+"_���G�!����T��.�?�-��'�b,�^�6A+'�y�f m�i�-��c7^a���fo����=�*���^��x�&��+��z=p�Uϔ]n4 ���YjH�TDy��Lq�l�D��!��~�����K�pZ�6x'jY>?��c����>� ���]�ϚC��y%;��6��M����N/L�ՙp��`�FIgɆL�|S��]KZ���g����������z�i�|�����ر��Sݦ���[ ����7R�5�I��M����v�T�S�Z��:��/@�Pn�k�0}0*%抎�n�~|q�k�:��ze}9����nn1�@�M��"���{�|XL!~�#dD�Wn����X�:��H�ܶ��!�º=-�e�'��J��S:xi 0**Ry����CI��b�]�73�:R�c��N�yN���X7�+)�:z5-��"#s;�O���;3��,r���e =.��P��mb�>���ё���@�Oەc\��+���{k������N�lp'̄�i垐��ց�' ���GxqBG����9��N[O��ȗ�2�T%r-#w0���ukcu����|a��3���R��8�q��D|�J�+N�ijF��B%�� ZiYq�>�"��#?R�/�� �����C��V��g�F��mGG�V��D��F t�tH��^�U���i�ݕ� 0�կL��oǧ�y@��n'H�ϝ�4�z�����B�YW8�#0����F �-M��p�$���з�6A}���`y�c�q����@�6Hp���DV�X��WT����6��MX$�����M$��pР*�AZ��s�G��i��L{��q�;��j׆^��OZb�-���6R^H� n���*.�GEf9gG�;���!jL�����?FI���#���X� ����3:2N+�r�;��7�c��,��}�����QGKEڙ u�#S �˗��b��O�qr���։����'�7J�N�K-��|xO���y�\�K#fM������N�F�T�a��3M,n�Vi��Z�����:��4p�*j�j�. >���҂An�����}���0�ɥ��gCp_@�th�j8b�͂�煖�oA��6]�du1�a1������p'-�֥� \{�>���k�pY��b� ��R��o�w�M��'k(fZ
Static task
static1
Behavioral task
behavioral1
Sample
Setup_File_Trimmed.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Setup_File_Trimmed.exe
Resource
win7-20230220-en
General
-
Target
Setup_File_Trimmed.exe
-
Size
13.5MB
-
MD5
57467cfd4cdf3cc1123de3ffa895946f
-
SHA1
df382c030544651fa78ef20e9ff4fc467c39af5f
-
SHA256
231d3e2182c711e45bef1d389ef9c3b18506ed56a8066b11ce3fa0b8abf33fb2
-
SHA512
dc9d7c9824606cff26eced83de8a51a4e8d2e2068999d80dcd50782fbf0556ce7d2be943279cbb68b52dac330556f5bd6e0179e79f15614dca0ce22877b1bbc0
-
SSDEEP
393216:+UfXAsuQf8MvlhGqu25RYzAZFr3ucdMQBV6TQxSKZjz:+KQWUqucRYcdRMQj6TQ8Yjz
Malware Config
Signatures
Files
-
Setup_File_Trimmed.exe.exe windows x86
16cf5db3878b2dcf0f97ac9d337625cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OffsetRect
CharUpperBuffW
gdi32
GetDeviceCaps
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pDi Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.#c_ Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9[n Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 436KB - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