setup.rar
- SHA256 4c766e41228e753ca2aac56fe5db8a2e2133692ebd13e6260a26b92bbbec7fd3
Password
Discount2026@27
Overview
overview
10Static
static
3setup.rar
windows11-ltsc_2024-x64
1bin/config_6696.bin
windows11-ltsc_2024-x64
3demo/packs...86.rpf
windows11-ltsc_2024-x64
3demo/packs...25.pak
windows11-ltsc_2024-x64
8demo/templ...66.dat
windows11-ltsc_2024-x64
3plugins/mo...98.dll
windows11-ltsc_2024-x64
8setup.exe
windows11-ltsc_2024-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
bin/config_6696.bin
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral3
Sample
demo/packs/content_8186.rpf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral4
Sample
demo/packs/content_8625.pak
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
Behavioral task
behavioral5
Sample
demo/templates/info_7366.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral6
Sample
plugins/module_2598.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral7
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
600 seconds
General
- Target setup.rar
- Size 19.3MB
- Sample260816-papsasdb44
- SHA256 4c766e41228e753ca2aac56fe5db8a2e2133692ebd13e6260a26b92bbbec7fd3
- MD5 4f0fcb3d97cc7097f437e69944963b8f
- SHA1 f5af74e31aebf172b0b1f01abd0c3bb33a47e45d
- SHA512 9b42a77cf5d574da5b0325593da923b6ee8d878fa0acec209bc406269abc48b91b3e036edf494614b324d81a5d1557e77cf492b27d788b6a59d24f039b847c09
- SSDEEP 393216:fT8DlcgJT/fZEY+GdOeafVp3gLxTuBN3ORNY4Z0VSzDa4Z1aT9dzOJmWs:fT8bJT/fZDaNpQ3nZgCnZovzOJs
- TLSH T17A173369DE3CBC023F551B7A3D0A8E850C22DA33541AF1A995374D6EDE61938DCE1F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/setup.exe
File Explorer
-
setup.rar.rar 19.3MB
-
bin/config_6696.bin13.0MB
-
demo/packs/content_8186.rpf2.2MB
-
demo/packs/content_8625.pak2.3MB
-
demo/templates/info_7366.dat819KB
-
plugins/module_2598.dll2.7MB
-
setup.exe.exe 983.0MB
bin/config_6696.bin
- SHA256 b7979a902440a70cb7504c92cc8d109538afdd949a410b4be67adb88c8bb6ace
- MD5 9cfae0aa4a45eea822cb180c92c2bea3
- SHA1 b152b3094200ba48893b5707757b9d3740c82eed
- SHA512 a37b967cacb30dd57eb2f39af1098cd8aca6ca0e30d7b2f52b4d035928b69cda29988c310e671fb936ea0b23490c3313dfd3cee0fc1bf96a4b68437d39a45c9d
- SSDEEP 393216:0NxVZIQLs6IKgTfXt9JYBxGkIYsZOuNPdtI8wnD:koQoK8ABuNvjs
- TLSH T1FAD6C0F994203088E743C9D485E973C09C832554EB155465392B5A9AAC3AC3BE73BFBF
- MD5 SHA1 SHA512 SSDEEP TLSH
demo/packs/content_8186.rpf
- SHA256 9bcb359ae04e7bbf184241c28829546fa6a42ae30d3dbdf29a98d26d28b08d40
- MD5 c8db0458bc52035037ac28b0cc3069e7
- SHA1 5195f036c1be6953ee63f696436f4c4a6de3d515
- SHA512 5d2389c38bd03a672b0bde59e4f11644a4c6b2dafd8352d24f3050a32ce538e0275913ed53ef8b49e6d1d7457a33916005cda5b01b4254a7266fbebe26d86414
- SSDEEP 49152:cXLaUYh/9eTKOyyc2B7nTaK7mpoA9nAsSPycqvUdB7suZI:YO1UTTV9TaK7So2x4x77Vm
- TLSH T146B5CFA0A7B74DD7D2D2622DF46F3B6BB51628864E4D1469707F2FC34CB28161B37A80
- MD5 SHA1 SHA512 SSDEEP TLSH
demo/packs/content_8625.pak
- SHA256 c48c6045277fb97cb87e461f24e80817974c1c314dbb84e9942fdab2c69e0ea3
- MD5 122c87a8b68b2e2baa1951916b6752df
- SHA1 5828b000f0c8877ccffe0a0f59aa3a05e25782f9
- SHA512 2a45b3d7cb377b705f7933f413b7ba4ed20dc0c8f1a968bc4ef872e4e90765d71d690c21e55fdd8af32dfd44df708ba43cc6f22a1af1f93fc18182ab4d4f2300
