Setup-Latest[.]exe

resource
Setup-Latest.exe

Setup-Latest.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 721f6073f9ec13d9a1b7cff7b7cfab342ec6fd5ebc1a95c006ae11198e8abfc9
MD5 d905d14928e2766285ed7ca83eaaf4b3
SHA1 5d27b2c538c81f7819f7de1071c28ecd03c5bd2e
SHA512 88862cdfde9a0bbedad8f16c0387ac305802434daf55e813614d33383edca078fea89f65ceea0f79d60582739807f8a23ce7f7f2083f56e7bed191305dea7619
SSDEEP 24576:oGXt9+6qjfYMk9qXo1UPDPdDoIKgweD1F4h/ym4iB5ePtH4M/d8rOn21:ZXt9+nfUsSs1oIK+7Kv5e1D/6rO21
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

359KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Complimentary.mp4

SHA256 f025d7132a2c77bd9c87c3707fef4ab64cc162df67b6727432c9831bdf11bba9
MD5 42198da674d4400e907aeb635db5bcd1
SHA1 662eddc12e98c75c654cb6a458ad31b1c9e8314e
SHA512 ec32a212887f783ce1469efba7e440bee22e07e591a11ce4ed6fb0634f04ad8897e4af5ca33430b90b066894518f5fd2e2533306249b266a77bc218b9f3a1e82
SSDEEP 1536:TFyNgUyeb/zTf5PlApu1UY/V7cIvfe1GV:42UHb/f5Psu9V7BvfN
MD5 SHA1 SHA512 SSDEEP

$TEMP/Darkness.mp4

SHA256 b4337e189ed65c122965008a94764c34fc61ad4796f62c3a407bb758d50fb482
MD5 acda51733a848a5c4a9d1381effc0823
SHA1 196639ca7174c9d1e817d042a5cc6703e4f7c804
SHA512 cc01602b242d832d38c86985fc64f7b92e1592e615eb46372a2d5adccca0e599f6053262a98774774f0dcdf083c5bbf9618a6b678a8c53a9c2881a99b783ee8b
SSDEEP 1536:n7KTPXmnpm3M4oiEjfyqp7rUfbFMYafRxCTNARqbOxRl/TVRTsfIXKXqd:n7UASM4fEjJ7rb5LCpAkbOxRV/TaIaXU
MD5 SHA1 SHA512 SSDEEP

$TEMP/Funding.mp4

SHA256 7b43310d8618c20e573df349732318096a3ce767e961291063885b1fcd46f09a
MD5 a066f57f4d5cae1ea0b806c0e1587133
SHA1 a4905e6345d73086429135f327a3c77f52090f90
SHA512 618478494c12809418207abae29159cb7d1128eb08d708f9dcb5dede933d4ca6ad488179e253dbaedb4e3b51ddef43ecaa82470bdaed53983d51165163501bf2
SSDEEP 1536:uneKSn9qjv0EsYW80dqjgcX4bzuMu4YLzkkr3+ZC2h1QLraxGH2EB:uNSSvRs38hmSDdzkkrI1+axGWe
MD5 SHA1 SHA512 SSDEEP

$TEMP/Oaks.mp4

SHA256 31ef6bdde2159cf40ba21dc10c0a24918fc2a93808343fb2b55679558477718f
MD5 5ea3b8b3c56ee7d1351b01cb894d37fb
SHA1 cdfb9e72f0463fd5110f20c2e3d68c2ce1979c6c
SHA512 ab83f5ab0ef9e6abcaa7a29400b6d2e75d92771191f5b8a4ae107efb6f1e891f6a9565c2fe0c684073aa9a10eb6802067811d4bb90109357dcba6800ba00bb37
SSDEEP 1536:ChYwoz3JBCfmLj6irSrB5y67uj5aszsRYZmBgxepzeq/jEyln2gjGwl7RNiyU:eYww3JBmmLjlrSrf7W53JoBgkleqbEMA
MD5 SHA1 SHA512 SSDEEP

$TEMP/Relate.mp4

SHA256 97992cc1ebb37ae53971ad56e234e8157cca8d93c69497747c9fb77eaae8e050
MD5 fec8e7ab6aad11105bf0c6cfd0303849
SHA1 f497af8ef0f220f5a88dce5871c8ae072782e8de
SHA512 f2cbb554bf6c4f371a894a4cfe27584b6e6d8c7fc052fe9a912e9482ba5cb4c9986f12dfa815153175e187575225a91fd1aaaadf882d549c68c55fcaaa61feb8
SSDEEP 1536:4hRRNQUI7rdU1UDl5nD9glLCxGsASWrTy:4hRDwxsilJD9gFCxGsPf
MD5 SHA1 SHA512 SSDEEP

$TEMP/Strikes.mp4

SHA256 fdeecbf6166f5ceff982c7a4131589ca3af7f71f8b5c4f4babfaa53b973d9edf
MD5 6dc907cad908b929ca1f16c09eccc57b
SHA1 89c98295b3caf422021b966d3f0df18e83ca70f5
SHA512 153351cf07d1622be5182e6af4f45d7c1cd28121cd2034677a7358eae5b52f5b47a4ab82f1464923bae6716eaa5c2f91703d97e79d117e6006374ff3791c83ae
SSDEEP 1536:BWTUkNhPcMSPVpVeJN4oR7q8UODkTYRMJn6/ju9xPR3jrwK35t4E:BWTxNhPcMStXeJhq8VkTh6YxJ33wsbz
MD5 SHA1 SHA512 SSDEEP

OasisTon/Always.mp4

SHA256 a38ef22b27199ffe04dcd923df199c475ab63e2b31943ae72f3a37f6161349c1
MD5 8a00b16dc3b76945617792cc65186bf6
SHA1 7ed328ccfd7e0e3617935e40fdd62958d86cd262
SHA512 02ea60b55acf4de07d8da8573290bd8f12b1e546a71050f979bf4ccc60f500ebe35f73ea0063130784cb0ac7023eb6228650664e51e22583627c13b875cf5358
SSDEEP 6144:DN9qPTbjHx/odUKCCYfpQ4AW6YaHzXt7r6jFZk3NAM/eXNwVySGOy6eCkgnnJCT:hkP7BoEp16YEXt/yFWAMmdwVHj7LnU
MD5 SHA1 SHA512 SSDEEP

Accountability

SHA256 7dcff8d7a4b6cb306dc97f5f7db57a36e56e13a1cfc17d3ab9836e9b5785ca59
MD5 f698f3b6bd4fd4c90ed5935292eb2bfe
SHA1 2db7423ae317279ae1372fc3cf8ff2460656c38a
SHA512 5d2601379130fa22d11fe1f9d6d399bfa4236066e8c0624cd2fa077792fda27496d1663b22890a0dd1279e4abc21c3ab28af97791cf5679e178ba335bfb548e5
SSDEEP 3072:gPtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj04:OCOMVIPPL/sZ7HS3zcNPj04
MD5 SHA1 SHA512 SSDEEP

Decorating

SHA256 0e93c1bb7974b0786d02f13fe1639c6e6ec7272f8621ac48bd06a776fa89bc9b
MD5 36b2425ac79b2809a72223b7ae0cb33d
SHA1 7919b6f47c5ea581150023c38fa002bbac236c1b
SHA512 97549dcb3bf11301ec222af0a4675e438373312f73ee7d2a43649f985e19545d69bde65398b8fe8d8bee0a0cada92dbf6197e4f06cbc57ad38a4c6d306c94cf5
SSDEEP 1536:rKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uS:b6whxjgarB/5elDWy4S
MD5 SHA1 SHA512 SSDEEP

Exhibits

SHA256 711a009fc9914b08d16b79013fa4e70a3de2a50b83388b89a138ab2c54e0e62c
MD5 b5377b1f52750982fdd6cad5b4e0af57
SHA1 fd12abeec698a60ddc8e1f8034fbcfc2adf38ecd
SHA512 8fcf1254ead772c2d1d0c5425b81ce6ea7703872ab5a83e43abb8de54ca8fdcee164d7f3873e8f8f1a44f88882e4a9ecc1f1f5ba658bbef2643a62e07c9cead9
SSDEEP 768:FdimkIXqURPN2mldrfa04VQv7Qf0VosQE7YmFdni8yDJ6bV6ybB:FyI7P4Cxi8q0vQEcmFdni8yDGVFB
MD5 SHA1 SHA512 SSDEEP

Fails

SHA256 285566e938aa29aa79b3f4091e00241c9b727c087f845782a062290d6d433556
MD5 e944bd961e9991ce3f56c2f01297f2da
SHA1 b44defd6fc45dec2b78a737338252e5d3a6f6af6
SHA512 3e7ecf91c321c5dafd2b794bebc994d5b1128d227c48482b68ef5aff3094c32339fbbd20de788aae9ded3c15655cfc3bf989fc8bf23770da8831376abe5b48ad
SSDEEP 3072:4EoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLtG:4Eo3tb2j6AUkB0CThp6vmVnjpG
MD5 SHA1 SHA512 SSDEEP

Labor

SHA256 2a00e6652dd2c4b5be810fc60be8da1d6a75443c98387ff9a23c42fb7013e894
MD5 0bb664eeffb2a88d13658da64847afef
SHA1 df934ca820f5a29682259241ce704c8711b174fe
SHA512 ef6194a216815f9554b58f019897df8f6068616b5ab5873dd6e7482445d68e68da5aa4eeed9ee3c649aa61891afa1b7bcf9903603d3843c64bd62286c597b4fd
MD5 SHA1 SHA512