- SSDEEP 49152:b4TpQkLFQ/py9YoiOMCs0nu6tQJedktTehinhRKJzN9kPaai:b4TDLF2py9nNnu6EDTWinhRKJz
- TLSH T1EEB5D1137462230135397A6B1469A4B57C4BF8153C672C7EBF0ED423F4B8F1A584BAAE
- MD5 SHA1 SHA512 SSDEEP TLSH
demo/templates/info_7366.dat
- SHA256 9ef80bf60ec98a7e876f554343ab4382069c6ac61186ce77585bb4057e1e0a64
- MD5 aaab4f8872c50a6495c94c746d3b74ab
- SHA1 622926c2a7c1667086d6851aa813326a3ca47be5
- SHA512 4fb8b6c0a9a96f65fc7f7208f45fe9d56696ff0555c99b2f712836ddf600b80734bc4e6127a9356d954bafa03691a5a95479b3530305976599b67edf7e6d05d4
- SSDEEP 24576:AZ2YlnR5qvpWgNs1uHFdJr3ZlDF813JdislJ:AsYVRQ1CMHpzZtF81Ku
- TLSH T1F105D04993281978B86F7EE340E35B72DE471AEB13CBB05EAF9C58D0BF449385E41642
- MD5 SHA1 SHA512 SSDEEP TLSH
plugins/module_2598.dll
- SHA256 72cc383ee039d2a5337c744268a6e49eb6c934d0705c39f3d6ea12b589310515
- MD5 fb602952a514f6960feb784a2873c68c
- SHA1 84fd40c25b353fb75813557914e89168ca279e98
- SHA512 3ecce5b87f185ba390647d8d2720dc6c1e9358de71c43bc7d5aaded1e1369239335d5d91ab83fc7f3065f6f76cde638d096ece2a155604c940054de3ca7478bc
- SSDEEP 49152:rADOW4PKx46aN6kvDv0wpQP62H9uL/M50XG8US1iET+Hr64BlVNwqYDY+sPnPcO9:rADT0848kvDrpQi2H9CU0bH+LjlVNwjk
- TLSH T137D5CFFBD6081E89EBF48674E6C77290B1C3A492F3822414635D13D3E9B094A57CA7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
setup.exe
- IMPHASH 4cea7ae85c87ddc7295d39ff9cda31d1
- SHA256 ab5049a84631f9e17a8cc640a594526b805948a11f959b81d68cef8faf0baa14
- MD5 a1d487b5cc9fa6f8681df4121f08b38f
- SHA1 d306cd755bd13c4f3dececeb05a90a2d759213a9
- SHA512 39b97cc26fd2455a888468f72f9bcd53e3644b651a4d5d9100554fd8f3a5ddf06a1aed2745c3329d1b3b30c9831672a9dd141802a4cefb3af2749f59d80b5124
- SSDEEP 49152:tNMIYw59DCBikqKuYPGZJjcAueci7V8uFzF8A:tNMIbeckqgPqcAuechup
- TLSH T1DEB9232153D401A7D07E273689F591872A303C865B364ACF2AC4E9693F23EC9F57A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Discount2026@27
Minor OS version
0
Major OS version
10
Entry point
31152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wextract.pdb
advapi32
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
kernel32
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalAlloc
lstrcmpA
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
GetShortPathNameA
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
FindClose
gdi32
GetDeviceCaps
user32
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
GetSystemMetrics
CallWindowProcA
SetWindowTextA
MessageBoxA
SendDlgItemMessageA
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetForegroundWindow
ReleaseDC
EnableWindow
CharNextA
LoadStringA
CharPrevA
EndDialog
MessageBeep
ExitWindowsEx
SetDlgItemTextA
CharUpperA
GetDesktopWindow
PeekMessageA
GetDlgItemTextA
msvcrt
?terminate@@YAXXZ
_commode
_fmode
_acmdln
__C_specific_handler
memset
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
_initterm
memcpy
comctl32
ord17
cabinet
ord20
ord21
ord23
ord22
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
983.0MB
Virtual Size
983.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=26213,
count=2, id=259, version=26213,
count=18, id=260, version=26213,
count=17, id=257, version=26213,
count=160, id=1, productName=Unmarked objects,
count=9, id=264, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,