Pavilion

SHA256 1fe97df39faa189ec1b9106e2745590adc28b4d53a69e1dcf52d163913114877
MD5 51a069ed9281718f826d41478b0a7549
SHA1 70b6e51126dc21bedf646fc640dd623c88bdc431
SHA512 fd2a5353f8cbe0432fc6840c568828fd4f21a6aa3c981311ad9034b5b542bddc73e32b117b952ad66868dcba0eb5fdbbd7ed33b97f0b19ec444e4ab977f8a544
SSDEEP 3072:WfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfF:WfhnvO5bLezWWt/Dd314V14ZgP0w
MD5 SHA1 SHA512 SSDEEP

Suggestions

SHA256 d56ee71b68b9da84bee2d64a83f0d3c1dd80b8e27d9bcc240f068dfbb24425e2
MD5 278722175e3d420cb44282477c2811e9
SHA1 f7246a2b43dc80493bc9c2e27dbb0794cace09c8
SHA512 75a30b2349f72209e3de32e8c66a28000af53319adfeb14092691ecc79b6da2c0e68d8a65762e93ed5032d790bc5f4ce04e15fb225ba4b169cced0470a3073d4
SSDEEP 1536:J6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPt:Jq8QLeAg0Fuz08XvBNbjaAtsPt
MD5 SHA1 SHA512 SSDEEP

Textbooks

SHA256 4cb81dbc3c21bc612b3e70bbcc515e4b99f7a82b8c39fbec2315d430b30fa53c
MD5 bf83026f801f9ff754fc88d937ca1e08
SHA1 995f512e1452d7b1b8bf6acc1cad4a97e5d67138
SHA512 eb3fb93ca0982f0b2dbc70694fe0ab0c151d67c3c58025951593384cc020eb7006faef99ef8f5344a9a0a74698f5c332f34826180f223b77782912263b4459c0
SSDEEP 1536:ixv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbY:g5mjccBiqXvpgF4qv+32eOyKODOSpQSB
MD5 SHA1 SHA512 SSDEEP

Uniform

SHA256 e7ede2194b1c1c501a5d61f2365e42e8a9f186b036a639163165bf6737cd73b1
MD5 61dfe44d20eeea4e73f494d30a371f8f
SHA1 6bd26783b24f1a4e1813f5c1b1d5ee3d215c39da
SHA512 211e140a4d9064f6011c346bdd016de7d38a823457029e0a13ecd8989c09a4c81509a7adcfda1b05553b04c9d186c2000c691b566d21e5ae3c452cbbe3641f29
SSDEEP 3072:/g5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfr:45vPeDkjGgQaE/loUDtfr
MD5 SHA1 SHA512 SSDEEP

Volunteers

SHA256 7e530d5163218b0ca02450150218a0f24c6f8179dfbd31b58121604115ad8362
MD5 6dff01d20dac1df6b76115a500a13a94
SHA1 71bc9419b18568112d2cb9eb6a85e017850c2391
SHA512 f3f75f8d251724381d526373bba5f716a4c9f57593f825bfb40444fae25ca2e2e3f27ed1e07abcede3e03f0c3428a0905073b0e67c56376764a1a44753748909
SSDEEP 1536:Wo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:WNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

OasisTon/Fares.mp4

SHA256 0f27ee47c58241bc7c6d5a1b2f7f1fe731236470f01e09cf2bd92368dd4a25ff
MD5 76d4ff100c071819b2de04ceab6750de
SHA1 937989af928f319b5a4a7d40a0a16489524856cc
SHA512 1d14fc8c5c759781377011fa6b91fa835da529fb967b55a6621847b2d8434d8233cfaf771cc304fed4d14cbfe05f1c8505b082e7326e7725de21dae642358133
SSDEEP 1536:uBOWz+HX19EjSTAq3O0PYu1O1UbwtxGSFI07qip9c4nX7x68GPEp+BAt:uBjy9G8Aq+4Yu1O1UEtxGSFIu/EPLAt
MD5 SHA1 SHA512 SSDEEP

OasisTon/Wide.mp4

SHA256 f9dffd2a81287e0c2cb1bb77f33e7000bfd875f6adc796ee9e1bfbc6b6b9f083
MD5 7e4cf5266498c16090ba55f200f39973
SHA1 76d6cfa9c48d5ec5dc2410a61dfff30343434390
SHA512 3ae8d7f61b9d28832b44b41a9f7d6c82c75b32ab745d93953c8e1cbe1e4da2dec4928cb958d09c79b1b41788f023ad12fc554d34e6de3310a6f480bb6f8c167c
SSDEEP 384:dwaVOOqcLlU/xHZdwb5029PJK5e3KkTg5o5YILnweV4SknBO:diOq0lGPS02BJEe3KjaweknI
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

Setup-Latest.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Complimentary.mp4

$TEMP/Darkness.mp4

$TEMP/Funding.mp4

$TEMP/Oaks.mp4

$TEMP/Relate.mp4

$TEMP/Strikes.mp4

OasisTon/Always.mp4

Accountability

Decorating

Exhibits

Fails

Labor

Pavilion

Suggestions

Textbooks

Uniform

Volunteers

OasisTon/Fares.mp4

OasisTon/Wide.mp4